IPR2015-00375
`Patent No. 8,074,115
`
`
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`_____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`_____________
`
`SYMANTEC CORPORATION,
`Petitioner,
`v.
`
`THE TRUSTEES OF COLUMBIA UNIVERSITY
`IN THE CITY OF NEW YORK,
`Patent Owner.
`_____________
`
`Case IPR2015-00375
`Patent 8,074,115
`_____________
`
`PETITIONER’S REPLY TO PATENT OWNER RESPONSE
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`
`TABLE OF CONTENTS
`
`Page
`
`I.
`
`II.
`
`Overview .......................................................................................................... 1
`
`The Disputed Level of Ordinary Skill in the Art Casts Doubt Over
`Dr. Cybenko’s Opinions .................................................................................. 1
`
`III. Khazan Anticipates Claims 22, 25, 27-29, 32, 35-39, and 42 ......................... 3
`
`A. Khazan discloses “modifying a program to include indicators of
`program-level function calls” ................................................................ 3
`
`B. Khazan discloses “identifying a function call as anomalous” .............. 6
`
`C. Khazan discloses an “emulator” ............................................................ 9
`
`D. Khazan discloses that “the model reflects normal activity” ................ 10
`
`E. Khazan discloses that “the model reflects attacks against the at least a
`part of the program” ............................................................................ 11
`
`F.
`
`Khazan discloses a “model of function calls” ..................................... 12
`
`IV. The Combination of Khazan and Arnold Render Obvious Claims 1, 4-8,
`11, 14-18, 21, and 26 ..................................................................................... 13
`
`A.
`
`B.
`
`The combination of Khazan and Arnold teaches the claimed
`“application community” ..................................................................... 13
`
`The combination of Khazan and Arnold teaches “upon identifying the
`anomalous function call, notifying an application community that
`includes a plurality of computers of the anomalous function call” ..... 15
`
`V.
`
`The Combination of Khazan, Arnold, and Agrawal Render Obvious
`Claims 2, 3, 9, 10, 12, 13, 19, 20, 23, 24, 30, 31, 33, 34, 40, and 41 ............ 17
`
`A.
`
`The combination of Khazan, Arnold, and Agrawal discloses
`“randomly selecting the model as to be used in the comparison from a
`plurality of different models relating to the program” ........................ 18
`
`ii
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`B.
`The combination of Khazan, Arnold, and Agrawal discloses
`“randomly selecting a portion of the model to be used in the
`comparison” ......................................................................................... 19
`
`C.
`
`D.
`
`E.
`
`The combination of Khazan, Arnold, and Agrawal discloses “creating
`a combined model” .............................................................................. 20
`
`The combination of Khazan, Arnold, and Agrawal discloses “creating
`a combined model from at least two models created using different
`computers” ........................................................................................... 21
`
`The combination of Khazan, Arnold, and Agrawal discloses “creating
`a combined model from at least two models created at different times”23
`
`VI.
`
`It Would Have Been Obvious to Combine Khazan, Arnold, and Agrawal .. 24
`
`iii
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`
`EXHIBIT LIST
`
`Description
`
`U.S. Patent No. 8,074,115
`
`File History of U.S. Patent No. 8,074,115
`
`Declaration of Michael T. Goodrich, Ph.D.
`
`Curriculum vitae of Michael T. Goodrich, Ph.D.
`
`The Trustees of Columbia University in the City of New York v.
`Symantec Corp., Civil Action No. 3:13-cv-808, Oct. 7, 2014 Claim
`Construction Order (Dkt. No. 123)
`
`The Trustees of Columbia University in the City of New York v.
`Symantec Corp., Civil Action No. 3:13-cv-808, Oct. 23, 2014 Claim
`Construction Order (Dkt. No. 146)
`
`U.S. Patent No. 5,440,723 (“Arnold”)
`
`U.S. Patent No. 8,108,929 (“Agrawal”)
`McGraw-Hill Dictionary of Scientific and Technical Terms (5th ed.
