Trials@uspto.gov
`571-272-7822
`
`
`
`
`
`
`
`
`
`
`
` Paper 47
`
`
` Entered: June 30, 2016
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`SYMANTEC CORPORATION,
`Petitioner,
`
`v.
`
`THE TRUSTEES OF COLUMBIA UNIVERSITY
`IN THE CITY OF NEW YORK,
`Patent Owner.
`____________
`
`Case IPR2015-00375
`Patent 8,074,115 B2
`____________
`
`Before HOWARD B. BLANKENSHIP, BRYAN F. MOORE, and
`ROBERT J. WEINSCHENK, Administrative Patent Judges.
`
`MOORE, Administrative Patent Judge.
`
`
`
`FINAL WRITTEN DECISION
`Inter Partes Review
`35 U.S.C. § 318(a) and 37 C.F.R. § 42.73
`
`
`I.
`
`INTRODUCTION
`
`We have jurisdiction to hear this inter partes review under 35 U.S.C.
`
`§ 6(c). This Final Written Decision is issued pursuant to 35 U.S.C. § 318(a)
`
`and 37 C.F.R. § 42.73. For the reasons discussed herein, Petitioner has
`
`shown by a preponderance of the evidence that claims 1, 3–8, 11, 13–18, 21,
`
`
`571-272-7822
`
`
`
`
`
`
`
`
`
`
`
` Paper 47
`
`
` Entered: June 30, 2016
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`____________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`____________
`
`SYMANTEC CORPORATION,
`Petitioner,
`
`v.
`
`THE TRUSTEES OF COLUMBIA UNIVERSITY
`IN THE CITY OF NEW YORK,
`Patent Owner.
`____________
`
`Case IPR2015-00375
`Patent 8,074,115 B2
`____________
`
`Before HOWARD B. BLANKENSHIP, BRYAN F. MOORE, and
`ROBERT J. WEINSCHENK, Administrative Patent Judges.
`
`MOORE, Administrative Patent Judge.
`
`
`
`FINAL WRITTEN DECISION
`Inter Partes Review
`35 U.S.C. § 318(a) and 37 C.F.R. § 42.73
`
`
`I.
`
`INTRODUCTION
`
`We have jurisdiction to hear this inter partes review under 35 U.S.C.
`
`§ 6(c). This Final Written Decision is issued pursuant to 35 U.S.C. § 318(a)
`
`and 37 C.F.R. § 42.73. For the reasons discussed herein, Petitioner has
`
`shown by a preponderance of the evidence that claims 1, 3–8, 11, 13–18, 21,
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`22, 24–29, 32, 34–39, and 42 of U.S. Patent No. 8,074,115 B2 are
`
`unpatentable.
`
`A. Procedural History
`
`Symantec Corporation filed a Petition requesting an inter partes
`
`review of claims 1–42 of U.S. Patent No. 8,074,115 B2 (Ex. 1001, “the ’115
`
`Patent”). Paper 2 (“Pet.”). In response, Patent Owner, The Trustees of
`
`Columbia University in The City of New York, filed a Preliminary
`
`Response. Paper 10 (“Prelim. Resp.”). Upon consideration of the Petition
`
`and Preliminary Response, we instituted an inter partes review of claims 1‒
`
`42, pursuant to 35 U.S.C. § 314. Paper 13 (“Dec.”).
`
`Subsequent to institution, Patent Owner filed a Corrected Patent
`
`Owner Response (Paper 44 (“PO Resp.”)) and Petitioner filed a Reply
`
`(Paper 34 (“Pet. Reply”)).
`
`An oral hearing was held on March 16, 2016, and a transcript of the
`
`hearing is included in the record (Paper 46 (“Tr.”)).
`
`B. Related Proceeding
`
`The ’115 Patent is involved in the following lawsuit: Trustees of
`
`Columbia University of New York v. Symantec Corp., No. 3:13-cv-808 (E.D.
`
`Va.). Pet. 1.
`
`
`
`C. The ’115 Patent
`
`The ’115 Patent describes a way to detect “anomalous program
`
`executions that may be indicative of a malicious attack or program fault.”
`
`Ex. 1001, 3:13–15. As disclosed in the ’115 Patent, an anomaly detector
`
`2
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`trains a model of normal program behavior and applies the model to detect
`
`deviations from normal program behavior during subsequent operation. Id.
