`571-272-7822
`
`
`
`
`
`
`
`
`
`
`
` Paper 47
`
`
` Entered: June 30, 2016
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`SYMANTEC CORPORATION,
`Petitioner,
`
`v.
`
`THE TRUSTEES OF COLUMBIA UNIVERSITY
`IN THE CITY OF NEW YORK,
`Patent Owner.
`____________
`
`Case IPR2015-00375
`Patent 8,074,115 B2
`____________
`
`Before HOWARD B. BLANKENSHIP, BRYAN F. MOORE, and
`ROBERT J. WEINSCHENK, Administrative Patent Judges.
`
`MOORE, Administrative Patent Judge.
`
`
`
`FINAL WRITTEN DECISION
`Inter Partes Review
`35 U.S.C. § 318(a) and 37 C.F.R. § 42.73
`
`
`I.
`
`INTRODUCTION
`
`We have jurisdiction to hear this inter partes review under 35 U.S.C.
`
`§ 6(c). This Final Written Decision is issued pursuant to 35 U.S.C. § 318(a)
`
`and 37 C.F.R. § 42.73. For the reasons discussed herein, Petitioner has
`
`shown by a preponderance of the evidence that claims 1, 3–8, 11, 13–18, 21,
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`22, 24–29, 32, 34–39, and 42 of U.S. Patent No. 8,074,115 B2 are
`
`unpatentable.
`
`A. Procedural History
`
`Symantec Corporation filed a Petition requesting an inter partes
`
`review of claims 1–42 of U.S. Patent No. 8,074,115 B2 (Ex. 1001, “the ’115
`
`Patent”). Paper 2 (“Pet.”). In response, Patent Owner, The Trustees of
`
`Columbia University in The City of New York, filed a Preliminary
`
`Response. Paper 10 (“Prelim. Resp.”). Upon consideration of the Petition
`
`and Preliminary Response, we instituted an inter partes review of claims 1‒
`
`42, pursuant to 35 U.S.C. § 314. Paper 13 (“Dec.”).
`
`Subsequent to institution, Patent Owner filed a Corrected Patent
`
`Owner Response (Paper 44 (“PO Resp.”)) and Petitioner filed a Reply
`
`(Paper 34 (“Pet. Reply”)).
`
`An oral hearing was held on March 16, 2016, and a transcript of the
`
`hearing is included in the record (Paper 46 (“Tr.”)).
`
`B. Related Proceeding
`
`The ’115 Patent is involved in the following lawsuit: Trustees of
`
`Columbia University of New York v. Symantec Corp., No. 3:13-cv-808 (E.D.
`
`Va.). Pet. 1.
`
`
`
`C. The ’115 Patent
`
`The ’115 Patent describes a way to detect “anomalous program
`
`executions that may be indicative of a malicious attack or program fault.”
`
`Ex. 1001, 3:13–15. As disclosed in the ’115 Patent, an anomaly detector
`
`2
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`trains a model of normal program behavior and applies the model to detect
`
`deviations from normal program behavior during subsequent operation. Id.
`
`at 3:50–56. The anomaly detector of the ’115 Patent specifically focuses on
`
`detecting deviations in function calls made by the program in order to detect
`
`anomalous behavior. Id. at 3:46–56. The anomaly detector first “models
`
`normal program execution stack behavior.” Id. at 3:50–52. This behavior
`
`may include function names, function call arguments, stack frames, and the
`
`like. Id. at 3:38–40. The anomaly detector then observes subsequent
`
`function calls made by the program and uses the trained model to detect
`
`deviations from normal behavior. Id. at 3:52–56. In some embodiments,
`
`upon identifying a function call as anomalous, the anomaly detector notifies
`
`an application community running the same program or same portion of the
`
`program that an anomalous function call has been identified. Id. at 18:57–
`
`59.