`1994)
`
`U.S. Patent Application No. 2005/0208562 (“Khazan”)
`
`U.S. Patent No. 7,334,005 (“Sobel”)
`
`Declaration of Michael J. Sacksteder in Support of Symantec
`Corporation’s Unopposed Motion for Pro Hac Vice Admission
`
`Deposition transcript of Mr. Scott Lewandowski
`
`Deposition transcript of George Cybenko, Ph.D.
`
`Supplemental Declaration of Michael T. Goodrich, Ph.D.
`
`
`
`Exhibit
`1001
`
`1002
`
`1003
`
`1004
`
`1005
`
`1006
`
`1007
`
`1008
`
`1009
`
`1010
`
`1011
`
`1012
`
`1013
`
`1014
`
`1015
`
`iv
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`1016
`Galen Hunt, et al., “Detours: Binary Interception of Win32 Functions,”
`Proceedings of the 3rd USENIX Windows NT Symposium, Seattle, WA,
`July 1999
`
`1017
`
`Expert Report of Professor Michael Bailey in The Trustees of Columbia
`University in the City of New York v. Symantec Corp., Civil Action No.
`3:13-cv-808, (October 17, 2014) (excerpt)
`
`v
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`
`I. Overview
`In its Decision to institute this inter partes review, the Board rejected Patent
`
`Owner’s proposed claim constructions because the “claim language does not
`
`expressly require” the narrowed limitations that Patent Owner suggested. See
`
`Institution Decision, Paper No. 13 at 7. Despite the Board’s guidance that it will
`
`reject proposed constructions injecting language that is not expressly required by
`
`the claims, Patent Owner, in its Response, repeatedly argues that the claims of the
`
`’115 patent are distinguishable from the prior art by advancing constructions not
`
`expressly required by the claims. Perhaps even more surprising, Patent Owner’s
`
`Response alleges that the express language in the challenged claims is not met by
`
`identical language in the prior art. Patent Owner’s Response runs counter to the
`
`Board’s Decision, the claim language, and common sense.
`
`II. The Disputed Level of Ordinary Skill in the Art Casts Doubt Over
`Dr. Cybenko’s Opinions
`
`Patent Owner, in attempting to disparage Dr. Goodrich’s analysis, managed
`
`only to cast doubt on the testimony of its own expert, Dr. Cybenko. See Patent
`
`Owner Response (“Response”), Paper No. 24 at 6. Petitioner’s expert, Dr.
`
`Goodrich, declared that “the level of ordinary skill in the art of the ’115 patent at
`
`the time of the effective filing date is a person with a Master’s degree in computer
`
`science or a related field with two or three years of experience in the field of
`
`1
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`software security systems.” Ex. 1003 at ¶ 20. Patent Owner countered that “a
`
`POSITA at the time of the invention would have at least an undergraduate degree
`
`in computer science or mathematics and one to two years of experience in the field
`
`of computer security.” Response at 4. The key difference between the parties’
`
`proposed level of ordinary skill, therefore, is as little as one to two years of
`
`schooling or experience in the field. Ex. 1015 at ¶¶ 5-6. This difference is not
`
`material, and both experts have asserted that their conclusions are the same
`
`regardless of which level of skill is adopted by the Board. Id. at ¶ 7; compare
`
`Ex. 2029 at 312:15-22 with Ex. 2030 at ¶ 28; Ex. 1014 at 25:13-17.
`
`However, Dr. Cybenko’s conclusion that a POSITA has only an
`
`undergraduate degree is suspect. Patent Owner argues that the “educational level
`
`of the inventor” is “the first factor to consider ‘in determining level of ordinary
`
`skill in the art.’” Response at 4-5 (citing Daiichi Sankyo Co. v. Apotex, Inc., 501
`
`F.3d 1254, 1256 (Fed. Cir. 2007). Patent Owner then asserts that one of the three
`
`named inventors of the ’115 patent, Stelios Sidiroglou, “had not yet received a
`
`Master’s degree at the time of the invention.” Response at 4-5. This is incorrect.