`
`at 3:50–56. The anomaly detector of the ’115 Patent specifically focuses on
`
`detecting deviations in function calls made by the program in order to detect
`
`anomalous behavior. Id. at 3:46–56. The anomaly detector first “models
`
`normal program execution stack behavior.” Id. at 3:50–52. This behavior
`
`may include function names, function call arguments, stack frames, and the
`
`like. Id. at 3:38–40. The anomaly detector then observes subsequent
`
`function calls made by the program and uses the trained model to detect
`
`deviations from normal behavior. Id. at 3:52–56. In some embodiments,
`
`upon identifying a function call as anomalous, the anomaly detector notifies
`
`an application community running the same program or same portion of the
`
`program that an anomalous function call has been identified. Id. at 18:57–
`
`59.
`
`The anomaly detector detects a function call being made by a
`
`program. The anomaly detector then compares the detected function call to
`
`a model of normal function calls computed based on training data. To train
`
`a model of normal function calls, the anomaly detector monitors normal
`
`execution of the program. Once the model is trained, it is applied against
`
`further executions of the program to identify anomalous function calls
`
`associated with the program. Thereafter, detected function calls can be
`
`compared to the model at step 804 to identify whether the function call is
`
`anomalous at step 806. Id. at 3:46–56.
`
`3
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`D. Illustrative Claim
`
`Of the challenged claims, claims 1, 11, 21, 22, 32, and 42 are the
`
`independent claims.
`
`Claim 22, reproduced below, is illustrative.
`
`22. A method for detecting anomalous program executions,
`comprising:
`
`modifying a program to include indicators of program-
`level function calls being made during execution of the program;
`
`comparing at least one of the indicators of program-level
`function calls made in an emulator to a model of function calls
`for at least a part of the program; and
`
`identifying a function call corresponding to the at least one
`of the indicators as anomalous based on the comparison.
`
`Ex. 1001, 21:50–59.
`
`
`
`
`
`E. Prior Art Relied Upon
`
`Petitioner relies upon the following prior art references:
`
`Aug. 8, 1995
` US 5,440,723
`Arnold et al.
`Jan. 31, 2012
` US 8,108,929 B2
`Agrawal et al.
`Khazan et al. US 2005/0108562 A1 May 19, 2005
`
`(Ex. 1007)
`(Ex. 1008)
`(Ex. 1010)
`
`4
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`F. Grounds of Unpatentability
`
`We instituted an inter partes review of claims 1–42 on the following
`
`grounds:
`
`Challenged Claims
`
`Basis
`
`References
`
`22, 25–29,1 32, 35– 39,
`and 42
`
`1, 4–8, 11, 14–18, and
`212
`2, 3, 9, 10, 12, 13, 19,
`20, 23, 24, 30, 31, 33,
`34, 40, and 41
`
`
`
`§ 102(e) Khazan
`
`§ 103(a) Khazan and Arnold
`
`§ 103(a) Khazan, Arnold, and Agrawal
`
`I. ANALYSIS
`
`A. Claim Construction
`
`In an inter partes review, claim terms in an unexpired
`
`patent are given their broadest reasonable construction in light of the
`
`specification of the patent in which they appear. 37 C.F.R. § 42.100(b); see
`
`also In re Cuozzo Speed Techs., LLC, 793 F.3d 1268, 1278 (Fed. Cir. 2015)
`
`
`
`1 Claim 26 was not included as part of this ground but this appears to be a
`typographical error because claim 26 depends from claim 22 and contains a
`limitation essentially the same as claim 36 included in this ground.
`Therefore, we include claim 26 in this ground. We also apply Petitioner’s
`explanations on pages 27 and 28 of the Petition to claim 26 as well as claim
`36.
`
` 2
`
` Claim 26 is listed by Petitioner as included in this challenge but it depends
`from claim 22 not claim 21 so it is more properly analyzed in the ground
`including claim 22 based on Khazan.
`
`5
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`(“We conclude that Congress implicitly approved the broadest reasonable
`
`interpretation standard in enacting the AIA”), aff’d sub nom. Cuozzo Speed
`
`Techs., LLC v. Lee, 579 U.S. ___ (2016). Under the broadest reasonable
`
`interpretation standard, claim terms are given their ordinary and customary
`
`meaning as would be understood by one of ordinary skill in the art in the
`
`context of the entire disclosure. In re Translogic Tech., Inc., 504 F.3d 1249,
`
`1257 (Fed. Cir. 2007).
