Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 1 of 31
`
`
`
`PAUL ANDRE (State Bar No. 196585)
`pandre@kramerlevin.com
`LISA KOBIALKA (State Bar No. 191404)
`lkobialka@kramerlevin.com
`JAMES HANNAH (State Bar No. 237978)
`jhannah@kramerlevin.com
`KRISTOPHER KASTENS (State Bar No. 254797)
`kkastens@kramerlevin.com
`KRAMER LEVIN NAFTALIS & FRANKEL LLP
`990 Marsh Road
`Menlo Park, CA 94025
`Telephone: (650) 752-1700
`Facsimile: (650) 752-1800
`
`Attorneys for Plaintiff
`FINJAN, INC.
`
`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`
`SAN FRANCISCO DIVISION
`
`FINJAN, INC., a Delaware Corporation,
`
`
`
`
`
`
`Plaintiff,
`
`v.
`
`
`JUNIPER NETWORKS, INC., a Delaware
`Corporation,
`
`
`Defendant.
`
`
`
`Case No.: 3:17-cv-05659-WHA
`
`PLAINTIFF FINJAN, INC.’S NOTICE OF
`MOTION AND MOTION FOR SUMMARY
`JUDGMENT OF INRINGEMENT OF CLAIM
`10 OF U.S. PATENT NO. 8,677,494;
`MEMORANDUM OF POINTS AND
`AUTHORITIES
`
`Date:
`Time:
`Courtroom:
`Before:
`
`
`July 26, 2018
`8:00 a.m.
`Courtroom 12, 19th Floor
`Hon. William Alsup
`
`
`
`
`
`
`
`REDACTED VERSION OF DOCUMENT SOUGHT TO BE SEALED
`
`____________________________________________________________________________________
`FINJAN’S NOTICE OF MOTION AND
`CASE NO. 3:17-cv-05659-WHA
`MOTION FOR SUMMARY JUDGMENT
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 2 of 31
`
`
`
`TABLE OF CONTENTS
`
`Page
`
`NOTICE OF MOTION AND MOTION FOR SUMMARY JUDGMENT .............................................1
`
`STATEMENT OF RELIEF SOUGHT .....................................................................................................1
`
`STATEMENT OF THE ISSUES..............................................................................................................2
`
`MEMORANDUM OF POINTS AND AUTHORITIES ..........................................................................2
`
`I.
`
`INTRODUCTION AND STATEMENT OF ISSUES TO BE DECIDED ......................................2
`
`II. STATEMENT OF FACTS ...............................................................................................................3
`
`A. Finjan ......................................................................................................................................3
`
`B. The ‘494 Patent .......................................................................................................................3
`
`1. Claim Constructions for the ‘494 Patent ........................................................................5
`
`2.
`
`Previous Findings of Infringement of the ‘494 Patent ...................................................5
`
`3. Claim 10 of the ‘494 Patent Has Withstood Numerous Validity and
`Patentability Challenges.................................................................................................6
`
`C.
`
`Juniper and the Accused Products ..........................................................................................6
`
`1.
`
`2.
`
`SRX Gateways ...............................................................................................................7
`
`Sky ATP .........................................................................................................................7
`
`D. Discovery ................................................................................................................................9
`
`III.
`
`ARGUMENT ..............................................................................................................................10
`
`A. The Preamble is Non-Limiting, but is Still Met by the Accused Products ...........................10
`
`B. Element 10(a) of the ‘494 Patent is Met by the Accused Products ......................................12
`
`1.
`
`2.
`
`The SRX Gateway is a Receiver ..................................................................................12
`
`The SRX
`
` Software in Sky ATP is a Receiver ......................................................13
`
`C. Element 10(b) of the ‘494 Patent is Met by the Accused Products ......................................14
`
`1. Malware Analysis Pipeline - Static Analysis ...............................................................16
`
`2. Malware Analysis Pipeline - Dynamic Analysis .........................................................18
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`i
`
`CASE NO. 3:17-cv-05659-WHA
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 3 of 31
`
`
`
`3. Doctrine of Equivalents for Element 10(b) ..................................................................20
`
`D. Element 10(c) of the ‘494 Patent is Met by the Accused Products ......................................20
`
`1.
