Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 1 of 183
`Case 4:18-cv-07229—YGR Document 125-1 Filed 10/22/20 Page 1 of 183
`
`
`
`
`
`EXHIBIT A
`
`EXHIBIT A
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 2 of 183
`
`UNITlD STATES PATENT AND TRADEMARK OFFICE
`
`UNITED STATES DEPARTMENT OF COMMERCE
`United States Patent and Trademark Office
`Address: COMMISSIONER FOR PATENTS
`P.O. Box 1450
`Alexandria, Virginia 22313-1450
`www.usple.gov
`
`NOTICE OF ALLOWANCE AND FEE(S) DUE
`
`12/20/2010
`
`74877
`7590
`King and Spalding LLP
`1700 Pennsylvania Ave, NW
`Suite 200
`Washington, DC 20006
`
`EXAMINER
`
`WILLIAMS, 3b1-ThXY L
`
`ART UNIT
`
`PAPER NUMBER
`
`2437
`DATE MAILED: 12/20/2010
`
`APPLICATION NO.
`
`HLINO DATE
`
`FIRST NAMED INVENTOR
`
`ATTORNEY DOCKET NO.
`
`CONFIRMATION NO.
`
`FIN0001CONICIP3CIP1
`Moshe Rubin
`12/09/2004
`11/009,437
`TITLE OF INVENTION: METHOD AND SYSTEM FOR ADAPTIVE RULE-BASED CONTENT SCANNERS FOR DESKTOP COMPUTERS
`
`5071
`
`APPLN. TYPE
`
`SMALL ENTITY
`
`ISSUE FEE DUE
`
`PUBLICATION Ebb DUE PREV. PAID ISSUE FEE
`
`TOTAL FEE(S) DUE
`
`DATE DUE
`
`nonprovisional
`
`NO
`
`$1510
`
`$300
`
`$0
`
`$1810
`
`03/21/2011
`
`THE APPLICATION IDENTIFIED ABOVE HAS BEEN EXAMINED AND IS ALLOWED FOR ISSUANCE AS A PATENT.
`PROSECUTION DA THE MERITS IS CLOSED. THIS NOTICE OF ALLOWANCE IS NOT A GRANT OF PATENT RIGHTS.
`THIS APPLICATION IS SUBJECT TO WITHDRAWAL FROM ISSUE AT THE INITIATIVE OF THE OFFICE OR UPON
`PETITION BY THE APPLICANT. SEE 37 CFR 1.313 AND MPEP 1308.
`
`THE ISSUE FEE AND PUBLICATION FEE (IF REQUIRED) MUST BE PAID WITHIN THREE MONTHS FROM THE
`MAILING DATE OF THIS NOTICE OR THIS APPLICATION SHALL BE REGARDED AS ABANDONED. THIS
`STATUTORY PERIOD CANNOT BE EXTENDED. SEE 35 U.S.C. 151. THE ISSUE FEE DUE INDICATED ABOVE DOES
`NOT REFLECT A CREDIT FOR ANY PREVIOUSLY PAID ISSUE FEE IN THIS APPLICATION.
`IF AN ISSUE FEE HAS
`PREVIOUSLY BEEN PAID IN THIS APPLICATION (AS SHOWN ABOVE), THE RETURN OF PART B OF THIS FORM
`WILL BE CONSIDERED A REQUEST TO REAPPLY THE PREVIOUSLY PAID ISSUE FEE TOWARD THE ISSUE FEE NOW
`DUE.
`
`HOW TO REPLY TO THIS NOTICE:
`
`I. Review the SMALL ENTITY status shown above.
`
`If the SMALL ENTITY is shown as YES, verify your current
`SMALL ENTITY status:
`A. If the status is the same, pay the TOTAL FEE(S) DUE shown
`above.
`B. If the status above is to be removed, check box 5b on Part B -
`Fee(s) Transmittal and pay the PUBLICATION FEE (if required)
`and twice the amount of the ISSUE FEE shown above, or
`
`If the SMALL ENTITY is shown as NO:
`
`A. Pay TOTAL FEE(S) DUE shown above, or
`
`B. If applicant claimed SMALL ENTITY status before, or is now
`claiming SMALL ENTITY status, check box 5a on Part B - Fee(s)
`Transmittal and pay the PUBLICATION FEE (if required) and 1/2
`the ISSUE FEE shown above.