`
`anomalous
`
`Petitioner proposes a construction for the claim term “anomalous” (all
`
`claims). Pet. 8. In our Decision to Institute, we determined the broadest
`
`reasonable construction of anomalous is: “deviation/deviating from a model
`
`of typical computer system usage.” Dec. 6. We specifically recognized that
`
`the Specification contemplates that “attack data” may be used to build the
`
`model used as a baseline for comparison to identify anomalous behavior. Id.
`
`Neither party has indicated that our determination in regard to that claim
`
`construction was improper, and we do not perceive any reason or evidence
`
`that now compels any deviation from our initial determination.
`
`Patent Owner also suggests the construction “deviation/deviating from
`
`a model of typical computer system usage” requires “identifying statistical
`
`deviations from normal.” PO Resp. 23. The claim language does not
`
`require a statistical analysis, and Patent Owner does not present sufficient
`
`evidence of any language in the Specification that suggests that such a
`
`limitation was intended to be imported into the claims. Thus, we do not
`
`adopt this limit on our construction.
`
`6
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`model of function calls
`
`Claims 22, 32, and 42 recite a “model of function calls.” In its
`
`Preliminary Response, Patent Owner proposes that “model of function calls”
`
`means “model generated in whole or in part from executing function calls.”
`
`Prelim. Resp. 11. In our Decision to Institute, we determined the broadest
`
`reasonable construction of “model of function calls” does not expressly
`
`require a model created via executing function calls. Dec. 6. Thus, we
`
`determined that it was not necessary to construe “model of function calls.”
`
`Patent Owner now asserts that “[t]he construction presented in this
`
`Response does not seek to re-argue the issue that was raised by the previous
`
`proposed construction.” PO Resp. 24. Nevertheless, Patent Owner argues
`
`that “[t]he BRI of ‘model of function calls,’ present in all claims of the ’115
`
`Patent, requires the claimed model to be created using a learning algorithm.”
`
`Id. at 23–24. Patent Owner points out that “[e]very embodiment disclosed in
`
`the specification employs a learning algorithm.” Id. at 24.
`
`The Federal Circuit states that
`
`[we] must interpret the claims in light of the specification,
`Markman v. Westview Instruments, Inc., 52 F.3d 967, 979
`(Fed. Cir. 1995) (en banc), aff'd 517 U.S. 370, 116 S. Ct. 1384,
`134 L.Ed.2d 577 (1996), yet avoid impermissibly importing
`limitations from the specification. Comark Communications v.
`Harris Corp., 156 F.3d 1182, 1186 (Fed. Cir. 1998). That
`balance turns on how the specification characterizes the claimed
`invention. Sunrace Roots Enter. Co. v. SRAM Corp., 336 F.3d
`1298, 1305 (Fed. Cir. 2003). In this respect, this court looks to
`whether the specification refers to a limitation only as a part of
`less than all possible embodiments or whether the specification
`read as a whole suggests that the very character of the invention
`
`7
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`requires the limitation be a part of every embodiment. For
`example, it is impermissible to read the one and only disclosed
`embodiment into a claim without other indicia that the patentee
`so intended to limit the invention. Teleflex, Inc. v. Ficosa N. Am.
`Corp., 299 F.3d 1313, 1327 (Fed. Cir. 2002). On the other hand,
`where the specification makes clear at various points that the
`claimed invention is narrower than the claim language might
`imply, it is entirely permissible and proper to limit the claims.
`SciMed Life Sys., Inc. v. Advanced Cardiovascular Sys., Inc., 242
`F.3d 1337, 1345 (Fed. Cir. 2001).
`
`
`
`Alloc, Inc. v. Int'l Trade Comm’n, 342 F.3d 1361, 1370 (Fed. Cir. 2003).