`
`2.
`
`The
`
`The
`
` Management Software is a “Database Manager” ...............................21
`
` includes a “Database” .........................................................................22
`
`3. Doctrine of Equivalents for Element 10(c) ..................................................................24
`
`E.
`
`Juniper Directly Infringes the Claim 10 of the ‘494 Patent ..................................................24
`
`IV.
`
`CONCLUSION ...........................................................................................................................25
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`ii
`
`CASE NO. 3:17-cv-05659-WHA
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 4 of 31
`
`
`
`TABLE OF AUTHORITIES
`
`
`
`Page(s)
`
`Cases
`
`Blue Coat Systems, Inc. v. Finjan, Inc.,
`IPR2016-00890, Paper 2 (P.T.A.B. Apr. 14, 2016) ............................................................................ 6
`
`Blue Coat Systems, Inc. v. Finjan, Inc.,
`IPR2016-01174, Paper 2 (P.T.A.B. Jun. 10, 2016) ............................................................................ 6
`
`Blue Coat Systems, Inc. v. Finjan, Inc.,
`IPR2016-01443, Paper 2 (P.T.A.B. Jul. 15, 2016) ............................................................................. 6
`
`Catalina Mktg. Int’l, Inc. v. Coolsavings.com, Inc.,
`289 F.3d 801 (Fed. Cir. 2002)........................................................................................................... 11
`
`Cisco Systems, Inc. v. Finjan, Inc.,
`IPR2017-02155, Paper 1 (P.T.A.B. Sep. 22, 2017) ............................................................................ 6
`
`Finjan, Inc. v. Blue Coat Systems, LLC,
`No. 15-cv-03295-BLF, 2016 WL 7212322 (N.D. Cal. Dec. 13, 2016) .......................................... 4, 6
`
`Finjan, Inc. v. Blue Coat Sys., Inc.,
`879 F.3d 1299 (Fed. Cir. 2018)....................................................................................................... 3, 6
`
`Finjan, Inc. v. Sophos, Inc.,
`244 F. Supp. 3d 1016 (N.D. Cal. 2017) .......................................................................................... 5, 6
`
`Finjan, Inc. v. Sophos, Inc.,
`No. 14-cv-01197-WHO, 2015 WL 890621 (N.D. Cal. Mar. 2, 2015) ............................................... 5
`
`Finjan, Inc. v. Symantec Corp.,
`No. 14-cv-02998-HSG, 2017 WL 550453 (N.D. Cal. Feb. 10, 2017) ................................................ 5
`
`Novatek, Inc. v. Sollami Co.,
`559 Fed. Appx. 1011 (Fed. Cir. 2014) .............................................................................................. 11
`
`NTP, Inc. v. Research in Motion, Ltd.,
`418 F.3d 1282 (Fed. Cir. 2005)......................................................................................................... 25
`
`Palo Alto Networks, Inc. v. Finjan, Inc.,
`IPR2016-00159, Paper 1 (P.T.A.B. Nov. 06, 2015) ........................................................................... 6
`
`Pfizer, Inc. v. Teva Pharm., USA, Inc.,
`429 F.3d 1364 (Fed. Cir. 2005)......................................................................................................... 10
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`i
`
`CASE NO. 3:17-cv-05659-WHA
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 5 of 31
`
`
`
`Sophos, Inc. v. Finjan, Inc.,
`IPR2015-01022, Paper 1 (P.T.A.B. Apr. 8, 2015) .............................................................................. 6
`
`Symantec Corporation v. Finjan, Inc.,
`IPR2015-01892, Paper 1 (P.T.A.B. Sept. 10, 2015) ........................................................................... 6
`
`Symantec Corporation v. Finjan, Inc.,
`IPR2015-01897, Paper 1 (P.T.A.B. Sept. 11, 2015) ........................................................................... 6
`
`TechSearch, L.L.C. v. Intel Corp.,
`286 F.3d 1360 (Fed. Cir. 2002)......................................................................................................... 10
