`Case 4:18-cv-07229—YGR Document 164-2 Filed 02/08/21 Page 1 of 16
`
`EXHIBIT A
`
`EXHIBIT A
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 2 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`1
`
`The Qualys Accused Products perform a multi‐lingual method for scanning incoming
`program code that a user attempts to download from the Internet. The program
`code is diverted to the Accused Products for analysis if the program code appears
`suspicious or is of a certain file type. Each Accused Product performs static,
`dynamic and behavioral analysis of received downloaded program code to identify
`exploits, and uses internal databases (as described below) to parse and analyze
`program code to detect exploits indicating that the program code is suspicious or
`malicious.
`
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`1
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 3 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1b. Contention 1 – The Accused Products, each resident on the Qualys Cloud,
`receive an incoming stream of computer code
`
`2
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`Each of the Accused Products, executed on a node that is part of the Qualys Cloud
`computing environment, includes a receiver component on a node that receives
`content based on a client device requesting the content from a source computer,
`such as the Internet. As shown below, the content is received by each Accused
`Product, (via the receiver) when a particular client device requests content provided
`by a source computer.
`
`2
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 4 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`3
`
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1b. Contention 2 – The Accused Products, each resident on Appliance Scanners,
`receive an incoming stream of computer code
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`Each of the Accused Products executed on Appliance Scanners, dispersed over a
`computer network, includes a receiver component that receives content based on a
`client device requesting the content from a source computer, such as the Internet.
`As shown below, the content is received by each Accused Product (via the receiver
`of the Appliance Scanner) when a particular client device requests content provided
`by a source computer.
`
`3
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 5 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1b. Contention 2 – The Accused Products, each resident on Appliance Scanners,
`receive an incoming stream of computer code (continued)
`
`4
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`As shown below, Scanner Appliances dispersed as endpoints throughout a
`computer network, receive content based on a client device requesting the content
`from a source computer, such as the Internet.
`
`receiver
`
`4
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 6 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`5
`
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1c. Contention 1 – Accused Products determine a programming language from the
`incoming stream of program code
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`Each Accused Product identifies malicious code expressed in different programming
`languages that are included within suspicious files. As shown below, each
`respective scanner of the Accused Products identifies exploits through parsing of
`html files and extracting suspicious JavaScripts, PDFs, visual basic scripts, and
`ActiveX components during static, dynamic, and behavior analysis.
`
`5
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 7 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`6
`
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1d. Contention 1 – Accused Products include a scanner that includes parser and
`analyzer rules
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`The database of each Accused Product, as part of the Qualys Cloud computing
`environment, stores parser and analyzer rules that enables each Accused Product’s
`respective scanner to scan and identify “vulnerabilities” (computer exploits) based
`on malicious content downloaded from a source computer, such as the Internet in a
`variety of languages.
`
`6
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 8 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`7
`
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1d. Contention 1 – Accused Products include a scanner that includes parser and
`analyzer rules (continued)
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`The parser and analyzer rules describe computer exploits as patterns of types of
`tokens because they enable the identification of malicious code expressed in
`different computer languages that are included within suspicious files. The patterns
`of types of tokens provided by the parser and analyzer rules enable each respective
`scanner to identify exploits through parsing of html files and extracting suspicious
`JavaScripts, PDFs, visual basic scripts, ActiveX components during static, dynamic,
`and behavior analysis.
`
`7
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 9 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`8
`
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1d. Contention 1 – Accused Products include a scanner that includes parser and
`analyzer rules (continued)
`
`The parser and analyzer rules describe computer exploits as patterns of types of
`tokens because they enable the identification of malicious code expressed in
`different computer languages that are included within suspicious files. The patterns
`of types of tokens provided by the parser and analyzer rules enable each respective
`scanner to identify exploits through parsing of html files and extracting suspicious
`JavaScripts, PDFs, visual basic scripts, ActiveX components during static, dynamic,
`and behavior analysis.
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the analyzer
`rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`8
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 10 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`12
`
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1d. Contention 1 – Accused Products include a scanner that includes parser and
`analyzer rules (continued)
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`The parser and analyzer rules describe computer exploits as patterns of types of
`tokens because they enable the identification of malicious code expressed in
`different computer languages that are included within suspicious files. The patterns
`of types of tokens provided by the parser and analyzer rules enable each respective
`scanner to identify exploits through parsing of html files and extracting suspicious
`JavaScripts, PDFs, visual basic scripts, ActiveX components during static, dynamic,
`and behavior analysis.