`
`The anomaly detector detects a function call being made by a
`
`program. The anomaly detector then compares the detected function call to
`
`a model of normal function calls computed based on training data. To train
`
`a model of normal function calls, the anomaly detector monitors normal
`
`execution of the program. Once the model is trained, it is applied against
`
`further executions of the program to identify anomalous function calls
`
`associated with the program. Thereafter, detected function calls can be
`
`compared to the model at step 804 to identify whether the function call is
`
`anomalous at step 806. Id. at 3:46–56.
`
`3
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`D. Illustrative Claim
`
`Of the challenged claims, claims 1, 11, 21, 22, 32, and 42 are the
`
`independent claims.
`
`Claim 22, reproduced below, is illustrative.
`
`22. A method for detecting anomalous program executions,
`comprising:
`
`modifying a program to include indicators of program-
`level function calls being made during execution of the program;
`
`comparing at least one of the indicators of program-level
`function calls made in an emulator to a model of function calls
`for at least a part of the program; and
`
`identifying a function call corresponding to the at least one
`of the indicators as anomalous based on the comparison.
`
`Ex. 1001, 21:50–59.
`
`
`
`
`
`E. Prior Art Relied Upon
`
`Petitioner relies upon the following prior art references:
`
`Aug. 8, 1995
` US 5,440,723
`Arnold et al.
`Jan. 31, 2012
` US 8,108,929 B2
`Agrawal et al.
`Khazan et al. US 2005/0108562 A1 May 19, 2005
`
`(Ex. 1007)
`(Ex. 1008)
`(Ex. 1010)
`
`4
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`F. Grounds of Unpatentability
`
`We instituted an inter partes review of claims 1–42 on the following
`
`grounds:
`
`Challenged Claims
`
`Basis
`
`References
`
`22, 25–29,1 32, 35– 39,
`and 42
`
`1, 4–8, 11, 14–18, and
`212
`2, 3, 9, 10, 12, 13, 19,
`20, 23, 24, 30, 31, 33,
`34, 40, and 41
`
`
`
`§ 102(e) Khazan
`
`§ 103(a) Khazan and Arnold
`
`§ 103(a) Khazan, Arnold, and Agrawal
`
`I. ANALYSIS
`
`A. Claim Construction
`
`In an inter partes review, claim terms in an unexpired
`
`patent are given their broadest reasonable construction in light of the
`
`specification of the patent in which they appear. 37 C.F.R. § 42.100(b); see
`
`also In re Cuozzo Speed Techs., LLC, 793 F.3d 1268, 1278 (Fed. Cir. 2015)
`
`
`
`1 Claim 26 was not included as part of this ground but this appears to be a
`typographical error because claim 26 depends from claim 22 and contains a
`limitation essentially the same as claim 36 included in this ground.
`Therefore, we include claim 26 in this ground. We also apply Petitioner’s
`explanations on pages 27 and 28 of the Petition to claim 26 as well as claim
`36.
`
` 2
`
` Claim 26 is listed by Petitioner as included in this challenge but it depends
`from claim 22 not claim 21 so it is more properly analyzed in the ground
`including claim 22 based on Khazan.
`
`5
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`(“We conclude that Congress implicitly approved the broadest reasonable
`
`interpretation standard in enacting the AIA”), aff’d sub nom. Cuozzo Speed
`
`Techs., LLC v. Lee, 579 U.S. ___ (2016). Under the broadest reasonable
`
`interpretation standard, claim terms are given their ordinary and customary
`
`meaning as would be understood by one of ordinary skill in the art in the
`
`context of the entire disclosure. In re Translogic Tech., Inc., 504 F.3d 1249,
`
`1257 (Fed. Cir. 2007).
`
`anomalous
`
`Petitioner proposes a construction for the claim term “anomalous” (all
`
`claims). Pet. 8. In our Decision to Institute, we determined the broadest
`
`reasonable construction of anomalous is: “deviation/deviating from a model
`
`of typical computer system usage.” Dec. 6. We specifically recognized that
`
`the Specification contemplates that “attack data” may be used to build the
`
`model used as a baseline for comparison to identify anomalous behavior. Id.