`
`Patent Owner’s own exhibit demonstrates that inventor Stelios Sidiroglou had a
`
`Master’s degree at the time of invention. Ex. 2032 at 1 (showing that inventor
`
`Sidiroglou-Douskos obtained a Master of Science degree from Columbia in 2003,
`
`before the 2005 priority date of the ’115 patent).
`
`2
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`Moreover, Dr. Cybenko admitted that a person with his asserted ordinary
`
`level of skill likely would not have been exposed to the machine learning concepts
`
`described in the specification of the ’115 patent. Ex. 1014 at 27:15-23. Given that
`
`Patent Owner and Dr. Cybenko (wrongly) argue that machine learning is central to
`
`the claims of the ’115 patent, Dr. Cybenko’s testimony undermines his proposed
`
`level of ordinary skill and casts doubt over the remainder of his opinions.
`
`III. Khazan Anticipates Claims 22, 25, 27-29, 32, 35-39, and 42
`A. Khazan discloses “modifying a program to include indicators of
`program-level function calls”
`
`Khazan unequivocally discloses modifying a program to include indicators
`
`of program-level function calls. Patent Owner argues against this clear disclosure,
`
`alleging: 1) Khazan does not disclose modifying “the program itself;” and 2)
`
`Khazan does not disclose tracking function calls internal to the program. Response
`
`at 10-14. The first argument is directly contracted by Khazan, while the second
`
`actually supports a conclusion that the ’115 patent is anticipated.
`
`First, Patent Owner argues that Khazan does not disclose “that the
`
`instrumentation technique modifies the program itself.” Response at 10-11. Patent
`
`Owner then cites ¶ 73 of Khazan as allegedly showing that only “associated
`
`libraries, such as all operating system DLLs, are instrumented.” Id. Patent Owner,
`
`however, ignores multiple disclosures in Khazan that discuss modifying the
`
`program itself. For instance, Khazan discloses “the instrumentation technique
`
`3
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`described in one embodiment herein modifies the memory loaded copy of the
`
`application and associated libraries to execute additional monitoring code.” Ex.
`
`1010 at ¶ 75 (emphasis added); see also id. at ¶ 79 (disclosing “instrumenting the
`
`application”). Patent Owner’s own expert in a related litigation, Professor Michael
`
`Bailey, agrees that this in-memory modification meets the limitations of the claim.
`
`See Ex. 1017 at 5 (a POSITA “would not draw a distinction between the in-
`
`memory code and the on-disk code of a program…” and “the plain and ordinary
`
`meaning of ‘modifying a program’ includes modification of in-memory code.”).
`
`Moreover, Khazan directly contradicts Patent Owner’s argument by explicitly
`
`disclosing “the instrumentation of the program itself.” Compare Ex. 1010 at ¶ 114
`
`(“Implementing the monitoring and interception steps may involve the
`
`instrumentation of the program itself….”) with Response at 10 (“Petitioner has not
`
`identified a teaching in Khazan that the instrumentation technique modifies the
`
`program itself.”).
`
`Second, Patent Owner admits that “Khazan consistently states that its system
`
`monitors external function calls….” Patent Owner and Petitioner are thus in
`
`agreement that Khazan monitors external function calls. See Petition at 20 (“In
`
`particular, ‘the instrumentation facilitates monitoring of the application’s
`
`executions as pertaining to the invocations of the external target functions.’”)
`
`(quoting Khazan, Ex. 1010 at ¶ 75).
`
`4
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`Nonetheless, Patent Owner asserts that monitoring external function calls is
`
`not enough, arguing that “Petitioner has not explained how functions that are
`
`internal to the program (not in libraries) would be tracked….” Response at 12.
`
`That argument is inconsistent with the position Professor Bailey took in the related
`
`litigation. Ex. 1017 at 4 (“‘[T]he program’s functions’ applies to the function calls
`
`being made by the program, whether they are external…or internal….”)
