Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 1 of 113
`Case 4:18-cv-07229—YGR Document 132-2 Filed 11/05/20 Page 1 of 113
`
`EXHIBIT A
`
`EXHIBIT A
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 2 of 113
`Case 4:18-cv-07229—YGR Document 132-2 Filed 11/05/20 Page 2 of 113
`PTO/SBi57 (-31 —1 8)
`Approved for use through ‘E ‘t 130/2021. OMB 0551-0064
`US. Patent and Trademark Office U.S. DEPARTMENT OF COMMERCE
`
`
`. n persons are required to respond to a c
`er‘tiori of information uriie
`it displays a valid OMB
`"oi number.
`
`‘ed to as FORM PTO—1465)
`
`REQUEST FGR EX PARTE REEXAMENATEGN TRANSMETTAL FQRM
`
`Address to:
`
`Mail Stop Ex Parte Reexam
`Commissioner for Patents
`F410. Box 1450
`Alexandria, VA 223134450
`
`Attorney Docket No.: 6805100001
`
`Date: MarCh 19, 2020
`
`1.
`
`This is a request for ex parte reexamination pursuant to 37 CFR1.510 of patent number 77975305
`
`issued Juty 512011
`
`. The request is made by:
`
`third party requester.
`
`2.
`
`The name and address ofthe person requesting reexamination is:
`
`1) Rapid7 — 1480 Chestnut Ridge, State College, PA 16803
`
`
`
`Requester D asserts smaii entity status (37 CFR 1.27) or [:1 certifies micro entity status (37 CPR 1.29). Oniy
`a patent owner requester can certify micro entity status. Form PTO/SB/i 5A or 8 must be attached to certify
`micro entity status.
`
`3
`
`This request is accompanied by payment ofthe reexamination fee as set forth in:
`
`37 CFR 120(c)(2); or
`
`I: 37 CFR 120(c)(1). in checking this box for payment of the fee set forth in 37 CFR 120(c)(1), requester
`asserts that this request has forty (40) or fewer pages and complies with ail other requirements of
`37 CFR1.20(c)(1).
`
`Payment of the reexamination fee is made by the method set forth beiow.
`
`a. I: A check in the amount of $________________________________________ is enciosed to cover the reexamination fee;
`i).
`The Director is hereby authorized to charge the reexamination tee
`
`to Deposit Account No. 044679
`,
`o. I: Payment by credit card. Form PTOu2038 is attached; or
`d.
`Payment made via EFS-Web.
`
`in addition, the Director is hereby authorized to charge any fee deficiencies to
`
`Deposit Account No. 044679
`
`5.
`
`6.
`
`Any refund should be made by Dcheck or .credit to Deposit Account No. 044679
`37 CFR 126(c). if payment is made by credit card, refund must be to credit card account.
`
`A copy of the patent to be reexamined having a doubie column format on one side of a separate paper is
`enciosed. 37 CFR 1.510(b)(4).
`
`7. I: cotton: or core in duplicate, Computer Program (Appendix) or targe table
`El Landscape Table on CD
`
`1' 3}
`
`This ootiection oi. ..ormati0h is required by 37 C. P 1.510. The information is
`..quired to obtain or retain a benefit b the public which is to file (and by the USPTO
`
`
`to process) a request for reexamination. Confidentiality is governed by 35 U SC. 12.2. and 37 CFR 1.11 and 1.14. T it
`ection is estimated to take 18 minutes to
`
`complete, inciuding gathering, preparing, and submitting the completed application form to the USPTO. Time Will vary depending upon the individual case. Any
`comments on the amount oftime you require to complete this form and/or suggestions for reducing this burden, shoutd be sentto the Chief information Officer, U.S.
`Patent and Trademark Office. l.i.S. Department of Commerce, PO. Box 1450. Atexandria, VA 22313—1450. DO NOT SEND FEES OR COMPLETED FiiéRiViS TO
`THIS ADDRESS. SEND TO: Mail Stop Ex Parte Reexam, Commissioner for Patents, P.O. Box 1450. Aiexandria, VA 22313—1450.
`
`if you need as“ stance in trompr'ez‘ing the form, call ‘7 -800-PTO-9199 and select option 2.