`
`II. PART B - FEE(S) TRANSMITTAL, or its equivalent, must be completed and returned to the United States Patent and Trademark Office
`(USPTO) with your ISSUE FEE and PUBLICATION FEE (if required). If you are charging the fee(s) to your deposit account, section "4b"
`of Part B - Fee(s) Transmittal should be completed and an extra copy of the form should be submitted. If an equivalent of Part B is filed, a
`request to reapply a previously paid issue fee must be clearly made, and delays in processing may occur due to the difficulty in recognizing
`the paper as an equivalent of Part B.
`
`III. All communications regarding this application must give the application number. Please direct all communications prior to issuance to
`Mail Stop ISSUE FEE unless advised to the contrary.
`
`IMPORTANT REMINDER: Utility patents issuing on applications filed on or after Dec. 12, 1980 may require payment of
`maintenance fees. It is patentee's responsibility to ensure timely payment of maintenance fees when due.
`
`PTOL-85 (Rev. 08/07) Approved for use through 08/31/2010.
`
`Page 1 of 3
`
`FINJAN-QUALYS 002190
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 3 of 183
`PART B - FEE(S) TRANSMITTAL
`
`Complete and send this form, together with applicable fee(s), to: Mail Mail Stop ISSUE FEE
`Commissioner for Patents
`P.O. Box 1450
`Alexandria, Virginia 22313-1450
` (571)-273-2885
`or j
`INSTRUCTIONS: This form should be used for transmitting the ISSUE FEE and PUBLICATION FEE (if required). Blocks 1 through 5 should be completed where
`appropriate. All further correspondence including the Patent, advance orders and notification of maintenance fees will he mailed to the current correspondence address as
`indicated unless corrected below or directed otherwise in Block 1, by (a) specifying a new correspondence address; and/or (b) indicating a separate "FEE ADDRESS" for
`maintenance fee notifications.
`CURRENT CORRESPONDENCE ADDRESS (Note, Use Block l for any change of address)
`
`12/20/2010
`
`74877
`7590
`King and Spalding LLP
`1700 Pennsylvania Ave, NW
`Suite 200
`Washington, DC 20006
`
`Note: A certificate of mailing can only be used for domestic mailings of the
`Fee(s) Transmittal. This certificate cannot be used for any other accompanying
`papers. Each additional paper, such as an assignment or formal drawing, must
`have its own certificate of mailing or transmission.
`
`Certificate of Mailing or Transmission
`I hereby certify that this Fee(s) Transmittal is being deposited with the United
`States Postal Service with sufficient postage for first class mail in an envelope
`addressed to the Mail Stop ISSUE FEE address above, or being facsimile
`transmitted to the USPTO (571) 273-2885, on the date indicated below.
`
`(Depositot's name)
`
`(Signature)
`
`(Date)
`
`APPLICATION NO.
`
`FILING DA'Z'E
`
`FIRST NAMED INVENTOR
`
`ATTORNEY DOCKET NO.
`
`CONFIRMATION NO.
`
`FIN000ICONICIP3CIP1
`Moshe Rubin
`12/09/2004
`11/009,437
`TITLE OF INVENTION: METHOD AND SYSTEM FOR ADAPTIVE RULE-BASED CONTENT SCANNERS FOR DESKTOP COMPUTERS
`
`5071
`
`APPLN. TYPE
`
`SMALL ENTITY
`
`ISSUE FEE DUE
`
`PUBLICATION 1-tE. DUE PREV. PAID ISSUE FEE
`
`TOTAL FEE(S) DUE
`
`DATE DUE
`
`nonprovisional
`
`NO
`
`$1510
`
`$300
`
`$0
`
`$1810
`
`03/21/2011
`
`EXAMINER
`
`ART UNIT
`
`CLASS-SUBCLASS
`
`WILLIAMS, JEFFERY L
`
`2437
`
`726-025000
`
`1. Change of correspondence address or indication of "Fee Address" (37
`CFR 1.363).
`0 Change of correspondence address (or Change of Correspondence
`Address form PTO/0/122) attached.