`
`Statutes
`
`35 U.S.C. § 101 ......................................................................................................................................... 6
`
`35 U.S.C. § 271 ................................................................................................................................. 24, 25
`
`35 U.S.C. §271(a) ............................................................................................................................... 3, 25
`
`Other Authorities
`
`Federal Rules of Civil Procedure 56(a) .................................................................................................. 10
`
`
`
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`ii
`
`CASE NO. 3:17-cv-05659-WHA
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 6 of 31
`
`
`
`NOTICE OF MOTION AND MOTION FOR SUMMARY JUDGMENT
`
`TO ALL PARTIES AND THEIR ATTORNEYS OF RECORD:
`
`PLEASE TAKE NOTICE that on July 26, 2018, at 8:00 a.m., or as soon thereafter as the
`
`matter may be heard by the Honorable William Alsup in Courtroom 12, 19th Floor of the
`
`United States District Court for the Northern District of California, 450 Golden Gate Avenue, San
`
`Francisco, CA 94102, Plaintiff Finjan, Inc. (“Finjan”) moves the Court for an Order granting summary
`
`judgment of infringement in favor of Finjan, that Defendant Juniper Network, Inc. (“Juniper”)
`infringes claim 10 of U.S. Patent No. 8,677,494 (the “’494 Patent”). Ex. 1.1
`
`This Motion is based on this Notice of Motion, the following Memorandum of Points and
`
`Authorities, the Declarations of Dr. Eric Cole and Kristopher Kastens, filed herewith, the pleadings
`
`and papers on file herein, and any evidence and argument presented to the Court at the hearing.
`
`STATEMENT OF RELIEF SOUGHT
`
`Finjan seeks an Order that Juniper infringes Claim 10 of the ‘494 Patent because it uses and
`sells in the United States the following Juniper products: (1) Juniper’s SRX Gateways2 used in
`combination with Sky ATP3 and (2) Sky ATP alone (“Accused Products”).
`
`
`1 All “Ex.” citations herein are to the Declaration of Kristopher Kastens (“Kastens Decl.”) filed
`herewith.
`2 SRX Gateways include all SRX Gateways used in conjunction with Sky ATP, which includes
`SRX100, SRX110, SRX210, SRX220, SRX240, SRX300, SRX340, SRX345, SRX550, SRX550m,
`SRX650, SRX1400, SRX1500, SRX3400, SRX3600, SRX4000, SRX4100, SRX4200, SRX5400,
`SRX5600, SRX5800, vSRX Virtual Firewall, vSRX (including 10Mbps, 100Mps, 1000Mbps,
`2000Mbps, 4000Mbps version), Next Generation Firewall, cSRX Container Firewall. SRX Gateways
`are understood to include all supporting server and/or cloud infrastructure, feeds, and other
`components utilized by SRX Gateways; Ex. 3, May 30, 2018 Deposition Of Raju Manthena
`(“Manthena Tr.”) at 16:14-16 (“Sky ATP is a cloud-based service, and it requires some subscription,
`and people can go ahead, but
`.”).
`3 Sky ATP refers to Juniper’s “cloud” advanced anti-malware service, which is used with the SRX
`Gateways and includes multiple subscriptions, including Free Sky ATP, Basic Sky ATP (SRX340-
`THRTFEED-1, 3, 5; SRX345-THRTFEED-1, 3, 5; SRX550-THRTFEED-1, 3, 5; SRX1500-
`THRTFEED-1, 3, 5; SRX4100THRTFEED-1, 3, 5; SRX4200-THRTFEED-1, 3, 5; SRX5400-
`THRTFEED-1, 3, 5; SRX5600-THRTFEED-1, 3, 5; SRX5800-THRTFEED-1, 3, 5;
`VSRX10MTHRTFEED-1, 3, 5; VSRX100MTHRTFEED-1, 3, 5; VSRX1GTHRTFEED-1, 3, 5;
`VSRX2GTHRTFEED-1, 3, 5; and VSRX4GTHRTFEED-1, 3, 5) and Premium Sky ATP (SRX340-
`ATP-1, 3, 5; SRX345-ATP-1, 3, 5; SRX550-ATP-1, 3, 5; SRX1500-ATP-1, 3, 5; SRX4100-ATP-1, 3,
`5; SRX4200-ATP-1, 3, 5; SRX5400-ATP-1, 3, 5; SRX5600-ATP-1, 3, 5; SRX5800-ATP-1, 3, 5;
`1
`
`CASE NO. 3:17-cv-05659-WHA
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 7 of 31
`
`
`
`STATEMENT OF THE ISSUES
`
`Whether summary judgment of infringement should be granted as to claim 10 of the ’494
`
`Patent with respect to: (1) Juniper’s SRX Gateways in combination with Sky ATP and (2) Sky ATP
`
`alone.