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 3 of 113
`Case 4:18-cv-O7229—YGR Document 132-2 Filed 11/05/20 Page 3 of 113
`
`PTO/SEi/57 (01 -t 8)
`Approved for use. through 11/30/2021. OMB 0651-0064
`:3. DEPARTMENT OF COMMERCE
`U.S. Patent and Trademark Offic
`Under the Pa emork Reduction Act of 1995, no ersons are re uired to res tend to a coliection of information unles
`.
`la 5 a vaiid OMB control number.
`
`8. El Nucleotide and/or Amino Acid Sequence Submission
`If applicable, items a. m c. are required.
`
`a. I: Computer Readabie Form (CRF)
`'3). Specification Sequence Listing on:
`
`E. El CID—ROM (2 copies) or CD—R (2 copies) or
`ii. El paper
`c. El Statements verifying identity of above copies.
`
`
`
`9.
`
`A copy of any disciaimer, certificate or" correction or reexamination certificate issued in the patent is inciuded.
`
`10.
`
`11.
`
`Reexamination of ciaimr‘s) 6! 9- 11! 12’ 17 and 25
`
`is requested.
`
`A copy of every patent or printed pubiication reiied upon is submitted herewith inciuding a iisting thereof on
`Form PTO/SB/Os, PTO—“i449, or equivaient.
`
`12. El An Engiish ianguage translation of at: necessary and pertinent non—Engiish ianguage patents and/or printed
`publications is attached.
`
`13.
`
`The attached detailed request includes at ieast the foiiowing items:
`
`a. A statement identifying each substantiai new question of patentability based on prior patents and printed
`publications. 37 CFR 1.510(h)(1).
`
`b. An identification of every claim forwitich reexamination is requested. and a detaiied explanation of the
`pertinency and manner of applying the cited art to every claim for which reexamination is requested.
`37 CFR1.5’iD(b)(2).
`
`14. El A proposed amendment is included (oniy where the patent owner is the requester). 37 Cit-"R 1.510(e),
`
`15. E it is certified that the statutory estoppei provisions of 35 USC. 315(e)(1) or 35 U.S.C. 325(e)(t) do not
`prohibit requesterfrom tiling this ex parte reexamination request. 37 CFR 1.510(b)(6),
`
`Service
`
`a.
`
`it is certified that a copy ofthis request (if filed by other than the patent owner) has been served in its
`entirety on the patent owner as provided in 37 CFR 133(0).
`
`The name and address ofthe party served are:
`
`Dawn-Marie Bey 2
`
`A dupiicate copy is enclosed since service on patent owner was not possibie. Ah expianation of the
`efforts made to serve patent owner is attached. See MPEP 2220.
`
`Page 2 of Si
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 4 of 113
`Case 4:18-cv-O7229—YGR Document 132-2 Filed 11/05/20 Page 4 of 113
`PTiIi/SB/SY (Di —1 8)
`Approved for use through ‘i ‘iISOIZOZ‘i. OMB 0651-0064
`US. Patent and Trademark Office. U.S. DEPARTMENT O." " MMERCE
`Under the Paperwork Reduction Act of 1995, no persons are required to respond to a colieotion of information unless it displays a valid OMB i.
`3 number.
`
`17.
`
`Correspondence Address: Direct all communication about the reexamination to:
`
`The address associated with Customer Number: 39299
`
`OR
`
`Firm or lndividuai Name
`
`(at the address identified below)
`
`
`
`18.
`
`The patent is currentiy the subject ofthe foiiowing concurrent proceeding(s):
`
`at El Copending reissue Apptication No
`
`b. E] Copendihg reexamination Controi Not
`
`c. E] Copending interference No.
`
`d.
`
`Copending iitigation styled:
`
`1 21 8wCVm0‘i 519
`
`5: "i WEN—04467
`
`
`
`information on this form may become puhiic. Credit card information should not be inciuded on this
`WARNENG :
`form. Provide credit card information and authorization on PTO—2038,
`
`ID. Joseph Engiish/
`Authorized Signature
`
`D. Joseph Engiish
`Typed/Printed Name
`
`March 19, 2020
`
`Registration No.