`0 "Fee Address" indication (or "Fee Address" Indication form
`PTOISB/47; Rev 03-02 or more recent) attached. Use of a Customer
`Number is required.
`
`2. For printing on the patent front page, list
`(1) the names of up to 3 registered patent attorneys
`or agents OR, alternatively,
`(2) the name of a single firm (having as a member a
`registered attorney or agent) and the names of up to
`2 registered patent attorneys or agents. If no name is
`listed, no name will be printed.
`
`1
`
`2
`
`3
`
`3. ASSIGNEE NAME AND RESIDENCE DATA TO BE PRINTED ON THE PATENT (print or type)
`PLEASE NOTE: Unless an assignee is identified below, no assignee data will appear on the patent. If an assignee is identified below, the document has been filed for
`recordation as set forth in 37 CFR 3.11. Completion of this form is NOT a substitute for filing an assignment.
`(A) NAME OF ASSIGNEE
`(B) RESIDENCE: (CITY and STATE OR COUNTRY)
`
`Please check the appropriate assignee category or categories (will not be printed on the patent) :
`
`q Individual 0 Corporation or other private group entity a Government
`
`4a. The following fee(s) are submitted:
`0 Issue Fee
`q Publication Fee (No small entity discount permitted)
`0 Advance Order - # of Copies
`
`4b. Payment of Fee(s): (Please first reapply any previously paid issue fee shown above)
`q A check is enclosed.
`0 Payment by credit card. Form PTO-2038 is attached.
`fa The Director is hereby authorized to charge the required fee(s), any deficiency, or credit any
`overpayment, to Deposit Account Number
`(enclose an extra copy of this form).
`
`5. Change in Entity Status (from status indicated above)
`LI b. Applicant is no longer claiming SMALL ENTITY status. See 37 CPR 1.27(g)(2).
`q a. Applicant claims SMALL ENTITY status. See 37 CFR 1.27.
`NOTE: The Issue Fee and Publication Fee (if required) will not be accepted from anyone other than the applicant; a registered attorney or agent; or the assignee or other party in
`interest as shown by the records of the United States Patent and Trademark Office.
`
`Authorized Signature
`
`Typed or printed name
`
`
`
`
`
`Date
`
`Registration No.
`
`This collection of information is required by 37 CFR 1.311. The information is required to obtain or retain a benefit by the public which is to file (and by the USPTO to process)
`an application. Confidentiality is governed by 35 U.S.C. 122 and 37 CFR 1.14. This collection is estimated to take 12 minutes to complete, including gathering, preparing, and
`submitting the completed application form to the USPTO. Time will vary depending upon the individual case. Any comments on the amount of time you require to complete
`this form and/or suggestions for reducing this burden, should be sent to the Chief Information Officer, U.S. Patent and Trademark Office, U.S. Department of Commerce, P.O.
`Box 1450, Alexandria, Virginia 22313-1450. DO NOT SEND FEES OR COMPLETED FORMS TO THIS ADDRESS. SEND TO: Commissioner for Patents, P.O. Box 1450,
`Alexandria, Virginia 22313-1450.
`Under the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number.
`
`PTOL-85 (Rev. 08/07) Approved for use through 08/31/2010.
`
`OMB 0651-0033
`
`U.S. Patent and Trademark Office; U.S. DEPARTMENT OF COMMERCE
`
`FINJAN-QUALYS 002191
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 4 of 183
`
`UNITID STATES PATENT AND TRADEMARK OFFICE
`
`UNITED STATES DEPARTMENT OF COMMERCE
`United States Patent and Trademark Office
`Address: COMMISSIONER FOR PATENTS
`P.O. Box 1450
`Alexandria, Virginia 22313-1450
`www.usple.gov
`
`APPLICATION NO.
`
`FILING. DATE
`
`FIRST NAMED INVENTOR
`
`ATTORNEY DOCKET NO.
`
`CONFIRMATION NO.