`
`MEMORANDUM OF POINTS AND AUTHORITIES
`
`I.
`
`INTRODUCTION AND STATEMENT OF ISSUES TO BE DECIDED
`
`Juniper infringes Finjan’s computer security patents, including Finjan’s ‘494 Patent, which
`
`pioneered an approach to scanning malware that focuses on the behavior of the malware. In particular,
`
`Juniper’s SRX Gateways and Sky ATP infringe Claim 10 of the ‘494 Patent, because Juniper makes,
`
`uses and sells these products in the United States and they satisfy each element of Claim 10. Claim 10
`
`of the ‘494 Patent recites:
`
`10. A system for managing Downloadables, comprising:
`
`10(a) a receiver for receiving an incoming Downloadable;
`10(b) a Downloadable scanner coupled with said receiver, for deriving security profile
`data for the Downloadable, including a list of suspicious computer operations that
`may be attempted by the Downloadable; and
`10(c) a database manager coupled with said Downloadable scanner, for storing the
`Downloadable security profile data in a database.
`Ex. 1, Claim 10. Juniper’s SRX Gateways and Sky ATP map directly to the language of this claim
`
`because they receive Downloadables from servers on the Internet, scan these Downloadables using
`
`dynamic and static analysis to generate a behavioral profile, and store the resulting behavioral profile
`
`in a results database.
`
`There is no genuine dispute of material fact that SRX Gateways and Sky ATP operate in a
`
`manner that satisfies the elements of Claim 10, based on the unequivocal descriptions in Juniper’s
`
`documents, source code, testimony of its employees and discovery responses. In fact, Juniper has
`
`
`VSRX10M-ATP-1, 3, 5; VSRX100M-ATP-1, 3, 5; VSRX1G-ATP-1, 3, 5; VSRX2G-ATP-1, 3, 5; and
`VSRX4G-ATP-1, 3, 5). Sky ATP is understood to include all supporting server and/or cloud
`infrastructure, feeds, and other components that are utilized by Sky ATP, including Spotlight Secure
`Threat Intelligence Platform. Sky ATP is also understood to include all products that receive updates
`from the service.
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`2
`
`CASE NO. 3:17-cv-05659-WHA
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 8 of 31
`
`
`
`admitted in discovery that SRX Gateways and Sky ATP include the “receiver” recited in Claim 10.
`
`Juniper also conceded that the results of its Malware Analysis Pipeline scanner, which creates a list of
`
`“behaviors,” are stored in its Results Database. Juniper’s only disclosed non-infringement position for
`
`Claim 10 is that its “Results Database” is not actually a database—an argument belied not only by the
`
`name of this component, but also by numerous Juniper documents that confirm that it is indeed a
`
`database.
`
`There are also no claim construction issues that would preclude summary judgment. Claim 10
`
`is written in a straightforward manner, such that there are only two terms in Claim 10 that require
`
`construction, “Downloadable” and “database.” Courts have already construed these two terms in
`
`multiple prior cases and Juniper admits that these prior constructions are correct. Because Finjan
`
`applies these same prior constructions here, there can be no dispute regarding claim construction.