`
`El For Patent Owner Requester
`
`For Third Party Requester
`
`{Page 3 of 3}
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 5 of 113
`Case 4:18-cv-07229—YGR Document 132-2 Filed 11/05/20 Page 5 of 113
`
`Privacy Act Statement
`
`The Privacy Act of 1974 (PL. 93—579) requires that you be given certain information in connection with your submission
`of the attached form reiated to a patent appiicaticn or patent. Accordingiy, pursuant to the requirements ofthe Act, piease
`be advised that: (1) the generai authority for the coiiection of this information is 35 USC. 2(b)(2); (2) furnishing of the
`information soiicited is voiuntary; and (3) the principai purpose for which the information is used by the US. Patent and
`Trademark Office is to process and/or examine your submission reiated to a patent appiication or patent.
`it“ you do not
`furnish the requested information, the US. Patent and Trademark Office may not be abte to process and/or examine your
`submission, which may resuit in termination of proceedings or abandonment ofthe appiication or expiration ofthe patent.
`
`The information provided by you in this form wiii be subject to the foiiowing routine uses:
`
`1 . The information on this form wiii be treated confidentiaiiy to the extent aiiowed underthe Freedom of information
`Act (5 U.S.C. 552) and the Privacy Act (5 USE: 552a). Records from this system of records may be disciosed
`to the Department of Justice to determine whether disciosure of these records is required by the Freedom of
`information Act.
`
`A record from this system of records may be disciosed, as a routine use, in the course of presenting evidence to
`a court, magistrate, or administrative tribunai,
`inctuding disciosures to opposing counsei
`in the course of
`settiement negotiations.
`A record in this system of records may be disciosed, as a routine use, to a Member of Congress submitting a
`request invoiving an individuai, to whom the record pertains, when the individuai has requested assistance from
`the Member with respect to the subject matter of the record.
`A record in this system of records may be disciosed, as a routine use, to a contractor ofthe Agency having need
`for the information in order to perform a contract. Recipients of information shaii be required to compiy with the
`requirements of the Privacy Act of 1974, as amended, pursuant to 5 U.S.C. 552a(m).
`A record reiated to an internationai Appiication fiied underthe Patent Cooperation Treaty in this system of records
`may be disciosed, as a routine use, to the internationai Bureau of the Worid tnteiiectuai Property Organization,
`pursuant to the Patent Cooperation Treaty.
`A record in this system of records may be disciosed, as a routine use, to another federai agency for purposes of
`Nationai Security review (35 1.1.8.0. 181) and for review pursuant to the Atomic Energy Act (42 USO. 218(0)).
`A record from this system of records may be disciosed, as a routine use. to the Administrator, Genera! Services,
`or his/her designee, during an inspection of records conducted by GSA as part of that agency’s responsibiiity to
`recommend improvements in records management practices and programs, under authority of 44 U.S.C. 2904
`and 2906. Such disciosure shaii be made in accordance with the GSA reguiations governing inspection of
`records for this purpose, and any other reievant (‘i_e., GSA or Commerce) directive. Such disciosure shaii not be
`used to make determinations about individuais.
`
`A record from this system of records may be disciosed, as a routine use, to the pubiic after either pubiication of
`the appiication pursuant to 35 U.S.C. 122(b) or issuance oi‘a patent pursuant to 35 U.S.C. 151. Further, a record
`may be disciosed, subject to the iimitations of 37 CFR 1.14, as a routine use, to the pubiic ifthe record was fiied
`in an appiication which became abandoned or in which the proceedings were terminated and which appiication
`is referenced by either a pubiished appiication, an appiication open to pubiic inspection or an issued patent.
`A record from this system of records may be disciosed, as a routine use, to a Federai, State, or iocai
`enforcement agency, if the USPTO becomes aware of a vioiation or potentiat vioiation of iaw or reguiation.
`
`iaw
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 6 of 113
`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 6 of 113
`
`IN THE UNITED STATES PATENT AND TRADEMARK OFFICE
`
`Request for Ex Part6 Reexamination
`
`US. Patent 7,975,305
`
`Issued:
`
`July 5, 2011
`
`OODOODOODOODOODOODOOD
`
`REQUEST FOR EXPARTE
`REEXAMINATION
`
`For:
`
`IVIETHOD AND SYSTEM FOR ADAPTIVE RULE-BASED
`
`CONTENT SCANNERS FOR DESKTOP COIVIPUTERS
`
`Mail Stop Ex Part6 Reexam
`Commissioner for Patents
`
`PO. Box 1450
`
`Alexandria, Virginia 22313-1450
`
`Sir:
`
`Pursuant to 35 U.S.C. §§ 302-307 and CPR. § 1.510, the undersigned
`
`hereby requests ex parte reexamination of Claims 6, 9, 11, 12, 17, and 25 of US.
