`Patent No. 8,074,115
`
`
`
`
`IN THE
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`_____________
`
`SYMANTEC CORPORATION,
`
`Petitioner
`
`- vs. -
`
`THE TRUSTEES OF COLUMBIA UNIVERSITY
`IN THE CITY OF NEW YORK,
`
`
`Patent Owner
`
`_____________
`
`Patent No. 8,074,115
`Issued: December 6, 2011
`Inventors: Salvatore J. Stolfo, Angelos D. Keromytis, and Stelios Sidiroglou
`Title: METHODS, MEDIA AND SYSTEMS FOR DETECTING ANOMALOUS
`PROGRAM EXECUTIONS
`
`Inter Partes Review No. 2015-00375
`
`EXHIBIT LIST
`_____________
`
`Mail Stop Patent Board
`Patent Trial and Appeal Board
`P.O. Box 1450
`Alexandria, VA 22313-1450
`
`
`
`
`
`
`
`
`
`IPR2015-00375
`Patent No. 8,074,115
`
`
`Petitioner’s Exhibit List
`
`Description
`
`Exhibit
`1001
`1002
`1003
`1004
`1005
`
`1006
`
`1007
`1008
`1009
`
`1010
`1011
`1012
`
`1013
`1014
`1015
`1016
`
`1017
`
`
`
`
`
`
`
`U.S. Patent No. 8,074,115
`File History of U.S. Patent No. 8,074,115
`Declaration of Michael T. Goodrich, Ph.D.
`Curriculum vitae of Michael T. Goodrich, Ph.D.
`The Trustees of Columbia University in the City of New York v.
`Symantec Corp., Civil Action No. 3:13-cv-808, Oct. 7, 2014 Claim
`Construction Order (Dkt. No. 123)
`The Trustees of Columbia University in the City of New York v.
`Symantec Corp., Civil Action No. 3:13-cv-808, Oct. 23, 2014 Claim
`Construction Order (Dkt. No. 146)
`U.S. Patent No. 5,440,723 (“Arnold”)
`U.S. Patent No. 8,108,929 (“Agrawal”)
`McGraw-Hill Dictionary of Scientific and Technical Terms (5th ed.
`1994)
`U.S. Patent Application No. 2005/0208562 (“Khazan”)
`U.S. Patent No. 7,334,005 (“Sobel”)
`Declaration of Michael J. Sacksteder in Support of Symantec
`Corporation’s Unopposed Motion for Pro Hac Vice Admission
`Deposition transcript of Mr. Scott Lewandowski
`Deposition transcript of George Cybenko, Ph.D.
`Supplemental Declaration of Michael T. Goodrich, Ph.D.
`Galen Hunt, et al., “Detours: Binary Interception of Win32 Functions,”
`Proceedings of the 3rd USENIX Windows NT Symposium, Seattle,
`WA, July 1999
`Expert Report of Professor Michael Bailey in The Trustees of Columbia
`University in the City of New York v. Symantec Corp., Civil Action No.
`3:13-cv-808, (October 17, 2014) (excerpt)
`
`
`1
`
`
`
`IPR2015-00375
`Patent No. 8,074,115
`
`
`Patent Owner’s Exhibit List
`
`
`
`
`
`Exhibit
`2001
`
`Description
`Sheasby Declaration ISO pro hac vice motion
`
`2002
`
`2003
`
`Declaration of Professor Douglas C. Szajda in The Trustees of
`Columbia University in the City of New York v. Symantec Corp., Civil
`Action No. 3:13-cv-808, Dkt. No. 106-1 (August 15, 2014)
`
`Expert Report of Dr. Richard Ford Regarding Invalidity of U.S. Patent
`Nos. 7,448,084, 7,913,306, 8,074,115 & 8,601,322 in The Trustees of
`Columbia University in the City of New York v. Symantec Corp., Civil
`Action No. 3:13-cv-808 (October 17, 2014) (excerpt)
`
`2004
`
`Expert Report of Dr. Trent Jaeger Regarding Invalidity of U.S. Patent
`Nos. 7,487,544 & 7,979,907 in The Trustees of Columbia University in
`the City of New York v. Symantec Corp., Civil Action No. 3:13-cv-808,
`(October 17, 2014) (excerpt)
`2005 McGraw-Hill Dictionary of Scientific and Technical Terms (6th ed.