`
`Furthermore, Juniper directly infringes because it is a U.S.-based company that makes, uses,
`
`and sells the SRX Gateways and Sky ATP in the United States, which satisfies the standard for direct
`
`infringement under 35 U.S.C. §271(a). Therefore, because the undisputed operation of Juniper’s
`
`products meets the clear language of Claim 10, summary judgment of infringement of Claim 10 is
`
`proper.
`II.
`
`STATEMENT OF FACTS
`
`
`A.
`
`Finjan
`
`Finjan was formed in 1996 and achieved groundbreaking technology through the innovation of
`
`its employees and the investment of over $65 million in development and research. The Federal
`
`Circuit recognized Finjan as the pioneer in the behavior-based computer security. Finjan, Inc. v. Blue
`
`Coat Sys., Inc., 879 F.3d 1299, 1304 (Fed. Cir. 2018) (affirming the patentability of Finjan’s related
`
`patent, U.S. Patent No. 6,154,844, which stems from the same parent as the ‘494 Patent). In this
`
`manner, Finjan was the first to develop techniques for dealing with new “zero-day” malware that had
`
`never been seen before.
`
`B.
`
`The ‘494 Patent
`
`The ‘494 Patent stems directly from Finjan’s “behavior-based” approach to malware analysis.
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`3
`
`CASE NO. 3:17-cv-05659-WHA
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 9 of 31
`
`
`
`The technology of the ‘494 Patent generally relates to protecting against a potentially malicious
`
`“downloadable.” Ex. 1, ‘494 Patent at Col. 1, ll. 60-63. A downloadable is often in the form of
`
`executables, JavaScript, etc. Id. at Col. 2, ll. 59-64, Col. 3, ll. 7-8. In a typical scenario, a
`
`downloadable is delivered to a computer from another computer on the Internet (sometimes called a
`
`server). Id. at Figs. 1a-c. The downloadable code often comes from untrusted sites or persons on the
`
`Internet. This is a common way adversaries deliver malicious code to a system, which could run
`
`without the user’s knowledge or permission. Id. at Col. 4, ll. 42-58. Claim 10 of the ‘494 Patent
`
`describes a system addressing this problem, which downloads content, inspects content that is
`
`downloaded, generates a security profile of malicious or suspicious operations that the downloaded
`
`content may perform, and stores this security profile in a database. Id., Claim 10. The ‘494 Patent
`
`describes that this downloadable security profile, or “DSP,” includes a list of suspicious operations that
`
`may be attempted by the Downloadable. The patent provides examples of these suspicious operations
`
`that include creating a file, connecting to a server, receiving data from a network, writing to a
`
`computer’s operating systems, and starting new processes. Ex. 2, U.S. Patent No. 6,804,780 (“‘780
`Patent”)4 at Col. 6, ll. 1-15.
`The ‘494 Patent sets forth a number of ways that the security profile can be used to protect
`
`against threats. Id. at Col. 2, ll. 17-27. In one example, the security profile may be used in real-time to
`
`make a decision of what operations by the downloaded content should be allowed. Id. In other
`
`instances, the profile could be analyzed by other processes as part of a security system used to classify
`
`malicious content. Id. at Col. 7, ll. 44-59. Also, the profile could be used to provide information to a
`
`customer regarding the types of threats that are observed on the network. Id.
`
`
`4 The ‘780 Patent is treated as part of the ‘494 Patent because it is a parent to the ‘494 Patent and was
`specifically incorporated by reference into the ‘494 Patent. See Finjan, Inc. v. Blue Coat Systems,
`LLC, No. 15-cv-03295-BLF, 2016 WL 7212322, at *8 (N.D. Cal. Dec. 13, 2016) (incorporating the
`entire U.S. Patent No. 6,092,194 (the “’194 Patent”), which is a parent of both the ‘780 and ‘494
`Patents, into the ‘494 Patent because “the ‘494 patent identifies the material it is incorporating with
`sufficient particularly: it indicates that it is incorporating the entire ‘194 patent, and provides enough
`information for the reader to locate this information.”) (citing Zenon Envtl., Inc. v. U.S. Filter Corp.,
`506 F.3d 1370, 1378 (Fed. Cir. 2007)).