`
`Patent No. 7,975,305 (the “Patent”). A Request for Ex Part6 Reexamination
`
`Transmittal Form (PTO/SB/57) is attached hereto.
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 7 of 113
`Case 4:18-cv-O7229-YGR Document 132-2 Filed 11/05/20 Page 7 of 113
`
`Table of Contents
`
`I.
`
`INTRODUCTION ............................................................................ 5
`
`II.
`
`RELATED PROCEEDINGS ............................................................. 7
`
`A.
`
`Prior Ex Parte Reexamination ................................................. 7
`
`B.
`
`Prior Inter Partes Review ........................................................ 7
`
`III.
`
`THE PATENT .................................................................................... 7
`
`A.
`
`B.
`
`The Specification ..................................................................... 7
`
`The Prosecution History ......................................................... 10
`
`1.
`
`2.
`
`The 437 Application Prosecution History .............................. 11
`
`The Reexam Prosecution History ........................................... 16
`
`C.
`
`The Claims ............................................................................. 19
`
`D.
`
`The Priority Date .................................................................... 23
`
`IV.
`
`STATEMENT OF THE LAW ......................................................... 26
`
`V.
`
`SUBSTANTIAL NEW QUESTION OF PATENTABILITY ......... 28
`
`VI.
`
`IDENTIFICATION OF CLAIMS FOR REEXAMINATION ........ 30
`
`VII. GROUNDS ....................................................................................... 30
`
`A.
`
`Ground 1: Claims 6, 9, 11, 12, 17 and 25 are unpatentable
`under 35 U.S.C. § 103 as obvious over Sandu in View of
`Wells. ...................................................................................... 3O
`
`1.
`
`2.
`
`3.
`
`4.
`
`Sandu ...................................................................................... 3O
`
`Wells ........................................................................................ 37
`
`Claims 1 and 13, and similarly Claim 25, are unpatentable
`over Sandu in View of Wells. .................................................. 47
`
`Claim 6 and Claim 9 are unpatentable over Sandu in View
`of Wells ................................................................................... 81
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 8 of 113
`Case 4:18-cv-O7229-YGR Document 132-2 Filed 11/05/20 Page 8 of 113
`
`5.
`
`6.
`
`Claim 11 and Claim 12 are unpatentable over Sandu in View
`of Wells ................................................................................... 84
`
`Claim 17 is unpatentable over Sandu in View of Wells .......... 85
`
`B.
`
`Ground 2: Claims 6, 9-12, 17 and 25 are unpatentable over
`Sandu in View of Wells and further in View of Freund ........ 89
`
`1.
`
`2.
`
`3.
`
`4.
`
`5.
`
`Freund..................................................................................... 89
`
`Claims 1 and 13 have been established to be unpatentable over
`Sandu in View of Wells ........................................................... 91
`
`Claims 6 and 9 are unpatentable over Sandu in View of Wells
`as applied to Claim 1 and further in View of Freund. ............ 9l
`
`Claims 11 and 12 are unpatentable over Sandu in View of
`Wells as applied to Claim 1 and further in View of Freund. ..94
`
`Claim 17 is unpatentable over Sandu in View of Wells as
`applied to Claim 13 and further in View of Freund................ 97
`
`VIII. CERTIFICATION REGARDING STATUTORY ESTOPPEL
`
`lOl
`
`IX.