`2003), p 108
`
`2006
`
`2007
`
`2008
`
`2009
`
`Schölkopf, B. et al., “Estimating the Support of a High-Dimensional
`Distribution,” Microsoft Research Technical Report MSR-TR-99-87
`(Nov. 27, 1999, revised Sept. 18, 2000), available at
`http://research.microsoft.com/pubs/69731/tr-99-87.pdf (last visited
`4/1/2015)
`
`Rebecca G. Bace, Intrusion Detection (MacMillian Technical
`Publishing, 2000) (excerpt), same as Ex. 1007 of IPR2015-00372
`
`Declaration of Michael T. Goodrich, Ph.D. in Support of Petition for
`Inter Partes Review of U.S. Patent No. 7,448,084 (IPR2015-00372,
`Exhibit 1003)
`
`Carey Nachenberg on-line profile, available from
`http://www.symantec.com/about/news/resources/press_kits/bios/bio.jsp
`? bioid=carey_nachenberg
`
`2
`
`
`
`IPR2015-00375
`Patent No. 8,074,115
`
`
`Exhibit
`2010
`
`Description
`Deposition transcript of Carey Nachenberg in The Trustees of Columbia
`University in the City of New York v. Symantec Corp., Civil Action No.
`3:13-cv-808 (Sept. 26, 2014) (excerpt)
`
`2011
`
`2012
`
`2013
`
`2014
`
`2015
`
`2016
`
`The Trustees of Columbia University in the City of New York v.
`Symantec Corp., No. 2015-1146 (Fed. Cir.), Opening Brief by
`Columbia University (Jan. 20, 2015)
`Richard Stallman et al., Debugging with GDB (9th Edition) (excerpt)
`
`Deposition transcript of Carey Nachenberg in The Trustees of Columbia
`University in the City of New York v. Symantec Corp., Civil Action No.
`3:13-cv-808 (Sept. 24, 2014) (excerpt)
`Roget's 21st Century Thesaurus (1992), p. 694
`US Patent No. 7,487,544
`
`Jude Shavlik et al., “Evaluating Software Sensors for Actively Profiling
`Windows 2000 Computer Users” (RAID 2001), same as Exhibit 1006 of
`IPR2015-00372
`
`2017 Wang, K., Parekh, J. J. & Stolfo, S. J., “Anagram: A Content Anomaly
`Detector Resistant to Mimicry Attack,” Columbia University Technical
`Report, available from
`https://mice.cs.columbia.edu/getTechreport.php?techreportID=403&for
`mat=pdf& (last visited 4/1/2015)
`
`2018
`
`American Heritage Dictionary of the English Language (4th ed. 2000)
`(excerpt)
`
`2019
`
`Intentionally not used
`
`2020
`
`Intentionally not used
`
`2021
`
`Intentionally not used
`
`
`
`3
`
`
`
`IPR2015-00375
`Patent No. 8,074,115
`
`
`Exhibit
`2022
`
`Intentionally not used
`
`Description
`
`2023
`
`Intentionally not used
`
`2024 Microsoft Computer Dictionary, Fifth Edition, 2002, p. 424
`
`2025 McGraw-Hill Dictionary of Scientific and Technical Terms, Sixth
`Edition, 2003, p. 1358
`
`2026 Microsoft Computer Dictionary, Fifth Edition, 2002, p. 229
`
`2027
`
`VMWare, What is virtualization? Virtualization 101 | United States,
`http://www.vmware.com/virtualization/how-it-works.html (last visited
`Sept. 27, 2015)
`
`2028
`
`United States Provisional Patent Application 60/730,289
`
`2029
`
`Deposition Transcript of Dr. Michael T. Goodrich taken Sept. 28, 2015
`and Sept. 30, 2015 in IPR2015-00375 and IPR2015-00377
`
`2030
`
`Declaration of Prof. George Cybenko
`
`2031
`
`Declaration of Scott M. Lewandowski
`
`2032
`
`2033
`
`2034
`
`
`
`Stelios Sidiroglou-Douskos Homepage,
`http://people.csail.mit.edu.edu/stelios (last visited Oct. 7, 2015)
`
`Eric Fosler-Lussier, Markov Models and Hidden Markov Models: A
`Brief Tutorial, TR-98-041, December 1998,
`http://di.ubi.pt/~jpaulo/competence/tutorials/hmm-tutorial-1.pdf.
`2028 United States Provisional Patent Application 60/730,289
`2029 Deposition Transcript of Dr. Michael T. Goodrich taken Sept. 28,
`2015
`
`4
`
`
`
`IPR2015-00375
`Patent No. 8,074,115
`
`
`Description
`John Shawe-Taylor and Blaz Zlicar, Novelty Detection with One-Class
`Support Vector Machines, in Advances in Statistical Models for Data
`Analysis, Studies in Classification, Data Analysis, and Knowledge
`Organization, 2015
`IEEE Membership and Subscription History of Prof. George Cybenko
`
`Exhibit
`2035
`
`2036
`
`2037
`
`IEEE – About the IEEE Fellow Program,
`http://www.ieee.org/membership_services/membership/fellows/index.ht
`ml (last visited Oct. 7, 2015)
`2038 William Landi, Undecidability of Static Analysis, in ACM Letters on
`Programming Languages and Systems, Vol. 1, No. 4, December 1992
`
`2039 Microsoft, Dynamic-Link Libraries (Windows),
`https://msdn.microsoft.com/en-us/
`library/windows/desktop/ms682589(v=vs.85).aspx (last visited Oct.