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`4
`
`CASE NO. 3:17-cv-05659-WHA
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 10 of 31
`
`
`
`
`1.
`
`Claim Constructions for the ‘494 Patent
`
`Claim 10 of the ‘494 Patent was written in a straightforward and easy to understand manner,
`
`with only two terms that require construction, “Downloadable” and “database.” Courts have
`
`previously construed these two terms and Juniper agrees that these previous constructions control.
`
`First, Courts have construed the term “Downloadable” on multiple occasions, including in this
`
`District, as “an executable application program, which is downloaded from a source computer and run
`
`on the destination computer” in the context of the ‘494 Patent. See, for example, Finjan, Inc. v.
`
`Symantec Corp., No. 14-cv-02998-HSG, 2017 WL 550453, at *2 (N.D. Cal. Feb. 10, 2017). These
`
`Courts determined that Finjan acted as its own lexicographer by specifically defining this term in the
`
`specification as “[a] Downloadable is an executable application program, which is downloaded from a
`
`source computer and run on the destination computer.” Ex. 2, ‘780 Patent, Col. 1, ll. 51-53. As such,
`
`there is an established construction of this claim term, which Juniper agrees is correct. See Ex. 4,
`
`Juniper’s Objs. & Resps. to Finjan’s First Set of Requests for Admission (Nos. 1-4, 7-8).
`
`Second, a Court in this District has construed the term “database” as having its plain and
`
`ordinary meaning of “a collection of interrelated data organized according to a database schema to
`
`serve one or more application.” See Finjan, Inc. v. Sophos, Inc., No. 14-cv-01197-WHO, 2015 WL
`
`890621, at *2-4 (N.D. Cal. Mar. 2, 2015). This definition comes from the 1994 version of the IBM
`
`Dictionary, which sets forth the plain and ordinary meaning of the term. Thus, as with
`
`“Downloadable,” “database” has an established construction, which Juniper agrees is correct. See Ex.
`
`4, Juniper’s Objs. & Resps. to Finjan’s First Set of Requests for Admission (Nos. 1-4, 7-8).
`
`Courts have not construed the remaining terms in Claim 10 of the ‘494 Patent and those terms
`
`do not need to be construed here. Furthermore, Juniper did not provide any positions during discovery
`
`that relate to the scope or construction of any terms of Claim 10 of the ‘494 Patent.
`
`2.
`
`Previous Findings of Infringement of the ‘494 Patent
`
`In September 2016, a jury in this District found that Claim 10 of the ‘494 Patent was infringed
`
`by the Sophos Live Cloud scanning service, a finding that the Court later determined to be supported
`
`by substantial evidence in a post-trial order. Finjan, Inc. v. Sophos, Inc., 244 F. Supp. 3d 1016, 1052
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`5
`
`CASE NO. 3:17-cv-05659-WHA
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 11 of 31
`
`
`
`(N.D. Cal. 2017). Sophos Live Cloud is a service that receives content that is submitted to it from its
`
`UTM Gateways, scans this content using dynamic analysis to identify suspicious operations, and stores
`
`the results in a database. Ex. 5, Finjan, Inc. v. Sophos, Inc., No. 3:14-cv-1197, Trial Tr. at 334:23-
`
`336:2 (N.D. Cal. Sept. 8, 2016) (describing how Sophos Live Cloud Service uses the “Warzone”
`
`sandbox to observe and monitor behavior and store the results in a database).
`
`
`
`3.
`
`Claim 10 of the ‘494 Patent Has Withstood Numerous Validity and
`Patentability Challenges
`Claim 10 of the ‘494 Patent has withstood at least sixteen different challenges before Courts
`
`and the Patent Office. Each time, Claim 10 was found to be valid over numerous prior art references.
`
`For example, the Patent Trial and Appeal Board has rejected at least eight different challenges to the
`validity of Claim 10.5 Separately, Judge Freeman found the ‘494 Patent patentable under 35 U.S.C. §
`101 (“§ 101”), finding that the claims, including Claim 10, recited an inventive concept. Finjan, Inc. v.