`
`11/009,437
`
`12/09/2004
`
`Moshe Rubin
`
`FIN0001CON1 CIP3CIP1
`
`5071
`
`12/20/2010
`
`74877
`7590
`King and Spalding LLP
`1700 Pennsylvania Ave, NW
`Suite 200
`Washington, DC 20006
`
`EXAMINER
`
`WILLIAMS, Jlrrt SKY L
`
`ART UNIT
`
`PAPER NUMBER
`
`2437
`DATE MAILED: 12/20/2010
`
`Determination of Patent Term Adjustment under 35 U.S.C. 154 (b)
`(application filed on or after May 29, 2000)
`
`The Patent Term Adjustment to date is 837 day(s). If the issue fee is paid on the date that is three months after the
`mailing date of this notice and the patent issues on the Tuesday before the date that is 28 weeks (six and a half
`months) after the mailing date of this notice, the Patent Term Adjustment will be 837 day(s).
`
`If a Continued Prosecution Application (CPA) was filed in the above-identified application, the filing date that
`determines Patent Term Adjustment is the filing date of the most recent CPA.
`
`Applicant will be able to obtain more detailed information by accessing the Patent Application Information Retrieval
`(PAIR) WEB site (http://pair.uspto.gov).
`
`Any questions regarding the Patent Term Extension or Adjustment determination should be directed to the Office of
`Patent Legal Administration at (571)-272-7702. Questions relating to issue and publication fee payments should be
`directed to the Customer Service Center of the Office of Patent Publication at 1-(888)-786-0101
`or
`(571)-272-4200.
`
`PTOL-85 (Rev. 08/07) Approved for use through 08/31/2010.
`
`Page 3 of 3
`
`FINJAN-QUALYS 002192
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 5 of 183
`
`Examiner-Initiated Interview Summary
`
`All Participants:
`
`(1) JEFFERY WILLIAMS.
`
`(2) DAWN MARIE BEY.
`
`Application No.
`
`11/009,437
`
`Examiner
`
`Applicant(s)
`
`RUBIN ET AL.
`
`Art Unit
`
`JEFFERY WILLIAMS
`
`2437
`
`Status of Application: Non-Final Resection
`
`(3)
`
`(4)
`
`Date of Interview: 1 December 2010
`
`Time: 11:50 am
`
`Type of Interview:
`El Telephonic
`q Video Conference
`q Personal (Copy given to: q Applicant
`Exhibit Shown or Demonstrated:
`q Yes
`If Yes, provide a brief description:
`
`q Applicant's representative)
`El No
`
`Part I.
`Rejection(s) discussed:
`n/a
`
`Claims discussed:
`13, 25
`
`Prior art documents discussed:
`n/a
`
`Part II.
`SUBSTANCE OF INTERVIEW DESCRIBING THE GENERAL NATURE OF WHAT WAS DISCUSSED:
`It was agreed upon to amend claim 25 to exclude signals and to amend claim 13 to explicitly tie the method to a machine so as to
`overcome issues of nonstatutory subject matter under 35 USC 101.
`
`Part Ill.
`•
`It is not necessary for applicant to provide a separate record of the substance of the interview, since the interview
`directly resulted in the allowance of the application. The examiner will provide a written summary of the substance
`of the interview in the Notice of Allowability.
`q It is not necessary for applicant to provide a separate record of the substance of the interview, since the interview
`did not result in resolution of all issues. A brief summary by the examiner appears in Part II above.
`
`/Jeffery Williams/
`Examiner, Art Unit 2437
`
`(Applicant/Applicant's Representative Signature — if appropriate)
`
`U.S. Patent and Trademark Office
`PTOL-413B (04-03)
`
`Examiner Initiated Interview Summary
`
`Paper No. 20101120
`
`FINJAN-QUALYS 002193
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 6 of 183
`
`Notice of Allowability
`
`Application No.
`
`11/009.437
`Examiner
`
`Applicant(s)
`
`RUBIN ET AL.
`Art Unit
`
`JEFFERY WILLIAMS
`
`2437
`
`-- The MAILING DATE of this communication appears on the cover sheet with the correspondence address--
`All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included
`herewith (or previously mailed). a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS
`NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative
`of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308.
`
`1. 0 This communication is responsive to 9/15/2010.
`
`2.
`
`The allowed claim(s) is/are 1-25.
`
`3. q Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f).
`a) q All
`b) q Some* c) q None of the:
`1. q Certified copies of the priority documents have been received.
`2. q Certified copies of the priority documents have been received in Application No. -
`•
`3. q Copies of the certified copies of the priority documents have been received in this national stage application from the
`International Bureau (PCT Rule 17.2(a)).