`
`CONCLUSION .............................................................................. lOl
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 9 of 113
`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 9 of 113
`
`Exhibits
`
`Exhibit
`
`
`
`1001
`
`1002
`
`1003
`
`1004
`
`1005
`
`1006
`
`1007
`
`1008
`
`1009
`
`1010
`
`1011
`
`US. Patent 7,975,305 (the “Patent”)
`
`File History of US. Application 11/009,437
`
`File History of Reexamination 90/013,660
`
`PTAB Appeal Decision
`
`Federal Circuit Decision
`
`Final Written Decision in IPR2017-0173 8
`
`US. Publication US. 2005/0172338 A1 (“Sandu”)
`
`US. Patent 8,140,660 (“Wells”)
`
`US. Patent 5,987,611 (“Freund”)
`
`Ex Parte Reexamination Certificate for 7,975,305
`
`US. Patent 7,373,643
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 10 of 113
`Case 4:18-cv-O7229-YGR Document 132-2 Filed 11/05/20 Page 10 of 113
`
`I.
`
`INTRODUCTION
`
`Reexamination is requested for Claims 6, 9, ll, l2, l7, and 25 of the
`
`Patent (the “Challenged Claims”). Independent Claims 1 and 13, from which
`
`Claims 6, 9, l2, and 17 depend, and which independent Claim 25 parallels, have
`
`been canceled as a result of reexamination by Ex Part6 Reexamination Certificate
`
`issued January 29, 2020. This request seeks reexamination of claims not
`
`challenged in the prior reexamination, but have no separate basis for patentability
`
`than the canceled claims.
`
`The substantial new questions of patentability presented herein rely on the
`
`grounds that formed the bases for cancellation of independent Claims 1 and 13,
`
`and that were affirmed by the Court of Appeals for the Federal Circuit (see EX-
`
`] 005).
`
`In support of this Request for Ex Part6 Reexamination (the “Request”),
`
`requestor provides the following:
`
`°
`
`Pursuant to 37 C.F.R. § 1.510(a), payment for the filing fee for this
`
`Request. The Director is authorized to charge $12,000.00 for the
`
`filing fee pursuant to 37 CPR. § 120(c)(1), and additional fees, if
`
`any, in connection with the filing of this Request, to Deposit
`
`Account No. 04-1679. Any refund should be credited to the same
`
`deposit account;
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 11 of 113
`Case 4:18-cv-O7229—YGR Document 132-2 Filed 11/05/20 Page 11 of 113
`
`0
`
`°
`
`Pursuant to 37 C.F.R. § l.510(b)(l), a statement pointing out each
`
`substantial new question of patentability based on prior patents and
`
`printed publications. See Section V of this Request;
`
`Pursuant to 37 C.F.R. § l.510(b)(2), an identification of every claim
`
`for which reexamination is requested (see Sections MC and VI of
`
`this Request), and a detailed explanation of the pertinency and
`
`manner of applying the cited prior art to every claim for which
`
`reexamination is requested (see Section VII of this Request);
`
`°
`
`Pursuant to 37 C.F.R. § l.510(b)(3), a copy of every patent or printed
`
`publication relied upon or referred to in the above-identified
`
`statement of substantial new questions of patentability and detailed
`
`explanation. See EX-1006, EX-I 00 7, and EX-1008. None of these
`
`references are non-English language patents or printed publications.
`
`°
`
`Pursuant to 37 C.F.R. § l.510(b)(4), a copy of the entire Patent,
`
`including the front face, drawings, and specification/claims (in
`
`double column format) (see EX-1001). An Ex Parte Reexamination
`
`Certificate issued on January 29, 2020. EX-1009. The Patent is not
`
`subject to a terminal disclaimer,
`
`0
`
`Pursuant to 37 C.F.R. § l.510(b)(5), a certification that a copy of the
`
`Request has been served in its entirety on the patent owner at the
`
`address as provided for in 37 C.F.R. § 133(0), and
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 12 of 113
`Case 4:18-cv-O7229—YGR Document 132-2 Filed 11/05/20 Page 12 of 113
`
`o
`
`A certification by the requester that the statutory estoppel provisions
`
`of 35 U.S.C.315(e)(1) or 35 U.S.C.325(e)(1) do not prohibit the
`
`requester from filing this Request.
`
`II.
`
`RELATED PROCEEDINGS
`
`A.