`
`Blue Coat Systems, LLC, No. 15-cv-03295-BLF, 2016 WL 7212322, at *12 (N.D. Cal. Dec. 13, 2016).
`
`The ‘494 Patent faced another § 101 challenge and Judge Orrick also upheld the patentability of the
`
`‘494 Patent. Finjan v. Sophos, 244 F.Supp.3d 1016, 1055 (N.D. Cal. Mar. 14, 2017) (“This is not the
`
`first time that the ‘494 and ‘844 patent have been challenged under section 101 . . . I conclude that both
`
`the ‘494 and ‘844 patents are patent-eligible.”). Finally, the Federal Circuit upheld the patentability of
`
`the ‘844 Patent, which is related to the ‘494 Patent. Blue Coat, supra, 879 F.3d at 1304.
`
`
`Juniper and the Accused Products
`
`C.
`
`Juniper is a network technology company that offers a line of security products. In 2004,
`
`Juniper determined that its flagship security product, the SRX Gateway,
`
`
`
` Ex. 6, JNPR-FNJN_29002_00173278 at 83.
`
`
`
`
`5 See Sophos, Inc. v. Finjan, Inc., IPR2015-01022, Paper 1 (P.T.A.B. Apr. 8, 2015); Symantec
`Corporation v. Finjan, Inc., IPR2015-01892, Paper 1 (P.T.A.B. Sept. 10, 2015); Symantec
`Corporation v. Finjan, Inc., IPR2015-01897, Paper 1 (P.T.A.B. Sept. 11, 2015); Palo Alto Networks,
`Inc. v. Finjan, Inc., IPR2016-00159, Paper 1 (P.T.A.B. Nov. 06, 2015); Blue Coat Systems, Inc. v.
`Finjan, Inc., IPR2016-00890, Paper 2 (P.T.A.B. Apr. 14, 2016); Blue Coat Systems, Inc. v. Finjan,
`Inc., IPR2016-01174, Paper 2 (P.T.A.B. Jun. 10, 2016); Blue Coat Systems, Inc. v. Finjan, Inc.,
`IPR2016-01443, Paper 2 (P.T.A.B. Jul. 15, 2016); Cisco Systems, Inc. v. Finjan, Inc., IPR2017-02155,
`Paper 1 (P.T.A.B. Sep. 22, 2017).
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`6
`
`CASE NO. 3:17-cv-05659-WHA
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 12 of 31
`
`
`
` Juniper determined that it needed to develop a new in-house
`
`cloud based service, which it called “Sky Advanced Threat Protection,” because it could be used with
`
`the SRX Gateways to “
`
`.” Id. Sky ATP integrated with the SRX
`
`Gateways to provide an advanced system for detecting malware. Id.
`
`
`SRX Gateways
`
`1.
`
`Juniper’s SRX Gateways generally operate by analyzing and potentially blocking content
`
`entering a network. Ex. 7, FINJAN-JN 005382 at 83. In 2015, the SRX Gateway
`
`
`
` integrated with Sky ATP. Ex. 8, May 9,
`
`2018 Deposition of Yuly Tenorio (“Tenorio Tr.”) at 137:18-138:15. The general flow of processing
`
`incoming files by SRX Gateways can be seen in Juniper’s Sky ATP website, where the SRX Gateway
`
`acts as an intermediary between the computer in an internal network (shown in the box) and the
`
`Internet, where malicious content like viruses and malware could be lurking to infect the computer on
`
`the internal network. Ex. 7, FINJAN-JN 005382 at 85.
`
`
`Sky ATP
`
`2.
`
`When Juniper integrated Sky ATP with the SRX Gateways, it allowed SRX Gateways to
`
`provide advanced malware scanning and protection in an increasingly dangerous and fast moving
`
`Internet. Ex. 9, FINJAN-JN 005438 at 38 (“Advanced Threat Prevention provides advanced anti-
`
`malware and anti-ransomware protection against sophisticated ‘zero-day’ and unknown threats …”).