`* Certified copies not received:
`
`Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements
`noted below. Failure to timely comply will result in ABANDONMENT of this application.
`THIS THREE-MONTH PERIOD IS NOT EXTENDABLE.
`
`4. q A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF
`INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient.
`
`5. q CORRECTED DRAWINGS ( as "replacement sheets") must be submitted.
`(a) q including changes required by the Notice of Draftsperson's Patent Drawing Review ( P10-948) attached
`1) q hereto or 2) q to Paper No./Mail Date
`.
`(b) q including changes required by the attached Examiner's Amendment / Comment or in the Office action of
`Paper No./Mail Date
`.
`Identifying indicia such as the application number (see 37 CFR 1.84(c)) should be written on the drawings in the front (not the back) of
`each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d).
`
`6. q DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the
`attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL.
`
`Attachment(s)
`1. Notice of References Cited (PTO-892)
`2. q Notice of Draftperson's Patent Drawing Review (PTO-948)
`
`3. q Information Disclosure Statements (PTO/SB/08),
`Paper No./Mail Date
`4. q Examiner's Comment Regarding Requirement for Deposit
`of Biological Material
`
`5. q Notice of Informal Patent Application
`6. El Interview Summary (PTO-413),
`Paper No./Mail Date 12/1/2010 .
`7. El Examiner's Amendment/Comment
`
`8. EI Examiner's Statement of Reasons for Allowance
`
`9. q Other
`
`.
`
`U.S. Patent and Trademark Office
`PTOL-37 (Rev. 08-06)
`
`Notice of Allowability
`
`Part of Paper No./Mail Date 20101120
`
`FINJAN-QUALYS 002194
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 7 of 183
`
`Application/Control Number: 11/009,437
`Art Unit: 2437
`
`Page 2
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`EXAMINER'S AMENDMENT
`
`An examiner's amendment to the record appears below. Should the changes
`
`and/or additions be unacceptable to applicant, an amendment may be filed as provided
`
`by 37 CFR 1.312. To ensure consideration of such an amendment, it MUST be
`
`submitted no later than the payment of the issue fee.
`
`Authorization for this examiner's amendment was given in a telephone interview
`
`7 with Dawn Marie Bey on 12/1/2010.
`
`8
`
`9
`
`10
`
`11
`
`The application has been amended as follows:
`
`13. (currently amended) A method for scanning content within a computer,
`
`12
`
`comprising:
`
`13
`
`receiving, at the computer, incoming content from the Internet on its
`
`14
`
`destination to an Internet application;
`
`15
`
`selectively diverting, by the computer, the received incoming content from
`
`16
`
`its intended destination;
`
`17
`
`scanning, by the computer, the selectively diverted incoming content to
`
`18
`
`recognize potential computer exploits therewithin, based on a database of parser and
`
`19
`
`analyzer rules corresponding to computer exploits, computer exploits being portions of
`
`20
`
`program code that are malicious, wherein the parser and analyzer rules describe
`
`21
`
`computer exploits as patterns of types of tokens, tokens being program code constructs,
`
`FINJAN-QUALYS 002195
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 8 of 183
`
`Application/Control Number: 11/009,437
`Art Unit: 2437
`
`Page 3
`
`and types of tokens comprising a punctuation type, an identifier type and a function
`
`type; and
`
`updating the database of parser and analyzer rules periodically to
`
`incorporate new behavioral rules that are made available.
`
`25. (currently amended) A computer-readable storage medium, the medium
`
`excluding signals, storing program code for causing a computer to perform the steps of:
`
`receiving incoming content from the Internet on its destination to an Internet
`
`application;
`
`selectively diverting the received incoming content from its intended destination;
`
`scanning the selectively diverted incoming content to recognize potential exploits
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`therewithin, based on a database of parser and analyzer rules corresponding to
`
`13
`
`computer exploits, computer exploits being portions of program code that are malicious,
`
`14 wherein the parser and analyzer rules describe exploits as patterns of types of tokens,
`
`15
`
`tokens being program code constructs, and types of tokens comprising a punctuation
`
`16
`
`type, an identifier type and a function type;
`
`17
`
`and updating the database of parser and analyzer rules periodically to
`
`18
`
`incorporate new parser and analyzer rules that are made available.