`
`(emphasis added). In his opinion, a POSITA “would agree that a program-level
`
`function call is not limited to an internal call.” Id. Patent Owner did not provide
`
`Professor Bailey’s testimony to Petitioner, and thus failed to comply with 37 C.F.R.
`
`§ 42.51, which requires a party to “serve relevant information that is inconsistent
`
`with a position advanced by the party during the proceeding concurrent with the
`
`filing of the documents or things that contain the inconsistency.”
`
`Additionally, Khazan does not limit its system to tracking only external calls
`
`and acknowledges that internal calls may be tracked. See Ex. 1010 at ¶ 44 (“in a
`
`case when target functions are external to the application executable”); id. at ¶ 42
`
`(“in one embodiment, it may be determined that the target function calls to be
`
`identified are those that are external to the application 102”); id. at ¶ 109 (“In one
`
`embodiment, when the target functions are external”) (emphasis added). A named
`
`inventor of Khazan, Scott Lewandowski, agrees that it is a reasonable inference
`
`that such statements in Khazan indicate there are cases where the target functions
`
`5
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`are not external. Ex. 1013 at 96:7-98:12. Additionally, the software package used
`
`by Khazan’s system to perform instrumentation, Microsoft “Detours,” enabled
`
`tracking of internal function calls. See Ex. 1010 at ¶ 79 (explaining that Khazan
`
`used “Detours”); Ex. 1016 at 2 (“the instrumentation DLL can detour any Win32
`
`function, whether in the application or system libraries”) (emphasis added).
`
`B. Khazan discloses “identifying a function call as anomalous”
`The Board construed “anomalous” to mean “deviation/deviating from a
`
`model of typical computer system usage.” Institution Decision at 6. Khazan
`
`discloses that its model comprises typical computer system usage and explicitly
`
`discloses “deviation” from the model. Patent Owner nonetheless argues that
`
`Khazan does not disclose “identifying a function call as anomalous” for two
`
`reasons: 1) Khazan does not model “typical computer system usage;” and 2)
`
`Khazan does not disclose “deviation” from a model. Response at 14-18.
`
`Patent Owner’s first argument boils down to saying that Khazan does not
`
`construct its model “by examining computer system usage, but rather by looking
`
`statically at unexecuted code.” Response at 15 (emphasis in original). However,
`
`this argument is again contrary to the disclosure expressed by Khazan’s inventors
`
`in the patent application. Khazan discloses determining that a program has
`
`executed malicious code if the program’s run time behavior deviates from a model
`
`of “normal or expected behavior.” Ex. 1010 at ¶ 65; see id. at ¶ 67 (“Normal
`
`6
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`behavior, or non-MC behavior, is associated with particular target function calls
`
`identified by the static analyzer 104.”). As such, Khazan’s model is of “normal”
`
`usage (typical computer system usage) and malicious code (or non-normal
`
`behavior) is determined based on comparison with the model. Id.; Ex. 1015 at ¶ 8.
`
`Furthermore, as the Board noted, Khazan explicitly teaches that models of typical
`
`computer system usage were prior art. Institution Decision at 9-10 (citing Ex.
`
`1010 at ¶ 9 (“Some existing anomaly detection techniques create models of normal
`
`behavior of a particular application based on observing sequences of system calls
`
`executed at run time as part of a learning phase.”).
`
`To support Patent Owner’s argument, Dr. Cybenko testified, incredibly, that
`
`Khazan incorrectly described its own system. See Ex. 1014 at 41:7-61:12 (e.g.,
`
`42:23-25: “I disagree with the characterization of the – the characterization and
`
`use of normal behavior in the context of the patent application”). However,
`
`“[e]xpert testimony in conflict with the intrinsic evidence” is “accorded no
`
`weight.” DESA IP, LLC v. EML Techs., LLC, 211 F. App'x 932, 936 (Fed. Cir.
`
`2007). In any event, even Dr. Cybenko ultimately acknowledged that static
`
`analysis, as is used to create Khazan’s model, can “identify what the program is
`
`capable of doing….” Ex. 1014 at 60:18-61:12. Patent Owner’s statement that
`
`“Khazan’s static analyzer…cannot be the basis for determining a deviation from ‘a
`
`model of typical computer system usage’…” thus is contradicted by its own expert.