`
`Additionally, Patent Owner cites Microsoft Corp. v. Proxyconn, Inc., 789
`
`F.3d 1292, 1300 (Fed. Cir. 2015). In Proxyconn, the words of the claims
`
`themselves suggested the claims should be limited. See id. at 1299 (“[T]he
`
`word ‘other’ [in the claim] denotes a further level of distinction between
`
`those two computers and the specific gateway and caching computers recited
`
`separately in the claim.”). Here, there is no such contradictory language in
`
`the claim. Patent Owner also cites In re Suitco Surface, Inc., 603 F.3d 1255,
`
`1260 (Fed. Cir. 2010). In Suitco, the specification specifically stated the
`
`“[t]he present invention” was directed to a finish on the top surface of the
`
`floor and the explicit language of the claim recited “finishing,” and thus the
`
`Federal Circuit found that claim was so limited. Id. at 1260. Here, the
`
`Specification does not make it clear that the claimed invention is narrower
`
`than the claim language. Patent Owner does not point to contrary language
`
`in the claims, as found in Proxyconn, or a statement of the “present
`
`invention” in the specification, as found in Suitco. Rather, Patent Owner
`
`relies on the consistent description of the use of a learning algorithm in the
`
`8
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`embodiments of the Specification and the Provisional Patent Application
`
`that led to the ’115 Patent. PO Resp. 24–26.
`
`It must be clear that the limitation represents more than simply the
`
`consistent description of one possible embodiment [but] a description of the
`
`invention itself.” Seachange Int’l, Inc. v. C-COR Inc., 413 F.3d 1361, 1370
`
`(Fed. Cir. 2005). Additionally, the Federal Circuit has “expressly rejected
`
`the contention that if a patent describes only a single embodiment, the claims
`
`of the patent must be construed as being limited to that embodiment.”
`
`Liebel-Flarsheim Co. v. Medrad, Inc., 358 F.3d 898, 906 (Fed. Cir. 2004);
`
`see also In re Trans Texas Holdings Corp., 498 F.3d 1290, 1298‒99 (Fed.
`
`Cir. 2007) (refusing to limit the meaning of a claim term, under a broadest
`
`reasonable construction rubric, despite the fact that every embodiment in the
`
`specification was so limited). Here, Patent Owner has not presented
`
`sufficient evidence in the Specification or prosecution history that the
`
`inventors intended to limit the invention, and thus all the claims, to a model
`
`built using a learning algorithm.
`
`In its Preliminary Response, Patent Owner proposes that “the model
`
`reflects attacks against the at least a part of the program” means “the model
`
`incorporates information about known or suspected attacks against the at
`
`least a part of the program.” Prelim. Resp. 14. In our Decision to Institute,
`
`we determined the broadest reasonable construction of “the model reflects
`
`attacks against the at least a part of the program” does not expressly require
`
`known or suspected attacks. Dec. 7. Thus, we determined that it was not
`
`necessary to construe “the model reflects attacks against the at least a
`
`9
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`portion of the program.” Neither party has indicated that our determination
`
`in regard to that claim construction was improper, and we do not perceive
`
`any reason or evidence that now compels any deviation from our initial
`
`determination.
`
`emulator
`
`Patent Owner also argues that Khazan does not disclose an emulator
`
`as required by the claims. Both Petitioner and Patent Owner agree that the
`
`broadest reasonable interpretation of “emulator” is “software, alone or in
`
`combination with hardware, that permits the monitoring and selective
`
`execution of certain parts, or all, of a program.” Pet. 8; PO Resp. 18. This
`
`construction is consistent with the Specification of the ’115 Patent. Ex.
`
`1001, 3:28–37. We did not construe this term in the Decision to Institute;
`
`nevertheless, we adopt this construction.
`
`application community
`
`Both parties agree that an “application community” means members
`
`of a community running the same program or a selected portion of the
`
`program. Pet. 5, 8; PO Resp. 30. This construction is consistent with the
`
`Specification of the ‘115 Patent. Ex. 1001, 6:31–33. We did not construe
`
`this term in the Decision to Institute; nevertheless, we adopt this
`
`construction.
`
`10
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`Accordingly, the following constructions apply to this Decision:
`
`Claim Term
`
`anomalous
`
`emulator
`
`application community
`
`Construction
`
`deviation/deviating from a model of
`typical computer system usage
`software, alone or in combination
`with hardware, that permits the
`monitoring and selective execution
`of certain parts, or all, of a program
`members of a community running
`the same program or a selected
`portion of the program
`
`
`
`
`
`B. Principles of Law
`
`Anticipation requires the disclosure in a single prior art reference of
`
`each and every element of the claimed invention, arranged as in the claim.