`
`Neither party has indicated that our determination in regard to that claim
`
`construction was improper, and we do not perceive any reason or evidence
`
`that now compels any deviation from our initial determination.
`
`Patent Owner also suggests the construction “deviation/deviating from
`
`a model of typical computer system usage” requires “identifying statistical
`
`deviations from normal.” PO Resp. 23. The claim language does not
`
`require a statistical analysis, and Patent Owner does not present sufficient
`
`evidence of any language in the Specification that suggests that such a
`
`limitation was intended to be imported into the claims. Thus, we do not
`
`adopt this limit on our construction.
`
`6
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`model of function calls
`
`Claims 22, 32, and 42 recite a “model of function calls.” In its
`
`Preliminary Response, Patent Owner proposes that “model of function calls”
`
`means “model generated in whole or in part from executing function calls.”
`
`Prelim. Resp. 11. In our Decision to Institute, we determined the broadest
`
`reasonable construction of “model of function calls” does not expressly
`
`require a model created via executing function calls. Dec. 6. Thus, we
`
`determined that it was not necessary to construe “model of function calls.”
`
`Patent Owner now asserts that “[t]he construction presented in this
`
`Response does not seek to re-argue the issue that was raised by the previous
`
`proposed construction.” PO Resp. 24. Nevertheless, Patent Owner argues
`
`that “[t]he BRI of ‘model of function calls,’ present in all claims of the ’115
`
`Patent, requires the claimed model to be created using a learning algorithm.”
`
`Id. at 23–24. Patent Owner points out that “[e]very embodiment disclosed in
`
`the specification employs a learning algorithm.” Id. at 24.
`
`The Federal Circuit states that
`
`[we] must interpret the claims in light of the specification,
`Markman v. Westview Instruments, Inc., 52 F.3d 967, 979
`(Fed. Cir. 1995) (en banc), aff'd 517 U.S. 370, 116 S. Ct. 1384,
`134 L.Ed.2d 577 (1996), yet avoid impermissibly importing
`limitations from the specification. Comark Communications v.
`Harris Corp., 156 F.3d 1182, 1186 (Fed. Cir. 1998). That
`balance turns on how the specification characterizes the claimed
`invention. Sunrace Roots Enter. Co. v. SRAM Corp., 336 F.3d
`1298, 1305 (Fed. Cir. 2003). In this respect, this court looks to
`whether the specification refers to a limitation only as a part of
`less than all possible embodiments or whether the specification
`read as a whole suggests that the very character of the invention
`
`7
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`requires the limitation be a part of every embodiment. For
`example, it is impermissible to read the one and only disclosed
`embodiment into a claim without other indicia that the patentee
`so intended to limit the invention. Teleflex, Inc. v. Ficosa N. Am.
`Corp., 299 F.3d 1313, 1327 (Fed. Cir. 2002). On the other hand,
`where the specification makes clear at various points that the
`claimed invention is narrower than the claim language might
`imply, it is entirely permissible and proper to limit the claims.
`SciMed Life Sys., Inc. v. Advanced Cardiovascular Sys., Inc., 242
`F.3d 1337, 1345 (Fed. Cir. 2001).
`
`
`
`Alloc, Inc. v. Int'l Trade Comm’n, 342 F.3d 1361, 1370 (Fed. Cir. 2003).