`
`7
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`Patent Owner’s second argument is that Khazan does not disclose “deviation
`
`from a model.” Response at 16-18. This argument is incorrect as well. Deviation
`
`from the model of normal usage is precisely the mechanism Khazan employs for
`
`identifying malicious code. See, e.g., Ex. 1010 at ¶ 65 (“If the run time behavior
`
`deviates from the application model, it is determined that the application
`
`executable has executed MC.”); id. at ¶ 67 (“If there are any deviations detected
`
`during the execution of the application executable 102, it is determined that the
`
`application executable 102 includes MC.”) (emphasis added).
`
`To reconcile its argument that the “deviations” of Khazan are not the same
`
`as the “deviation” required by the construction of “anomalous,” Patent Owner
`
`attempts to narrow “deviation” to mean “a statistical deviation beyond normal
`
`variations.” Response at 18 (internal quotation omitted). But the Board has
`
`consistently rejected Patent Owner’s similar attempts where “the claim language
`
`does not expressly require” the proposed construction. Institution Decision at 7.
`
`Here, the claim language does not expressly require “statistical deviation.”
`
`Further, as Dr. Cybenko acknowledged, the Board’s construction of “anomalous”
`
`does not require “statistical deviation beyond normal variations.” Ex. 1014 at
`
`87:12-19. (“Q: Does the board’s interpretation say anything about statistical
`
`deviation? A: No. But it describes deviation from a model of typical computer
`
`system usage. Q: And the board also doesn’t say anything about deviation beyond
`
`8
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`normal variation, correct? A: The board does not say anything about that.”).
`
`C. Khazan discloses an “emulator”
`Khazan explicitly discloses that a detection tool may execute one or more
`
`executables to detect malicious codes, and that this “may also be done as an
`
`emulation or simulation of the execution, or in what is known to those skilled in
`
`the art as a virtual environment, such as VMWare.” Ex. 1010 at ¶ 111 (emphasis
`
`added). Khazan goes on to explain that detection of malicious code may be
`
`performed by executing an application and that “execution of the application may
`
`also be emulated or simulated.” Id. at ¶ 112 (emphasis added).
`
`Patent Owner argues that the claimed “‘emulator’ must permit both
`
`monitoring and selective execution” but asserts that “Petitioner has never linked
`
`what it identifies as the emulator in Khazan to either of these capabilities.”
`
`Response at 18-19. Patent Owner’s statement is incorrect. Petitioner’s expert Dr.
`
`Goodrich stated in his declaration that “[o]ne of ordinary skill would recognize
`
`from these statements [in Khazan] that Khazan teaches that at least part of a
`
`program may be executed in an emulator (i.e., software, alone or in combination
`
`with hardware, that permits the monitoring and selective execution of certain parts,
`
`or all, of a program).” Ex. 1003 at ¶ 66. In other words, “emulation,” as disclosed
`
`in Khazan, is performed by an emulator. Ex. 1015 at ¶¶ 9, 10.
`
`Patent Owner makes an extremely convoluted argument that Khazan is
`
`9
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`referring to an emulator that does not permit the monitoring and selective
`
`execution. Response at 19-20; Ex. 2030 at ¶¶ 131-53. This argument is supported
`
`by a yarn Dr. Cybenko spins that a POSITA would interpret “emulation” to “mean
`
`that these executions can be performed on non-native hardware…” rather than
`
`simply executing in software that permits monitoring and selective execution. Ex.
`
`2030 at ¶¶ 142, 152. His conclusions, however, are based on speculation and leaps
`
`of logic that stray well beyond the disclosure in Khazan. Ex. 1015 at ¶¶ 10-14.
`
`Furthermore, Mr. Lewandowski’s declaration does not support Dr. Cybenko’s
`
`claims. Ex. 2031 at ¶ 18 (referring to the “‘sandbox’ protection offered by an
`
`emulator or a virtual environment”); Ex. 1015 at ¶ 12.