`
`Lindemann Maschinenfabrik GmbH v. American Hoist & Derrick Co.,
`
`730 F.2d 1452, 1458 (Fed. Cir. 1984). A patent claim is unpatentable under
`
`35 U.S.C. § 103(a) if the differences between the claimed subject matter and
`
`the prior art are such that the subject matter, as a whole, would have been
`
`obvious at the time the invention was made to a person having ordinary skill
`
`in the art to which said subject matter pertains. KSR Int’l Co. v. Teleflex
`
`Inc., 550 U.S. 398, 406 (2007). The question of obviousness is resolved on
`
`the basis of underlying factual determinations including: (1) the scope and
`
`content of the prior art; (2) any differences between the claimed subject
`
`matter and the prior art; (3) the level of ordinary skill in the art; and (4)
`
`objective evidence of nonobviousness. Graham v. John Deere Co., 383 U.S.
`
`1, 17–18 (1966).
`
`11
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`In that regard, an obviousness analysis “need not seek out precise
`
`teachings directed to the specific subject matter of the challenged claim, for
`
`a court can take account of the inferences and creative steps that a person of
`
`ordinary skill in the art would employ.” KSR, 550 U.S. at 418; see also
`
`Translogic, 504 F.3d at 1259. A prima facie case of obviousness is
`
`established when the prior art itself would appear to have suggested the
`
`claimed subject matter to a person of ordinary skill in the art. In re Rinehart,
`
`531 F.2d 1048, 1051 (CCPA 1976).
`
`The level of ordinary skill in the art is reflected by the prior art of
`
`record. See Okajima v. Bourdeau, 261 F.3d 1350, 1355 (Fed. Cir. 2001);
`
`In re GPAC Inc., 57 F.3d 1573, 1579 (Fed. Cir. 1995).
`
`C. Anticipation by Khazan
`
`Petitioner asserts that claims 22, 25–29,3 32, 35–39, and 42 are
`
`unpatentable under 35 U.S.C. § 102(a) as anticipated by Khazan. Pet. 17.
`
`To support its contentions, Petitioner provides detailed explanations as to
`
`how the prior art meets each claim limitation. Id. at 17–28. Petitioner also
`
`relies upon a Declaration of Dr. Michael T. Goodrich, who has been retained
`
`by Petitioner for the instant proceeding. Ex. 1003.
`
`
`
`3 Claim 26 was not included as part of this ground but this appears to be a
`typographical error because claim 26 depends from claim 22 and contains a
`limitation essentially the same as claim 36 included in this ground. Thus, we
`apply Petitioner’s explanations on pages 27 and 28 of the Petition to claim
`26 as well as claim 36.
`
`12
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`Khazan describes a malicious code “detection system 110[that] includes a
`
`static analyzer 104 and a dynamic analyzer 108.” Ex. 1010 ¶ 40. The static
`
`analyzer acts “to examine and identify calls or invocations made from [an]
`
`application executable 102 to a predetermined set of target functions or
`
`routines.” Id. ¶ 42. The static identifier “may also identify additional
`
`information about these functions, such as, for example, particular locations
`
`within the application from which the calls to these functions are made,
`
`parameter number and type information for each call, the values that some of
`
`these parameters take at run-time, and the like.” Id. The static analyzer then
`
`“produces a list of targets and invocation locations 106, as related to the
`
`identified function calls.” Id. ¶ 60.
`
`The malicious code detection system “creates an application model
`
`using the information obtained from the static analyzer.” Id. ¶ 65. The
`
`model comprises “the identified calls, their locations within the program,
`
`and other call-related information.” Id. ¶ 114. Khazan notes that building
`
`such models was prior art to Khazan’s application, and that “[s]ome existing
`
`anomaly detection techniques create models of normal behavior of a
`
`particular application based on observing sequences of system calls executed
`
`at run time as part of a learning phase.” Id. ¶ 9.