`
`12
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 11 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`Doctrine of Equivalents
`
`13
`
`To the extent that the Qualys Accused Products do not literally infringe this claim
`element, Qualys infringes under the doctrine of equivalents. The above described
`functionality of the Accused Products is at most insubstantially different from the
`claimed functionality and performs substantially the same function in substantially
`the same way to achieve substantially the same result.
`
`The Accused Products perform the same function as this element because the
`Accused Products include software components to identify specific programming
`languages and to identify exploits in the code.
`
`The Accused Products perform the above function in the same way because the
`Accused Products use rules to analyze the incoming program code to monitor for
`malicious activity. The Accused Products perform the function in the same way as
`parser rules and analyzer rules because the rules that the Accused Products use
`identify specific languages and exploits in program code.
`
`The Accused Products achieve the same result because they are able to inspect the
`incoming stream of programming code to identify its specific language and locate
`potentially malicious portions of the code.
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`13
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 12 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`14
`
`1e. Contention 1 – Accused Products identify tokens within an incoming stream
`
`Each Accused Product identifies malicious code expressed in different programming
`languages that are included within suspicious files. As described above in 1(c)
`above, each respective scanner of the Accused Products identifies exploits through
`parsing of html files and extracting suspicious JavaScripts, PDFs, visual basic scripts,
`and ActiveX components during static, dynamic, and behavior analysis. During these
`procedures, the Accused Products identify individual tokens as content is analyzed.
`
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`14
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 13 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`15
`
`1a. A computer processor‐based multi‐lingual method for Scanning
`incoming program code, comprising:
`
`1f. Contention 1 – Accused Products build parse trees during malware detection
`scans
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`During the scans described above in 1(d), each Accused Product builds parse trees,
`as shown below. The parse tress are built using the parsers rules described in 1(d)
`above.
`
`https://community.qualys.com/docs/DOC‐4523‐qualys‐api‐client‐examples
`
`15
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 14 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1g. Contention 1 – Accused Products build parse trees during malware detection
`scans
`
`16
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`During the scans described above in 1(d), each Accused Product detects indicators
`of potential exploits based on node combinations from the parse tree, as shown
`below. The Accused Product detect node combinations based at least in part on the
`analyzer rules discussed above.
`
`https://community.qualys.com/docs/DOC‐4523‐qualys‐api‐client‐examples
`
`16
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 15 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`17
`
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1h. Contention 1 – Accused Products build parse trees during malware detection
`scans
`
`1b. receiving, by a computer, an incoming stream of program
`code;
`
`1c. determining, by the computer, any specific one of a plurality of
`programming languages in which the incoming stream is written;
`
`1d. instantiating, by the computer, a scanner for the specific
`programming language, in response to said determining, the
`scanner comprising parser rules and analyzer rules for the specific
`programming language, wherein the parser rules define certain
`patterns in terms of tokens, tokens being lexical constructs for the
`specific programming language, and wherein the analyzer rules
`identify certain combinations of tokens and patterns as being
`indicators of potential exploits, exploits being portions of program
`code that are malicious;
`
`1e. identifying, by the computer, individual tokens within the
`incoming stream;
`
`1f. dynamically building, by the computer while said receiving
`receives the incoming stream, a parse tree whose nodes represent
`tokens and patterns in accordance with the parser rules;
`
`1g. dynamically detecting, by the computer while said dynamically
`building builds the parse tree, combinations of nodes in the parse
`tree which are indicators of potential exploits, based on the
`analyzer rules; and
`
`1h. indicating, by the computer, the presence of potential exploits
`within the incoming stream, based on said dynamically detecting.
`
`The Accused Products, executed on a computer that is part of the Qualys Cloud
`computing environment, each indicate the presence of potential exploits based on
`the detecting procedures of 1(g) above when they scan digital content to derive a
`corresponding content profile. As shown below, each Accused Product generates
`reports that identify “vulnerabilities” (computer exploits) based on malicious
`content downloaded from a source computer such as the Internet.
`
`https://www.qualys.com/forms/freescan/
`
`17
`
`© 2018 Finjan, Inc. ALL RIGHTS RESERVED
`Subject to FRE 408
`
`
`
`Case 4:18-cv-07229-YGR Document 164-2 Filed 02/08/21 Page 16 of 16
`
`US Patent No. 8,225,408
`Method and System for Adaptive Rule-based Content Scanners
`Claim 1
`
`18
`
`1a. A computer processor‐based multi‐lingual method for scanning
`incoming program code, comprising:
`
`1h. Contention 1 – Accused Products build parse trees during malware detection
`scans (continued)
`
`The Accused Products, executed on a computer that is part of the Qualys Cloud
`computing environment, each indicate the presence of potential exploits based on
`the detecting procedures of 1(g)