`
`D. Khazan discloses that “the model reflects normal activity”
`Both Petitioner’s expert and Patent Owner’s expert agree that the term
`
`“reflects,” as used in this claim limitation, means “describes.” Ex. 1003 at ¶ 60;
`
`Ex. 2030 at ¶ 155; Ex. 1014 at 184:8-11, 185:6-8. Khazan’s model describes
`
`“normal activity of at least part of the program.” Ex. 1010 at ¶ 67 (“Normal
`
`behavior, or non-MC behavior is associated with particular target function calls
`
`identified by the static analyzer 104”); Ex. 1003 at page 107.
`
`Nevertheless, Patent Owner argues that Khazan’s model does not satisfy this
`
`claim limitation because “a POSITA would understand that a limitation that the
`
`model reflects or describes something would require the presence of data inside the
`
`10
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`model.” Response at 21 (citing to Dr. Cybenko’s declaration at ¶ 155 for support).
`
`However, Patent Owner’s construction should be rejected because “the claim
`
`language does not expressly require” the presence of normal activity inside the
`
`model. See Institution Decision at 7 (the Board rejecting Patent Owner’s
`
`constructions that, similarly, narrowed the scope beyond the express requirements
`
`of the claim). Nevertheless, Khazan’s model, indeed, describes and comprises
`
`normal activity. See Ex. 1010 at ¶¶ 65 and 67; Ex. 1003 at pages 56-57.
`
`Patent Owner’s second argument is that “normal activity is not included
`
`within Khazan’s list.” Response at 21. But this just rehashes Patent Owner’s
`
`previous argument about “computer system usage.” Once again, Dr. Cybenko
`
`supports his position by denying the plain meaning of the words in Khazan. Ex.
`
`1014 at 176:8-177:7 (Dr. Cybenko: “Those are the words Khazan uses, but that’s
`
`not the characterization that either I or other people, I believe, have used.”). Patent
`
`Owner’s argument here fails for the same reasons provided above in Section III.B.
`
`E. Khazan discloses that “the model reflects attacks against the at least
`a part of the program”
`
`As discussed above, the parties’ experts agree that “reflects” means
`
`“describes.” Ex. 1003 at ¶ 60; Ex. 2030 at ¶ 155. Although Khazan’s model is
`
`created using “normal behavior” obtained by the static analyzer, Khazan notes that
`
`misuse detection techniques “may miss, for example, slight variations of known
`
`MC and new, previously unseen, instances of MC.” Ex. 1010 at ¶¶ 9 and 67.
`
`11
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`Dr. Goodrich confirms that “[s]uch ‘missed’ malicious code would inadvertently
`
`be incorporated into the model.” Ex. 1003 at p. 108.
`
`In response, Patent Owner again makes a variation of the “computer system
`
`usage” argument. Response at 22. In addition, Patent Owner asserts that the claim
`
`requires attack data be knowingly incorporated in the model. Response at 23 (“…a
`
`POSITA would not have had a reason to build a model that inadvertently includes
`
`attack data, but would rather have taken precautionary measures to avoid doing
`
`so.”) The Board already rejected this argument when it denied Patent Owner’s
`
`proposed construction of claim 29. Institution Decision at 7.
`
`F. Khazan discloses a “model of function calls”
`Khazan repeatedly and consistently discloses that its system creates and uses
`
`a model of function calls. See, e.g., Ex. 1010 at ¶¶ 12, 15, 65, 114, and 116.
`
`Patent Owner’s arguments against this disclosure are based on a proposed narrower
`
`claim construction that was previously rejected by the Board and disavowed by
`
`Patent Owner’s own expert. Response at 23-30.