`
`Sky ATP provides this benefit by scanning files with its “Malware Analysis Pipeline” of technologies
`
`that use advanced static analysis and dynamic analysis techniques to create a complete behavioral
`
`profile for the Downloadable. Id. at 39 (describing the Sky ATP “pipeline analysis” as having static
`
`and dynamic analysis); see also Ex. 10, JNPR-FNJN_29017_00552807 (describing sample malware
`
`analysis processing pipeline).
`
`The general flow of the “Malware Analysis Pipeline” is described at FINJAN-JN 044744 at 62,
`
`which shows that first Sky ATP determines if it has already analyzed the file; next Sky ATP scans the
`
`file with off-the-shelf antivirus scanners from third-parties; then Sky ATP performs detailed static
`
`analysis that generates a profile including suspicious signs like unusual operations; and last, for the
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`7
`
`CASE NO. 3:17-cv-05659-WHA
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 13 of 31
`
`
`
`most dangerous and difficult to detect malware, Sky ATP scans the file using dynamic analysis, which
`
`runs the Downloadable in a decoy machine and watches to see if the file performs any suspicious
`
`activity. This processing is described showing how the pipeline is used for suspicious downloaded
`
`files. Ex. 11, FINJAN-JN 044744 at 62.
`
`Sky ATP uses this “Malware Analysis Pipeline” because each step requires an increased
`
`amount of processing power to perform. The pipeline analysis allows malware that is easily detected
`
`to be identified first, and then the most dangerous and hard-to-detect malware to be processed through
`
`all steps. Id. at 63-64. The results of this pipeline analysis include a “verdict,” which provides an
`
`overall score for how dangerous the file is. Id. at 62 (“If Sky Advanced Threat Prevention returns a
`
`bad verdict, the SRX Series device drops the connection and the file is blocked”).
`
`The Malware Analysis Pipeline uses “Static Analysis [that] examines files without actually
`
`running them.” Id. at 62. The static analysis scans for suspicious features in a file, such as if a file
`
`includes unusual operations that indicate it is performing malicious or potentially malicious operations.
`
`Id. at 62 (“Static Analysis … Does the file contain suspicious signs, like unusual instructions or
`
`structures?”), 63 (“Is the file modifying the Windows registry? Is it touching disk I/O APIs?”).
`
`The Malware Analysis Pipeline also uses “dynamic analysis,” “often called sandboxing,”
`
`which studies a file “as it is executed in a secure environment.” Id. at 63. In doing so, Sky ATP will
`
`actually run the file in a “virtual” system or “sandbox” (a fake system that mimics a real computer
`
`system) that is meant to be infected. Id. at 63-64. Sky ATP watches the Downloadable run in this
`
`sandbox, records operations the file performs, and determines which of those operations are suspicious
`
`or malicious. Id. at 763-64. In this way, Sky ATP uses dynamic analysis to determine “[w]hat
`
`happens when we execute the file in a real environment?” Ex. 12, FINJAN-JN 005387 at 87. The
`
`dynamic analyses are based on “behavioral analysis,” which includes collecting and listing different
`
`suspicious or malicious behaviors, including hundreds of different behaviors that are “Often Malicious
`
`behaviors,” to reach a verdict on whether the file is dangerous. Kastens Decl., ¶ 31
`
`(https://www.youtube.com/watch?v=K8Y0MkbJwcs&feature=youtu.be) (“Lanworks & Juniper Sky
`
`ATP Lunch and Learn”) (FINJAN-JN 317958).
`
`FINJAN’S NOTICE OF MOTION AND
`MOTION FOR SUMMARY JUDGMENT
`
`8
`
`CASE NO. 3:17-cv-05659-WHA
`
`1 2 3 4 5 6 7 8 9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`

`

`Case 3:17-cv-05659-WHA Document 98 Filed 06/07/18 Page 14 of 31
`
`
`
`The below excerpt of Juniper’s administration guide for Sky ATP includes an example list of