`
`19
`20
`
`21
`
`The following is an examiner's statement of reasons for allowance:
`
`The prior art fails to disclose the features, as found recited in combination with
`
`22
`
`remaining claim limitations, of "scanning, by the computer, the selectively diverted
`
`23
`
`incoming content to recognize potential computer exploits therewithin, based on a
`
`FINJAN-QUALYS 002196
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 9 of 183
`
`Application/Control Number: 11/009,437
`Art Unit: 2437
`
`Page 4
`
`1
`
`2
`
`3
`
`database of parser and analyzer rules corresponding to computer exploits, computer
`
`exploits being portions of program code that are malicious, wherein the parser and
`
`analyzer rules describe computer exploits as patterns of types of tokens, tokens being
`
`4 program code constructs, and types of tokens comprising a punctuation type, an
`
`5
`
`6
`
`7
`
`8
`
`identifier type and a function type".
`
`Any comments considered necessary by applicant must be submitted no later
`
`than the payment of the issue fee and, to avoid processing delays, should preferably
`
`accompany the issue fee. Such submissions should be clearly labeled "Comments on
`
`9 Statement of Reasons for Allowance." Any inquiry concerning this communication or
`
`10
`
`earlier communications from the examiner should be directed to JEFFERY WILLIAMS
`
`11 whose telephone number is (571)272-7965. The examiner can normally be reached on
`
`12
`
`8:30-5:00.
`
`13
`
`If attempts to reach the examiner by telephone are unsuccessful, the examiner's
`
`14
`
`supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone
`
`15
`
`number for the organization where this application or proceeding is assigned is 571-
`
`16
`
`273-8300.
`
`FINJAN-QUALYS 002197
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 10 of 183
`
`Application/Control Number: 11/009,437
`Art Unit: 2437
`
`Page 5
`
`1
`
`Information regarding the status of an application may be obtained from the
`
`2 Patent Application Information Retrieval (PAIR) system. Status information for
`
`3
`
`published applications may be obtained from either Private PAIR or Public PAIR.
`
`4 Status information for unpublished applications is available through Private PAIR only.
`
`5 For more information about the PAIR system, see http://pair-directuspto.gov. Should
`
`6
`
`you have questions on access to the Private PAIR system, contact the Electronic
`
`7 Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a
`
`8 USPTO Customer Service Representative or access to the automated information
`
`9
`
`system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
`
`10
`
`11
`/Jeffery Williams/
`12
`13 Examiner, Art Unit 2437
`14
`15
`/Emmanuel L. Moise/
`16 Supervisory Patent Examiner, Art Unit 2437
`17
`18
`
`FINJAN-QUALYS 002198
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 11 of 183
`
`Attorney's Docket No.: FIN0001-CON1-CIP3-C1P1
`
`PATENT
`
`IN THE UNITED STATES PATENT AND TRADEMARK OFFICE
`
`In Re Patent Application of:
`
`Examiner:
`
`Jeffrey L. Williams
`
`Moshe Rubin
`Moshc Matitya
`Artem Melnick
`Shlomo Touboul
`Alexander Yermakov
`Amit Shaked
`
`)
`) Art Unit:
`)
`)
`)
`)
`
`2437
`
`Application No: 11/009,437
`
`Filed:
`
`December 9, 2004
`
`For:
`
`METHOD AND SYSTEM FOR
`ADAPTIVE RULE-BASED
`CONTENT SCANNERS FOR
`DESKTOP COMPUTERS
`
`)
`)
`)
`)
`)
`)
`)
`)
`)
`
`Mail Stop AMENDMENT
`Commissioner for Patents
`P. 0. Box 1450
`Alexandria, VA 22313-1450
`
`AMENDMENT AND RESPONSE TO OFFICE ACTION
`UNDER 37 C.F.R. 1.111
`
`Dear Examiner Williams:
`
`In response to the Office Action dated June 15, 2010, applicants
`
`respectfully request that the above-identified application be amended as requested herein. A
`
`telephone interview has been scheduled for October 28, 2010 at 11:00 AM to discuss this
`
`application and the undersigned respectfully requests that if possible, the Examiner not take
`
`additional action on this application until after the interview.