`
`Additionally, Patent Owner cites Microsoft Corp. v. Proxyconn, Inc., 789
`
`F.3d 1292, 1300 (Fed. Cir. 2015). In Proxyconn, the words of the claims
`
`themselves suggested the claims should be limited. See id. at 1299 (“[T]he
`
`word ‘other’ [in the claim] denotes a further level of distinction between
`
`those two computers and the specific gateway and caching computers recited
`
`separately in the claim.”). Here, there is no such contradictory language in
`
`the claim. Patent Owner also cites In re Suitco Surface, Inc., 603 F.3d 1255,
`
`1260 (Fed. Cir. 2010). In Suitco, the specification specifically stated the
`
`“[t]he present invention” was directed to a finish on the top surface of the
`
`floor and the explicit language of the claim recited “finishing,” and thus the
`
`Federal Circuit found that claim was so limited. Id. at 1260. Here, the
`
`Specification does not make it clear that the claimed invention is narrower
`
`than the claim language. Patent Owner does not point to contrary language
`
`in the claims, as found in Proxyconn, or a statement of the “present
`
`invention” in the specification, as found in Suitco. Rather, Patent Owner
`
`relies on the consistent description of the use of a learning algorithm in the
`
`8
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`embodiments of the Specification and the Provisional Patent Application
`
`that led to the ’115 Patent. PO Resp. 24–26.
`
`It must be clear that the limitation represents more than simply the
`
`consistent description of one possible embodiment [but] a description of the
`
`invention itself.” Seachange Int’l, Inc. v. C-COR Inc., 413 F.3d 1361, 1370
`
`(Fed. Cir. 2005). Additionally, the Federal Circuit has “expressly rejected
`
`the contention that if a patent describes only a single embodiment, the claims
`
`of the patent must be construed as being limited to that embodiment.”
`
`Liebel-Flarsheim Co. v. Medrad, Inc., 358 F.3d 898, 906 (Fed. Cir. 2004);
`
`see also In re Trans Texas Holdings Corp., 498 F.3d 1290, 1298‒99 (Fed.
`
`Cir. 2007) (refusing to limit the meaning of a claim term, under a broadest
`
`reasonable construction rubric, despite the fact that every embodiment in the
`
`specification was so limited). Here, Patent Owner has not presented
`
`sufficient evidence in the Specification or prosecution history that the
`
`inventors intended to limit the invention, and thus all the claims, to a model
`
`built using a learning algorithm.
`
`In its Preliminary Response, Patent Owner proposes that “the model
`
`reflects attacks against the at least a part of the program” means “the model
`
`incorporates information about known or suspected attacks against the at
`
`least a part of the program.” Prelim. Resp. 14. In our Decision to Institute,
`
`we determined the broadest reasonable construction of “the model reflects
`
`attacks against the at least a part of the program” does not expressly require
`
`known or suspected attacks. Dec. 7. Thus, we determined that it was not
`
`necessary to construe “the model reflects attacks against the at least a
`
`9
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`portion of the program.” Neither party has indicated that our determination
`
`in regard to that claim construction was improper, and we do not perceive
`
`any reason or evidence that now compels any deviation from our initial
`
`determination.
`
`emulator
`
`Patent Owner also argues that Khazan does not disclose an emulator
`
`as required by the claims. Both Petitioner and Patent Owner agree that the
`
`broadest reasonable interpretation of “emulator” is “software, alone or in
`
`combination with hardware, that permits the monitoring and selective
`
`execution of certain parts, or all, of a program.” Pet. 8; PO Resp. 18. This
`
`construction is consistent with the Specification of the ’115 Patent. Ex.
`
`1001, 3:28–37. We did not construe this term in the Decision to Institute;
`
`nevertheless, we adopt this construction.
`
`application community
`
`Both parties agree that an “application community” means members
`
`of a community running the same program or a selected portion of the
`
`program. Pet. 5, 8; PO Resp. 30. This construction is consistent with the
`
`Specification of the ‘115 Patent. Ex. 1001, 6:31–33. We did not construe
`
`this term in the Decision to Institute; nevertheless, we adopt this
`
`construction.