`
`Specifically, Patent Owner asserts that the claimed “model of function calls”
`
`“requires the claimed model to be created using a learning algorithm.” Response at
`
`23-24. Patent Owner then argues that “Khazan does not disclose [the claimed
`
`model] under Patent Owner’s proposed construction because its static analysis lists
`
`were not created using a learning algorithm.” Response at 27. However, the
`
`12
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`Board already rejected Patent Owner’s earlier attempt to narrow this limitation and
`
`found “that the claim language does not expressly require a model created via
`
`executing function calls.” Institution Decision at 6-7. Patent Owner pays lip
`
`service to the Board’s finding, but then proposes a new construction that seeks to
`
`achieve the same end through different wording. Response at 27. Moreover, even
`
`Dr. Cybenko thinks that a learning algorithm is not required to meet the claim. Ex.
`
`1014 at 132:1-5 (“Q: So it’s your opinion that using a machine learning algorithm
`
`in the creation of the model is part of the requirement for the limitation model of
`
`function calls, correct? A: No, I’m not saying that.”). The Board should again
`
`reject Patent Owner’s proposed construction.
`
`Patent Owner also argues that Khazan’s “model” is not a “model.”
`
`Response at 27-30. Patent Owner refers to Khazan’s model instead as a “list.”
`
`See, e.g., Response at 27-28. Despite Patent Owner’s attempts to limit Khazan’s
`
`disclosure to a “list,” the fact remains that Khazan repeatedly discloses a “model.”
`
`See, e.g., Ex. 1010 at ¶¶ 12, 15, 65, 114, and 116.
`
`IV. The Combination of Khazan and Arnold Render Obvious Claims 1, 4-8, 11,
`14-18, 21, and 26
`A. The combination of Khazan and Arnold teaches the claimed
`“application community”
`
`The parties agree that “application community” means “members of a
`
`community running the same program or a selected portion of the program.”
`
`13
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`Petition at 8; Response at 30. The “notifying an application community” claim
`
`limitation is met by the combination of Khazan with Arnold. See, e.g., Ex. 1003 at
`
`p. 46-49. Patent Owner argues that the combination of Khazan and Arnold does
`
`not disclose this limitation because 1) “the same program” should be construed as
`
`the same “application,” which Arnold allegedly does not disclose; and 2) Arnold
`
`does not disclose multiple computers running the same program. Response at 30-
`
`32. However, Patent Owner is incorrect.
`
`Patent Owner again narrows its construction beyond what the claim
`
`language expressly requires, this time arguing that “program” really means
`
`“application.” Response at 32. This new definition enables Patent Owner to argue
`
`that a worm such as that disclosed in Arnold is not an application. However,
`
`Patent Owner never provides a rationale for this construction. See id. (failing to
`
`explain why a worm is not an application). Moreover, Dr. Cybenko admitted that a
`
`worm is a “program.” Ex. 2030 at ¶ 169 (“a worm is a malicious program”).
`
`Thus, Arnold’s disclosure of a worm satisfies the “program” element of the claims.
`
`Patent Owner’s other argument is also flawed. Patent Owner relies on Dr.
`
`Cybenko to argue that “Arnold does not teach that any of the neighboring
`
`computers are actually running or are even infected with the same worm or virus.”
`
`Response at 32 (citing Ex. 2030 at ¶ 171). Dr. Cybenko states that Arnold “is
`
`silent as to whether any of the notified computers might be running, or even
`
`14
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`infected with the same worm with which a notifying computer is infected.” Ex.
`
`2030 at ¶ 171 (citing Ex. 1007 at 21:50:59). But Dr. Cybenko ignores the context
`
`underlying Arnold’s statement that “the use of an automatic kill signal that is
`
`transmitted between machines is important to stop a rapidly-spreading worm.” Ex.
`
`1007 at 21:50-59. Namely, “[o]ne of ordinary skill would recognize that a reason
`
`the kill signal is valuable when combatting worms is because it will cause other
`
`computers running the same worm to terminate the worm.” Ex. 1003 at p. 48.
`
`B. The combination of Khazan and Arnold teaches “upon identifying
`the anomalous function call, notifying an application community that
`includes a plurality of computers of the anomalous function call”
`
`Patent Owner’s argument that the combination of Khazan and Arnold does
`
`not disclose this claim element fails for at least two reasons: 1) Patent Owner
`
`improperly construes “notifying … of the anomalous function call” to require
`
`providing additional information about the function call, and 2) it only considers
`
`Arnold, not Arnold in combination with Khazan.