`
`Atty. Docket No. FIN0001-CON1-CIP3-CIP1
`
`-1-
`
`FINJAN-QUALYS 002214
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 12 of 183
`
`IN THE CLAIMS:
`
`same number:
`
`Please substitute the following claims for the pending claims with the
`
`1. (currently amended) A security system for scanning content within a computer,
`comprising:
`
`a network interface, housed within a computer, for receiving incoming
`content from the Internet on its destination to an Internet application running on the
`computer;
`
`a database of parser and analyzer rules corresponding to computer
`exploits, stored within the computer, computer exploits being portions of program code that
`are malicious, wherein the parser and analyzer rules describe computer exploits as patterns of
`types of tokens, tokens being program code constructs, and types of tokens comprising a
`
`punctuation type, an identifier type and a function type;
`a rule-based content scanner that communicates with said database of
`parser and analyzer rules, operatively coupled with said network interface, for scanning
`incoming content received by said network interface to recognize the presence of potential
`computer exploits therewithin;
`a network traffic probe, operatively coupled to said network interface
`and to said rule-based content scanner, for selectively diverting incoming content from its
`intended destination to said rule-based content scanner; and
`a rule update manager that communicates with said database of parser
`and analyzer rules, for updating said database of parser and analyzer rules periodically to
`incorporate new parser and analyzer rules that are made available.
`
`2. (previously presented) The security system of claim 1 wherein said database of parser and
`analyzer rules stores parser and analyzer rules in the form of pattern-matching engines.
`
`3. (original)
`
`The security system of claim 2 wherein the pattern-matching engines
`
`are deterministic finite automata.
`
`Atty. Docket No. FIN0001-CON1-CIP3-CIP1
`
`-2-
`
`FINJAN-QUALYS 002215
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 13 of 183
`
`4. (original)
`
`The security system of claim 2 wherein the pattern-matching engines
`
`are non-deterministic finite automata.
`
`5. (previously presented) The security system of claim 1 further comprising a content
`
`blocker, operatively coupled to said rule-based content scanner, for preventing incoming
`
`content having a computer exploit that was recognized by said rule-based content scanner
`
`from reaching its intended destination.
`
`6. (previously presented) The system of claim 1 wherein the incoming content received from
`
`the Internet by said network interface is HTTP content.
`
`7. (previously presented) The system of claim 1 wherein the incoming content received from
`
`the Internet by said network interface is HTTPS content.
`
`8. (previously presented) The system of claim 1 wherein the incoming content received from
`
`the Internet by said network interface is FTP content
`
`9. (previously presented) The system of claim 1 wherein the incoming content received from
`the Internet by said network interface is SMTP content
`
`10. (previously presented)The system of claim 1 wherein the incoming content received from
`
`the Internet by said network interface is POP3 content
`
`11. (original)
`
`web browser.
`
`The system of claim 1 wherein the destination Internet application is a
`
`12. (original)
`
`The system of claim 1 wherein the destination Internet application is
`
`an e-mail client.
`
`13. (currently amended) A method for scanning content within a computer, comprising:
`
`Atty. Docket No. FIN0001-CON1-CIP3-CIP1
`
`-3-
`
`FINJAN-QUALYS 002216
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 14 of 183
`
`receiving incoming content from the Internet on its destination to an
`
`selectively diverting the received incoming content from its intended
`
`Internet application;
`
`destination;
`
`scanning the selectively diverted incoming content to recognize
`
`potential computer exploits therewithin, based on a database of parser and analyzer rules
`
`corresponding to computer exploits, computer exploits being portions of program code that
`
`are malicious, wherein the parser and analyzer rules describe computer exploits as patterns of
`types of tokens, tokens being program code constructs, and types of tokens comprising a
`
`punctuation type, an identifier type and a function type; and
`
`updating the database of parser and analyzer rules periodically to
`
`incorporate new behavioral rules that are made available.
`
`14. (previously presented)The method of claim 13 wherein said database of parser and
`
`analyzer rules stores parser and analyzer rules in the form of pattern-matching engines.
`
`15. (original)
`
`The method of claim 14 wherein the pattern-matching engines are
`
`deterministic finite automata.
`
`16. (original)
`
`The method of claim 14 wherein the pattern-matching engines are non-
`
`deterministic finite automata.