`
`10
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`Accordingly, the following constructions apply to this Decision:
`
`Claim Term
`
`anomalous
`
`emulator
`
`application community
`
`Construction
`
`deviation/deviating from a model of
`typical computer system usage
`software, alone or in combination
`with hardware, that permits the
`monitoring and selective execution
`of certain parts, or all, of a program
`members of a community running
`the same program or a selected
`portion of the program
`
`
`
`
`
`B. Principles of Law
`
`Anticipation requires the disclosure in a single prior art reference of
`
`each and every element of the claimed invention, arranged as in the claim.
`
`Lindemann Maschinenfabrik GmbH v. American Hoist & Derrick Co.,
`
`730 F.2d 1452, 1458 (Fed. Cir. 1984). A patent claim is unpatentable under
`
`35 U.S.C. § 103(a) if the differences between the claimed subject matter and
`
`the prior art are such that the subject matter, as a whole, would have been
`
`obvious at the time the invention was made to a person having ordinary skill
`
`in the art to which said subject matter pertains. KSR Int’l Co. v. Teleflex
`
`Inc., 550 U.S. 398, 406 (2007). The question of obviousness is resolved on
`
`the basis of underlying factual determinations including: (1) the scope and
`
`content of the prior art; (2) any differences between the claimed subject
`
`matter and the prior art; (3) the level of ordinary skill in the art; and (4)
`
`objective evidence of nonobviousness. Graham v. John Deere Co., 383 U.S.
`
`1, 17–18 (1966).
`
`11
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`In that regard, an obviousness analysis “need not seek out precise
`
`teachings directed to the specific subject matter of the challenged claim, for
`
`a court can take account of the inferences and creative steps that a person of
`
`ordinary skill in the art would employ.” KSR, 550 U.S. at 418; see also
`
`Translogic, 504 F.3d at 1259. A prima facie case of obviousness is
`
`established when the prior art itself would appear to have suggested the
`
`claimed subject matter to a person of ordinary skill in the art. In re Rinehart,
`
`531 F.2d 1048, 1051 (CCPA 1976).
`
`The level of ordinary skill in the art is reflected by the prior art of
`
`record. See Okajima v. Bourdeau, 261 F.3d 1350, 1355 (Fed. Cir. 2001);
`
`In re GPAC Inc., 57 F.3d 1573, 1579 (Fed. Cir. 1995).
`
`C. Anticipation by Khazan
`
`Petitioner asserts that claims 22, 25–29,3 32, 35–39, and 42 are
`
`unpatentable under 35 U.S.C. § 102(a) as anticipated by Khazan. Pet. 17.
`
`To support its contentions, Petitioner provides detailed explanations as to
`
`how the prior art meets each claim limitation. Id. at 17–28. Petitioner also
`
`relies upon a Declaration of Dr. Michael T. Goodrich, who has been retained
`
`by Petitioner for the instant proceeding. Ex. 1003.
`
`
`
`3 Claim 26 was not included as part of this ground but this appears to be a
`typographical error because claim 26 depends from claim 22 and contains a
`limitation essentially the same as claim 36 included in this ground. Thus, we
`apply Petitioner’s explanations on pages 27 and 28 of the Petition to claim
`26 as well as claim 36.
`
`12
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`Khazan describes a malicious code “detection system 110[that] includes a
`
`static analyzer 104 and a dynamic analyzer 108.” Ex. 1010 ¶ 40. The static
`
`analyzer acts “to examine and identify calls or invocations made from [an]
`
`application executable 102 to a predetermined set of target functions or
`
`routines.” Id. ¶ 42. The static identifier “may also identify additional
`
`information about these functions, such as, for example, particular locations
`
`within the application from which the calls to these functions are made,
`
`parameter number and type information for each call, the values that some of
`
`these parameters take at run-time, and the like.” Id. The static analyzer then
`
`“produces a list of targets and invocation locations 106, as related to the
`
`identified function calls.” Id. ¶ 60.