`
`Prior Ex Parte Reexamination
`
`An Ex Parte Reexamination Certificate (see EX-1009) issued January 29,
`
`2020 as a result of Reexamination No. 90/013,660 canceling Claims 1, 2, 5, and
`
`13. The Examiner’s final rejection of the canceled claims (based on Ground 1
`
`asserted in this Request) was affirmed in a decision on appeal by the Patent Trial
`
`and Appeal Board (see EX-1004), which decision was subsequently affirmed by
`
`the Court of Appeals for the Federal Circuit (see EX-1005). Claims 3-4, 6-12,
`
`and 14-25 were not reexamined.
`
`B.
`
`Prior Inter Partes Review
`
`A Final Written Decision issued on January 24, 2019 as a result of Inter
`
`Par/es Review No. IPR2017-01738 holding that the petitioner in that proceeding
`
`failed to establish the unpatentability of the challenged claims on grounds
`
`unrelated to this Request (see EX-101 I).
`
`III. THE PATENT
`
`A.
`
`The Specification
`
`The Patent is generally directed to a system and method for receiving
`
`incoming content from the Internet destined to an Internet application,
`
`selectively diverting the incoming content from its intended destination,
`
`7
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 13 of 113
`Case 4:18-cv-O7229—YGR Document 132-2 Filed 11/05/20 Page 13 of 113
`
`scanning the incoming content to recognize the presence of potential
`
`computer exploits using rules from a database, and updating the database
`
`periodically. EX-IOO], Abstract, 2:37-52, claims 1, l3, and 25. The purported
`
`advantage of the Patent is that it “utilizes a novel description language for
`
`efficiently describing exploits.” According to the Patent specification, “[t]his
`
`description language enables an engineer to describe exploits as logical
`
`combinations of patterns of tokens.” EX-IOO], 2:28-31.
`
`More specifically, the Patent describes a particular way of scanning
`
`content at a destination computer as the content arrives, using three different
`
`components: a tokenizer, a parser, and an analyzer. See EX-IOO], FIG. 2, 9:9-
`
`19. The Patent specifically describes “adaptive rule-based (ARB) scanners.”
`
`EX-IOO], 2:10-11, FIG. 2. According to the Patent, “[t]he content scanners of
`
`the present invention are referred to as adaptive rule- based (ARB) scanners.
`
`An ARB scanner is able to adapt itself dynamically to scan a specific type of
`
`content, such as inter alia JavaScript, VBScript, URI, URL and HTML.” EX-
`
`]001, 2:10-14.
`
`Furthermore, the Patent provides that “ARB scanners are data-driven,
`
`and can be enabled to scan any specific type of content by providing
`
`appropriate rule files, Without the need to modify source code. Rule files are
`
`text files that describe lexical characteristics of a particular language. Rule
`
`files for a language describe character encodings, sequences of characters that
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 14 of 113
`Case 4:18-cv-O7229—YGR Document 132-2 Filed 11/05/20 Page 14 of 113
`
`form lexical constructs of the language, referred to as tokens, patterns of
`
`tokens that form syntactical constructs of program code, referred to as parsing
`
`rules, and patterns of tokens that correspond to potential exploits, referred to
`
`as analyzer rules. Rules files thus serve as adaptors, to adapt an ARB content
`
`scanner to a specific type of content.” EX-IOO], 2: 10-27.
`
`According to the patent specification, “[a] token is generally a sequence
`
`of characters delimited on both sides by a punctuation character, such as a
`
`white space. Tokens includes [sic] inter alia language keywords, values,
`
`names for variables or functions, operators, and punctuation characters.” EX-
`
`]001, 9:14-18.
`
`According to the Patent, parser rules are used to form a “parse tree.”
`
`According to the specification, “[p]referably, parser 220 uses a parse tree data
`
`structure to represent scanned content. A parse tree contains a node for each
`
`token identified while parsing, and uses parsing rules to identify groups of
`
`tokens as a single pattern.” EX-IOO], 10:49-55. “[I]mmediately after parser
`
`220 performs a reduce operation, it calls analyzer 230 to check for exploits.
`
`Analyzer 230 searches for specific patterns of content that indicate an
`
`exploit.” EX-IOO], 12:54-62.