`
`17. (previously presented)The method of claim 13 further comprising preventing incoming
`
`content having a computer exploit that was recognized by said scanning from reaching its
`
`intended destination.
`
`18. (previously presented)The method of claim 13 wherein the incoming content received
`
`from the Internet by said network interface is HTTP content.
`
`19. (previously presented)The method of claim 13 wherein the incoming content received
`
`from the Internet by said network interface is HTTPS content.
`
`Atty. Docket No. FIN0001-CON1-CIP3-CIP1
`
`-4-
`
`FINJAN-QUALYS 002217
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 15 of 183
`
`20. (previously presented)The method of claim 13 wherein the incoming content received
`
`from the Internet by said network interface is FTP content
`
`21. (previously presented)The method of claim 13 wherein the incoming content received
`
`from the Internet by said network interface is SMTP content
`
`22. (previously presented)The method of claim 13 wherein the incoming content received
`
`from the Internet by said network interface is POP3 content
`
`23. (original)
`
`The method of claim 13 wherein the destination Internet application is
`
`a web browser.
`
`24. (original)
`
`The method of claim 13 wherein the destination Internet application is
`
`an e-mail client.
`
`25. (currently amended) A computer-readable storage medium storing program code for
`
`causing a computer to perform the steps of:
`receiving incoming content from the Internet on its destination to an
`
`Internet application;
`
`destination;
`
`selectively diverting the received incoming content from its intended
`
`scanning the selectively diverted incoming content to recognize
`
`potential exploits therewithin, based on a database of parser and analyzer rules corresponding
`to computer exploits, computer exploits being portions of program code that are malicious,
`wherein the parser and analyzer rules describe exploits as patterns of types of tokens, tokens
`being program code constructs, and types of tokens comprising a punctuation type, an
`
`identifier type and a function type; and
`
`updating the database of parser and analyzer rules periodically to
`
`incorporate new parser and analyzer rules that are made available.
`
`Atty. Docket No. FIN0001-CON1-CIP3-CIP1
`
`-5-
`
`FINJAN-QUALYS 002218
`
`

`

`Case 4:18-cv-07229-YGR Document 125-1 Filed 10/22/20 Page 16 of 183
`
`REMARKS
`
`Applicants have carefully studied the outstanding Office Action. The
`present amendment is intended to place the application in condition for allowance and is
`
`believed to overcome all of the objections and rejections made by the Examiner. Favorable
`
`reconsideration and allowance of the application are respectfully requested.
`
`Applicants have amended claims 1, 13 and 25 to properly claim the
`present invention. No new matter has been added. Claims 1- 25 are presented for
`
`examination.
`
`Specification
`
`On pages 2 and 3 of the Office Action, the Examiner has objected to
`
`the specification as failing to provide proper antecedent basis for the claimed subject matter.
`
`Specifically, the Examiner has indicated that there is no support for "patterns of types of
`
`tokens".
`
`Applicants note that the appendix to the specification discloses that
`
`tokens are characterized into types. Thus, as defined on page 46,
`
`IDENT
`
`"[A-Za-z[!underscore!][!dollarsignn] [A-Za-z0-
`
`9[!underscoren[ ! dollarsign!]]*",
`
`a token consisting of a character a-z or a character A-Z or an underscore or a dollar sign,
`
`followed by zero or more of a character a-z or a character A-Z or a number 0 — 9 or an
`
`underscore or a dollar sign, is of type IDENT. Similarly, as defined on page 47,
`
`INTEGER DECIMAL
`
`10-9]+",
`
`a token consisting of one or more of the numbers 0 — 9, is of type INTEGER DECIMAL;
`
`and
`
`INTEGER—HEX
`
`"O[OC][0-9A-Fa-f]-F",
`
`a token consisting of Ox or OX followed by one or more of the numbers 0 - 9 or the characters
`
`A-F or the characters a-f, is of type INTEGER HEX.
`Applicants respectfully submit that patterns of types of tokens appear
`
`throughout the specification. Inter alia, at par. [0067], the specification recites
`
`A parse tree ... uses parsing rules to identify groups of tokens as a single pattern.
`
`Atty. Docket No. FIN0001-CON1-CIP3-CIP1
`
`-6-
`
`FINJAN-QUALYS 002