`
`The claim limitation does not expressly require the notifying step to provide
`
`any additional information beyond the notification of the anomalous function call.
`
`Nor does the specification of the ’115 patent describe including any additional
`
`information with the notifying step. See Ex. 1001 at FIG. 6 (“Notifying the other
`
`devices (e.g., workstations, servers, etc.) of the fault)”; id. at 18:57-62 (“At 650,
`
`the application community member that detects or predicts the fault may notify the
`
`15
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`other application community members.”). Nevertheless, Patent Owner now argues
`
`that the notifying step must not only notify the application community of the
`
`anomalous function call, but must also provide additional information describing
`
`the intrusion. See, e.g., Response at 33 (arguing that Arnold’s kill signal does not
`
`meet the notifying step because “no information about the intrusion is provided”);
`
`Ex. 2030 at ¶ 173 (“This single bit of information [the kill signal] does not provide
`
`any information about the intrusion, and thus does not constitute a notification ‘of
`
`an anomalous function call.’”). This argument again incorrectly relies on an
`
`unsupported claim construction. See Institution Decision at 6-7.
`
`Furthermore, Patent Owner’s arguments consider the references
`
`individually, rather than in combination. Arnold discloses that “[t]he first step in
`
`the process of this invention detects anomalous system behavior of a type that may
`
`indicate the presence of an undesirable informational state resulting from the
`
`presence of a virus or some other undesirable software entity.” Ex. 1007 at 4:61-
`
`65. Arnold also states that the end result of the kill signal “is that other computers
`
`on the network are alerted to the presence of an anomaly.” Ex. 1007 at 20:8-11.
`
`Khazan discloses detecting anomalies, and specifically that the anomalies are
`
`anomalous function calls. See Ex. 1010 at ¶¶ 64-67. The combination of Khazan
`
`and Arnold, therefore, renders “notifying … of the anomalous function call”
`
`obvious to a POSITA. Ex. 1003 at ¶ 90.
`
`16
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`Patent Owner also makes a lengthy argument that Khazan and Arnold may
`
`not be combined to render the claims obvious. Response at 35-40. This argument
`
`relies on the assertion that neither Khazan nor Arnold discloses “notifying
`
`application community members of particular anomalous function calls.”
`
`Response at 39 (emphasis in original); see id. at 38 (“concerning a particular
`
`function call”). But Patent Owner’s argument is defective because the word
`
`“particular” does not appear in the claims. See Institution Decision at 6-7.
`
`In addition, Patent Owner alleges that Petitioner “employs conclusory,
`
`boilerplate language when addressing [the] combination” and makes other
`
`arguments, such as “Petitioner has not presented any plausible advantage to adding
`
`a modification of an anomalous function call to the combined system of Khazan
`
`and Arnold.” Response at 36, 39 (emphasis in original). Yet Patent Owner does
`
`not challenge the actual reasoning offered in support of the combination. Response
`
`at 36. Namely, that “[o]ne of ordinary skill would recognize that a reason the kill
`
`signal is valuable when combatting worms is because it will cause other computers
`
`running the same worm to terminate the worm.” Ex. 1003 at ¶ 89. The
`
`combination of Khazan and Arnold is desirable because “[i]t has been
`
`demonstrated that informing one’s neighbors if one is infected is highly effective
`
`in limiting or prevent viral spread.” Ex. 1007 at 19:46-48; Ex. 1003 at ¶ 90.
`
`V. The Combination of Khazan, Arnold, and Agrawal Render Obvious Claims
`2, 3, 9, 10, 12, 13, 19, 20, 23, 24, 30, 31, 33, 34, 40, and 41
`
`17
`
`

`
`IPR2015-00375
`Patent No. 8,074,115
`A. The combination of Khazan, Arnold, and Agraw