`
`Claims 22, 32, and 42
`
`Claims 22, 32, and 42 recite modifying a program to include
`
`indicators of program-level function calls being made during execution of
`
`the program. For this limitation, Petitioner contends that Khazan’s
`
`“instrumentation technique” modifies an application (program) so that the
`
`13
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`application executes additional monitoring code which indicates which of
`
`the programs functions are being called. Pet. 20–21; Ex. 1010, ¶¶ 5, 44, 73,
`
`75, 78. Khazan states that “[w]hen the application is executed, dynamic
`
`analysis is used to intercept calls to targets and verify them against the
`
`model.” Ex. 1010, Abstract. Further, Petitioner emphasizes that Khazan
`
`explains that dynamic analysis is performed “during execution of the
`
`application.” Pet. 21; Ex. 1010 ¶ 62. We are persuaded by Petitioner’s
`
`showing, which we adopt as our own, that Khazan discloses modifying a
`
`program to include indicators of program-level function calls being made
`
`during execution of the program.
`
`Claims 22, 32, and 42 further recite comparing at least one of the
`
`indicators of program-level function calls being made in an emulator to a
`
`model of function calls for at least a part of the program. For this limitation,
`
`Petitioner contends that Khazan discloses monitoring of program level
`
`function calls made by an application in an emulator. Pet. 22; Ex. 1010
`
`¶¶ 66, 111. Petitioner asserts that Khazan discloses “[w]hen the application
`
`is executed, dynamic analysis is used to intercept calls to targets and verify
`
`them against the model” and “[t]he verifications may involve comparing the
`
`invocation and target location, as well as other call-related information . . . to
`
`the corresponding information identified by static analysis.” Pet. 22; Ex.
`
`1010, Abstract. Further, Petitioner states that Khazan explains that dynamic
`
`analysis is performed “during execution of the application.” Pet. 21; Ex.
`
`1010 ¶ 62. We are persuaded by Petitioner’s showing, which we adopt as
`
`our own, that Khazan discloses comparing at least one of the indicators of
`
`14
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`program-level function calls being made in an emulator to a model of
`
`function calls for at least a part of the program.
`
`Claims 22, 32, and 42 further recite identifying a function call
`
`corresponding to the at least one of the indicators as anomalous based on the
`
`comparison. For these limitations, Petitioner contends that Khazan discloses
`
`the verification described above involves comparing run time behavior with
`
`the application model. Pet. 23; Ex. 1010, Abstract. Petitioner contends that
`
`the run time behavior in Khazan is monitored using monitoring code added
`
`to the application using the instrumentation technique (i.e., indicators). Pet.
`
`23; Ex. 1010 ¶¶ 64, 75. Khazan further discloses “[i]f the run time behavior
`
`deviates from the application model, it is determined that the application
`
`executable has executed MC [malicious code, i.e., anomalous function
`
`call].” Pet. 23 Ex. 1010 ¶ 65. We are persuaded by Petitioner’s showing,
`
`which we adopt as our own, that Khazan discloses identifying a function call
`
`corresponding to the at least one of the indicators as anomalous based on the
`
`comparison.
`
`modifying the program itself
`
`Patent Owner argues that Petitioner has not identified a teaching in
`
`Khazan that the instrumentation technique modifies the program itself.
`
`According to Patent Owner, Khazan discloses that other software
`
`components—not the program—are modified to intercept function calls.
`
`PO Resp. 10–11 (citing Ex. 1010 ¶ 73 (“At step 126, the associated libraries,
`
`such as all operating system DLLs, are instrumented to intercept calls to a
`
`predetermined set of target functions at run time.”)). Nevertheless,
`
`15
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`Petitioner points to the following statement from Khazan: “the
`
`instrumentation technique described in one embodiment herein modifies the
`
`memory loaded copy of the application and associated libraries to execute
`
`additional monitoring code.” Ex. 1010 at ¶ 75 (emphasis added) cited in Pet.