`
`The malicious code detection system “creates an application model
`
`using the information obtained from the static analyzer.” Id. ¶ 65. The
`
`model comprises “the identified calls, their locations within the program,
`
`and other call-related information.” Id. ¶ 114. Khazan notes that building
`
`such models was prior art to Khazan’s application, and that “[s]ome existing
`
`anomaly detection techniques create models of normal behavior of a
`
`particular application based on observing sequences of system calls executed
`
`at run time as part of a learning phase.” Id. ¶ 9.
`
`Claims 22, 32, and 42
`
`Claims 22, 32, and 42 recite modifying a program to include
`
`indicators of program-level function calls being made during execution of
`
`the program. For this limitation, Petitioner contends that Khazan’s
`
`“instrumentation technique” modifies an application (program) so that the
`
`13
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`application executes additional monitoring code which indicates which of
`
`the programs functions are being called. Pet. 20–21; Ex. 1010, ¶¶ 5, 44, 73,
`
`75, 78. Khazan states that “[w]hen the application is executed, dynamic
`
`analysis is used to intercept calls to targets and verify them against the
`
`model.” Ex. 1010, Abstract. Further, Petitioner emphasizes that Khazan
`
`explains that dynamic analysis is performed “during execution of the
`
`application.” Pet. 21; Ex. 1010 ¶ 62. We are persuaded by Petitioner’s
`
`showing, which we adopt as our own, that Khazan discloses modifying a
`
`program to include indicators of program-level function calls being made
`
`during execution of the program.
`
`Claims 22, 32, and 42 further recite comparing at least one of the
`
`indicators of program-level function calls being made in an emulator to a
`
`model of function calls for at least a part of the program. For this limitation,
`
`Petitioner contends that Khazan discloses monitoring of program level
`
`function calls made by an application in an emulator. Pet. 22; Ex. 1010
`
`¶¶ 66, 111. Petitioner asserts that Khazan discloses “[w]hen the application
`
`is executed, dynamic analysis is used to intercept calls to targets and verify
`
`them against the model” and “[t]he verifications may involve comparing the
`
`invocation and target location, as well as other call-related information . . . to
`
`the corresponding information identified by static analysis.” Pet. 22; Ex.
`
`1010, Abstract. Further, Petitioner states that Khazan explains that dynamic
`
`analysis is performed “during execution of the application.” Pet. 21; Ex.
`
`1010 ¶ 62. We are persuaded by Petitioner’s showing, which we adopt as
`
`our own, that Khazan discloses comparing at least one of the indicators of
`
`14
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`program-level function calls being made in an emulator to a model of
`
`function calls for at least a part of the program.
`
`Claims 22, 32, and 42 further recite identifying a function call
`
`corresponding to the at least one of the indicators as anomalous based on the
`
`comparison. For these limitations, Petitioner contends that Khazan discloses
`
`the verification described above involves comparing run time behavior with
`
`the application model. Pet. 23; Ex. 1010, Abstract. Petitioner contends that
`
`the run time behavior in Khazan is monitored using monitoring code added
`
`to the application using the instrumentation technique (i.e., indicators). Pet.
`
`23; Ex. 1010 ¶¶ 64, 75. Khazan further discloses “[i]f the run time behavior
`
`deviates from the application model, it is determined that the application
`
`executable has executed MC [malicious code, i.e., anomalous function
`
`call].” Pet. 23 Ex. 1010 ¶ 65. We are persuaded by Petitioner’s showing,
`
`which we adopt as our own, that Khazan discloses identifying a function call
`
`corresponding to the at least one of the indicators as anomalous based on the
`
`comparison.
`
`modifying the program itself
`
`Patent Owner argues that Petitioner has not identified a teaching in
`
`Khazan that the instrumentation technique modifies the program itself.
`
`According to Patent Owner, Khazan discloses that other software
`
`components—not the program—are modified to intercept function calls.