`
`Claim 1 of the Patent recites “a network traffic probe operatively
`
`coupled to said network interface and to said rule-based content scanner, for
`
`selectively diverting incoming content from its intended destination to said
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 15 of 113
`Case 4:18-cv-O7229-YGR Document 132-2 Filed 11/05/20 Page 15 of 113
`
`rule-based content scanner.” Figure 9 of the patent illustrates such a “network
`
`traffic probe.” Within the specification, however, the network traffic probe is
`
`only described in terms of its function. For example, “network traffic probe
`
`920 selectively diverts incoming traffic to ARB scanner.” EX-IOO], 19:39-41.
`
`And, “[d]esktop computer 900 preferably includes a network traffic probe
`
`920, which generally passes incoming network traffic to its destination, be it a
`
`browser, e-mail client or other Internet application. However, in accordance
`
`with a preferred embodiment of the present invention, network traffic probe
`
`920 selectively diverts incoming traffic to ARB scanner 930.” EX-IOO],
`
`1 9: 3 5 - 5 1 .
`
`The Patent also describes a process for updating scanning rules. EX-
`
`1001, 19:52-55 (“In order to keep exploit rule database 940 current, desktop
`
`computer 900 preferably includes a rules update manager 960, which
`
`periodically receives modified rules and new rules over the Internet, and
`
`updates database 940 accordingly”).
`
`B.
`
`The Prosecution History
`
`US. Patent Appl. No. 11/009,437 (the “437 Application”) was filed on
`
`December 9, 2004. The Patent issued from the 437 Application with twenty-five
`
`claims, including independent Claims 1, 13, and 25.
`
`A Request for Ex Part6 Reexamination (No. 90/013,660) filed December
`
`11, 2015 requesting reexamination of Claims 1, 2, 5, and 13 was granted. As a
`
`10
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 16 of 113
`Case 4:18-cv-O7229-YGR Document 132-2 Filed 11/05/20 Page 16 of 113
`
`result of reexamination, an Ex Part6 Reexamination Certificate issued on January
`
`29, 2020 canceling all of the reexamined claims — Claims 1, 2, 5, and 13. This
`
`Request seeks reexamination of Claims 6, 9, 11, and 12 dependent from canceled
`
`Claim 1, Claim 17 dependent from canceled Claim 13, and independent Claim
`
`25, none of which were subject to reexamination in the prior proceeding.
`
`1.
`
`The 437 Application Prosecution History
`
`On September 5, 2008, the Examiner issued a non-final Office Action
`
`rejecting all pending claims as anticipated by US. Patent 5,987,611 to
`
`Freund (hereinafter, “Freund’ ’). Applicants responded by arguing that “the
`
`rules used in the subject claimed invention are p_arser rules and analyzer rules,
`
`which describe program source code exploits in terms of logical combinations
`
`of constructs of a specific programming language,” in distinction to the rules
`
`of Freund, which Applicants argued were “Internet access rules which limit a
`
`user’s use of the Internet” (emphasis in original). EX-1002 p. 582. Applicants
`
`amended the claims to specify that the rules are “behavioral rules” in order to
`
`“distinguish them from the access rules of Freund’ ’ (emphasis in original). Id.
`
`at 578-582. Applicants further stated that they “added the limitations that
`
`exploits are portions of program code that are potentially malicious, and that
`
`the behavioral rules describe exploits as logical combinations of patterns of
`
`program code constructs.” Id at 582. Applicants added:
`
`Thus using Freund, for example, a user may either be allowed
`
`unconditional access to all JavaScrip_t, or denied access to all
`
`11
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 17 of 113
`Case 4:18-cv-07229—YGR Document 132-2 Filed 11/05/20 Page 17 of 113
`
`JavaScript; whereas using the claimed invention, each JavaScript is
`
`scanned for the presence of potentially malicious behavior and then
`
`conditionally allowed or denied.
`
`Id. at 5 84 (emphasis in original).
`
`According to Applicants, the access rules of Freund determine whether
`
`the user has permission to use protocol components such as “JavaScript
`
`(<SCRIPT> tag)” when parsing contents of an HTML page for such
`
`components, but do not describe how to recognize malicious exploits such as
`
`the JavaScript code that the user is trying to access. Id.
`
`The Examiner issued a final Office Action on January 13, 2009
`
`maintaining the anticipation rejection over Freund, adding further rejections,
`
`and stating that there is no written description support for the various
`
`limitations added by Applicants by amendment, including “behavioral rules”
`
`that “correspond to potentially malicious computer exploits and that describe
`
`exploits as logical combinations of patterns of program code constructs.”