`7, 2015)
`2040 Microsoft, Linking an Executable to a DLL,
`https://msdn.microsoft.com/en-us/library/9yd93633(d=printer).aspx
`(last visited Oct. 7, 2015)
`Andrew M. Steane, Quick introduction to Windows API,
`https://users.physics.ox.ac.uk/~Steane/cpp_help/winapi_intro.html (last
`visited Oct. 7, 2015)
`Random House Webster’s College Dictionary, 2005, p. 404
`
`2041
`
`2042
`
`2043
`
`2044
`
`Jack Lo, VMware and CPU Virtualization Technology, 2005, available
`at http://download3.vmware.com/vmworld/2005/pac346.pdf
`
`VMware, Understanding Full Virtualization, Paravirtualization, and
`Hardware Assist, 2007, available at
`https://www.vmware.com/files/pdf/VMware_paravirtualization.pdf
`
`2045
`
`Apache, FAQ – Httpd Wiki, http://wiki.apache.org/httpd/FAQ (last
`visited Oct. 7, 2015)
`
`
`
`5
`
`
`
`IPR2015-00375
`Patent No. 8,074,115
`
`
`Description
`Exhibit
`2046 Wayback Machine, Oracle FAQ: General Questions,
`http://web.archive.org/web/20031014203617/http://www.orafaq.com/fa
`qora.htm (Oracle webpage captured by Wayback Machine Oct. 14,
`2003) (Oracle webpage last revised July 26, 2003) (Wayback Machine
`webpage last visited Oct. 7, 2015)
`Griffin Caprio, Virtual Machines: Virtualization vs. Emulation,
`http://www.griffincaprio.com/blog/2006/08/virtual-
`machinesvirtualization-
`vs-emulation.html (Aug. 16, 2006) (last visited Oct. 7, 2015)
`
`2047
`
`Lee M. Rossey, Robert K. Cunningham, David J. Fried, Jesse C. Rabek,
`Richard P. Lippmann, Joshua W. Haines, and Marc A. Zissman,
`LARIAT: Lincoln Adaptable Real-time Information Assurance Testbed,
`in Aerospace Conference Proceedings, IEEE 2002
`Sibsankar Haldar and Alex A. Aravind, Operating Systems, 2009, pp.
`83-109
`
`Sheldon Ross, A First Course in Probability, Prentice Hall, Sixth
`Edition, 2002, pp. 217-23
`
`Nir Friedman and Yoram Singer, Efficient Bayesian Parameter
`Estimation in Large Discrete Domains, Advances in Neural Information
`Processing Systems, 11, 1999
`Deposition Transcript of Dr. Michael T. Goodrich taken Aug. 24-26,
`2015, in IPR2015-00372, IPR2015-00374, and IPR2015-00378
`
`Declaration of Michael R. Fleming
`
`
`
`
`6
`
`2048
`
`2049
`
` 2050
`
`2051
`
` 2052
`
`2053
`
`
`
`
`
`
`
`
`
`
`
`IPR2015-00375
`Patent No. 8,074,115
`
`
`Dated: January 8, 2016
`
`
`
`
`
`Respectfully submitted,
`
`/s/ Brian M. Hoffman
`Brian M. Hoffman
`FENWICK & WEST LLP
`555 California Street, 12th Floor
`San Francisco, CA 94104
`Tel: (415) 875-2300
`Fax: (415) 281-1350
`Email: bhoffman@fenwick.com
`
`
`
`
`7
`
`
`
`IPR2015-00375
`Patent No. 8,074,115
`
`
`CERTIFICATE OF SERVICE
`
`Pursuant to 37 C.F.R. § 42.6, the undersigned certifies that on January 8,
`
`2016, a copy of the foregoing document EXHIBIT LIST was served by electronic
`
`mail, as agreed to by the parties, upon the following:
`
`Hong Zhong
`Michael Fleming
`IRELL & MANELLA LLP
`1800 Avenue of the Stars, Suite 900
`Los Angeles, CA 90067
`hzhong@irell.com
`MFleming@irell.com
`
`
`
`/s/ Brian M. Hoffman
`Brian M. Hoffman
`FENWICK & WEST LLP
`555 California Street, 12th Floor
`San Francisco, CA 94104
`Tel: (415) 875-2300
`Fax: (415) 281-1350
`Email: bhoffman@fenwick.com
`
`8