`
`PO Resp. 10–11 (citing Ex. 1010 ¶ 73 (“At step 126, the associated libraries,
`
`such as all operating system DLLs, are instrumented to intercept calls to a
`
`predetermined set of target functions at run time.”)). Nevertheless,
`
`15
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`Petitioner points to the following statement from Khazan: “the
`
`instrumentation technique described in one embodiment herein modifies the
`
`memory loaded copy of the application and associated libraries to execute
`
`additional monitoring code.” Ex. 1010 at ¶ 75 (emphasis added) cited in Pet.
`
`20. Patent Owner does not explain sufficiently in its papers why this
`
`statement is incorrect.4 Specifically, Patent Owner assumes that the
`
`statement is referring to modifying the libraries only. PO Resp. 10
`
`(“Petitioner has not identified a teaching in Khazan that the instrumentation
`
`technique modifies the program itself.”) Therefore, we are not persuaded by
`
`Patent Owner’s argument.5
`
`
`
`4 In the hearing, Patent Owner asserted that this sentence refers only to
`modifying the libraries, but this argument is not made in the Patent Owner
`Response. Tr. 43–46. We decline to rely on argument made solely in the
`oral hearing. Nevertheless, while it may be true that the libraries are the
`only thing modified in the embodiment of Khazan, the cited language clearly
`states that the application and libraries are modified. Patent Owner further
`argues “Petitioner has not explained how functions that are internal to the
`program (not in libraries) would be tracked or how a program would be
`modified to add indicators for them.” PO Resp. 12. Prior art patents,
`however, are presumed to be enabled. In re Antor Media Corp., 689 F.3d
`1282, 1287 (Fed. Cir. 2012) (“[B]oth claimed and unclaimed materials
`disclosed in a patent are presumptively enabling . . . .”). The burden is on
`the party challenging the enablement of the prior art patent to show that the
`patent is not enabled. Id. at 1288. Patent Owner has not made a sufficient
`presentation of evidence for such a showing.
`
` 5
`
` Patent Owner also argues that the libraries are external to the program and
`the claims require modification that is internal to the program. PO Resp.
`16
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`typical computer usage
`
`Claims 22, 32, and 42 further recite identifying/identifies a function
`
`call corresponding to the at least one of the indicators as anomalous based on
`
`the comparison. We construed “anomalous” to mean “deviation from a
`
`model of typical computer system usage.” Patent Owner argues that
`
`Khazan’s system which models using a static examination without execution
`
`of the program cannot model “typical computer usage.” PO Resp. 14. The
`
`issue of the static nature of Khazan was argued at the preliminary stage, and
`
`we were not persuaded at that time. In the Institution Decision, we stated
`
`“we find that the claim language does not expressly require a model created
`
`via executing function calls.” Dec. 7. In other words, we the claims do not
`
`require execution of the program to create the model. Patent Owner has not
`
`persuaded us to change that construction, therefore we maintain that
`
`construction here. The construction of “anomalous” was not intended to
`
`imply by use of the term “usage” that actual execution of the program is
`
`necessary to create a model that reflects typical usage of the program. Thus,
`
`Patent Owner’s argument is not commensurate with the limitations of the
`
`claims.
`
`statistical deviations
`
`Patent Owner also suggests that “identifying statistical deviations
`
`from normal” is required by the claims, and Khazan does not disclose such
`
`
`
`12–13. Because we find that Khazan modifies the application (program) the
`debate regarding whether the libraries are internal is moot. Tr. 47:4–13.
`17
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`statistical analysis. PO Resp. 17. We did not adopt this construction. Thus,
`
`Patent Owner’s argument is not commensurate with the limitations of the
`
`claims. We therefore are not persuaded by this argument.
`
`emulator
`
`Patent Owner also argues that Khazan does not disclose an emulator
`
`as required by the claims. As noted above, both Petitioner and Patent Owner
`
`agree that the broadest reasonable interpretation of “emulator” is “software,
`
`alone or in combination with hardware, that permits the monitoring and
`
`selective execution of certain parts, or all, of a program.” Pet. 8; PO Resp.