`
`Applicants responded by amending the claim language from “behavioral
`
`rules” to “parser and analyzer rules” and pointing to portions of the
`
`specification that allegedly support the amendments. EX-1002 pp. 504-512.
`
`Although these amendments were subsequently entered after Applicants filed
`
`an RCE, the Examiner issued another non-final Office Action on June 15,
`
`2010, maintaining the rejections over Freund on the basis that Applicant’s
`
`12
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 18 of 113
`Case 4:18-cv-O7229—YGR Document 132-2 Filed 11/05/20 Page 18 of 113
`
`latest substantive papers comprised mere allegations of novelty without any
`
`evidence, argument, or rationale for support. EX-IOO2 pp. 270-283
`
`In response, Applicants amended the independent claims as follows:
`
`wherein the parser and analyzer rules describe computer exploits as
`
`patterns of types of tokens, tokens being program code constructs,
`
`and types of tokens comprising a punctuation type, an identifier type
`
`and a function type;
`
`EX-IOO2 pp. 256-259 and 262(emphasis in original).
`
`According to Applicants, the limitation added by amendment provides
`
`novelty for the claimed invention, which is “describing and recognizing
`
`computer exploits from patterns of types of tokens,” where types of tokens
`
`comprise a “punctuation type, an identifier type and a function type.” Id at
`
`262-264.
`
`More specifically, Applicants stressed that “tokens” and “patterns of
`
`types of tokens” have different meanings. Id at 263. Applicants explained
`
`that tokens can be categorized into different “types” where, for example,
`
`APPLET, OBJECT, IMAGE, etc. are different tokens of the same “identifier
`
`type.” Id According to Applicants, an exemplary “pattern of types of tokens”
`
`is a token that is of the “identifier type” followed by a token of the
`
`“punctuation type” followed again by a token of the “identifier type” etc. Id
`
`Importantly, in addressing the Examiner’s rejections, Applicants stated
`
`that:
`
`13
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 19 of 113
`Case 4:18-cv-O7229—YGR Document 132-2 Filed 11/05/20 Page 19 of 113
`
`the prior art does not relate to categorization of tokens into types,
`
`i.e., categories of tokens, and to description of computer exploits
`
`in terms of such categories.
`
`Id (emphasis in original).
`
`Applicants recognized that Freund may disclose tokens such as tags,
`
`syntax elements and HTML components; however, Applicants stated that
`
`Freund does not disclose “patterns of types of tokens.” Id Applicants
`
`repeated its conclusion specifically stating “Freund does not teach
`
`categorization of tokens into types, nor description of computer exploits in
`
`terms of patterns of types of tokens.” Id at 264. Applicants stated that Claim
`
`1 was amended to explicitly recite that token types include “punctuation type,
`
`an identifier type and a function type” in order to “clarify this distinction.” Id
`
`Accordingly, based on the amendments and arguments presented by
`
`Applicants during prosecution of the 437 Application, it is clear that the
`
`alleged point of novelty of the Patent is the categorization of tokens into the
`
`types of tokens that are recited in Claim 1, and describing exploits in terms of
`
`patterns of such types of tokens.
`
`An interview subsequently took place between the Examiner and
`
`Applicants’ representative. A summary of that interview by the Examiner
`
`(which was agreed to by Applicants’ representative) further confirms the
`
`aforementioned distinction. EX-IOO2 p. 249-250 and 252. During this
`
`interview, Applicants’ representative stressed that the prior art does not
`
`14
`
`

`

`Case 4:18-cv-07229-YGR Document 132-2 Filed 11/05/20 Page 20 of 113
`Case 4:18-cv-O7229—YGR Document 132-2 Filed 11/05/20 Page 20 of 113
`
`disclose the “types” of tokens according to Applicants’ definition of that
`
`term, and that the parsing techniques and lexical analysis taught in the prior
`
`art does not render obvious Applicant’s claims pertaining to describing
`
`exploits as “patterns of types of tokens.” Id.
`
`A Notice of Allowability subsequently issued on December 20, 2010
`
`together with an Examiner’s Amendment adding certain terms (6. g,
`
`“computer”) to