`
`18. We have adopted this construction.
`
`Patent Owner argues that “Petitioner has pointed to a component that,
`
`while referred to as an ‘emulator’ in Khazan, does not possess the
`
`capabilities required by the agreed-upon claim construction. Ex. 2030
`
`¶¶ 151–53.” PO Resp. 20. Patent Owner argues that Petitioner relies on a
`
`separate component called VM Ware to provide the selective execution. PO
`
`Resp. 19–20. Specifically, Patent Owner argues that the detection tool of
`
`Khazan that performs monitoring is not an emulator and that VM Ware does
`
`not “provide off the shelf” selective execution. PO Resp. 19 (citing Ex.
`
`2030 ¶¶ 147–151; Ex. 2031 ¶ 186).
`
`The Khazan Specification states
`
`
`
`6 A co-inventor of Khazan testifies that “neither I nor my colleagues ever ran
`the system described in Khazan in an emulator, nor did we test it in one.”
`Ex. 2031 ¶ 18. This statement cannot negate the express reference to the use
`of an emulator in the Khazan patent. Ex. 1010 ¶¶ 111, 112.
`18
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`The detection tool may execute, for example, as a background
`task, use the foregoing techniques and invoke and execute one or
`more of the executables in order to possibly detect MC contained
`in these executables. This may also be done as an emulation or
`simulation of the execution, or in what is known to those skilled
`in the art as a virtual environment, such as VMWare.
`
`
`
`An application may be executed using the techniques
`described herein at a variety of different times. The application
`may be executed during normal usage, when purposefully testing
`it for the presence of MC, or when analyzing the MC embedded
`within the application. An execution of the application may also
`be emulated or simulated.
`
`
`
`Ex. 1010 ¶¶ 111–112. Patent Owner, through its Declarant, argues that this
`
`quoted text refers to emulating or simulating the detection tool rather than
`
`the program that is being analyzed. See generally Ex. 1014, 143–73. In the
`
`hearing, Patent Owner clarified that
`
`The broadest definition of emulator means to imitate the
`functions of another computer by means of software. And so to
`simply say you are emulating a program generically could mean
`that you are just running that program, another piece of software.
`It doesn’t mean that you are selecting that program for
`emulation. It doesn’t mean that you are selecting that program
`for monitoring and the ability to selectively execute all or a
`portion of the program. That would be the distinction we're
`talking about.
`
`Tr. 51:7–16. We are not persuaded by this argument. Patent Owner parses
`
`the construction and requirements of the prior art too finely. There is no
`
`explicit requirement in the claims or the agreed-upon construction that the
`
`emulation occur in a single “off the shelf” emulator. Petitioner relies on the
`
`19
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`detection tool running the application in the virtual environment to meet the
`
`claim; there is no reason that Petitioner cannot do so. Pet. 12–13.
`
`Patent Owner cites to Net MoneyIN, Inc. v. VeriSign, Inc., 545 F.3d
`
`1359, 1371 (Fed. Cir. 2008) for the proposition that a reference cannot be
`
`anticipatory if it requires combining separate parts of the reference to
`
`produce a single entity recited in the claims. Net MoneyIN does not go that
`
`far. In Net MoneyIN the Federal Circuit states “differences between the
`
`prior art reference and a claimed invention, however slight, invoke the
`
`question of obviousness, not anticipation . . . . [To anticipate], it is not
`
`enough that the prior art reference discloses . . . multiple, distinct teachings
`
`that the artisan might somehow combine to achieve the claimed invention.”
`
`Net MoneyIN, 545 F.3d at 1371 (citations omitted). Here, the detection tool
`
`and VM Ware are not distinct teachings, rather they work in concert as
`
`described by Khazan. See Pet. 22 (citing Ex. 1010 ¶¶ 111, 112, Ex. 1003, ¶
`
`66); see Wm