`
`20. Patent Owner does not explain sufficiently in its papers why this
`
`statement is incorrect.4 Specifically, Patent Owner assumes that the
`
`statement is referring to modifying the libraries only. PO Resp. 10
`
`(“Petitioner has not identified a teaching in Khazan that the instrumentation
`
`technique modifies the program itself.”) Therefore, we are not persuaded by
`
`Patent Owner’s argument.5
`
`
`
`4 In the hearing, Patent Owner asserted that this sentence refers only to
`modifying the libraries, but this argument is not made in the Patent Owner
`Response. Tr. 43–46. We decline to rely on argument made solely in the
`oral hearing. Nevertheless, while it may be true that the libraries are the
`only thing modified in the embodiment of Khazan, the cited language clearly
`states that the application and libraries are modified. Patent Owner further
`argues “Petitioner has not explained how functions that are internal to the
`program (not in libraries) would be tracked or how a program would be
`modified to add indicators for them.” PO Resp. 12. Prior art patents,
`however, are presumed to be enabled. In re Antor Media Corp., 689 F.3d
`1282, 1287 (Fed. Cir. 2012) (“[B]oth claimed and unclaimed materials
`disclosed in a patent are presumptively enabling . . . .”). The burden is on
`the party challenging the enablement of the prior art patent to show that the
`patent is not enabled. Id. at 1288. Patent Owner has not made a sufficient
`presentation of evidence for such a showing.
`
` 5
`
` Patent Owner also argues that the libraries are external to the program and
`the claims require modification that is internal to the program. PO Resp.
`16
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`typical computer usage
`
`Claims 22, 32, and 42 further recite identifying/identifies a function
`
`call corresponding to the at least one of the indicators as anomalous based on
`
`the comparison. We construed “anomalous” to mean “deviation from a
`
`model of typical computer system usage.” Patent Owner argues that
`
`Khazan’s system which models using a static examination without execution
`
`of the program cannot model “typical computer usage.” PO Resp. 14. The
`
`issue of the static nature of Khazan was argued at the preliminary stage, and
`
`we were not persuaded at that time. In the Institution Decision, we stated
`
`“we find that the claim language does not expressly require a model created
`
`via executing function calls.” Dec. 7. In other words, we the claims do not
`
`require execution of the program to create the model. Patent Owner has not
`
`persuaded us to change that construction, therefore we maintain that
`
`construction here. The construction of “anomalous” was not intended to
`
`imply by use of the term “usage” that actual execution of the program is
`
`necessary to create a model that reflects typical usage of the program. Thus,
`
`Patent Owner’s argument is not commensurate with the limitations of the
`
`claims.
`
`statistical deviations
`
`Patent Owner also suggests that “identifying statistical deviations
`
`from normal” is required by the claims, and Khazan does not disclose such
`
`
`
`12–13. Because we find that Khazan modifies the application (program) the
`debate regarding whether the libraries are internal is moot. Tr. 47:4–13.
`17
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`statistical analysis. PO Resp. 17. We did not adopt this construction. Thus,
`
`Patent Owner’s argument is not commensurate with the limitations of the
`
`claims. We therefore are not persuaded by this argument.
`
`emulator
`
`Patent Owner also argues that Khazan does not disclose an emulator
`
`as required by the claims. As noted above, both Petitioner and Patent Owner
`
`agree that the broadest reasonable interpretation of “emulator” is “software,
`
`alone or in combination with hardware, that permits the monitoring and
`
`selective execution of certain parts, or all, of a program.” Pet. 8; PO Resp.
`
`18. We have adopted this construction.
`
`Patent Owner argues that “Petitioner has pointed to a component that,
`
`while referred to as an ‘emulator’ in Khazan, does not possess the
`
`capabilities required by the agreed-upon claim construction. Ex. 2030
`
`¶¶ 151–53.” PO Resp. 20. Patent Owner argues that Petitioner relies on a
`
`separate component called VM Ware to provide the selective execution. PO
`
`Resp. 19–20. Specifically, Patent Owner argues that the detection tool of
`
`Khazan that performs monitoring is not an emulator and that VM Ware does
`
`not “provide off the shelf” selective execution. PO Resp. 19 (citing Ex.
`
`2030 ¶¶ 147–151; Ex. 2031 ¶ 186).
`
`The Khazan Specification states
`
`
`
`6 A co-inventor of Khazan testifies that “neither I nor my colleagues ever ran
`the system described in Khazan in an emulator, nor did we test it in one.”
`Ex. 2031 ¶ 18. This statement cannot negate the express reference to the use
`of an emulator in the Khazan patent. Ex. 1010 ¶¶ 111, 112.
`18
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`The detection tool may execute, for example, as a background
`task, use the foregoing techniques and invoke and execute one or
`more of the executables in order to possibly detect MC contained
`in these executables. This may also be done as an emulation or
`simulation of the execution, or in what is known to those skilled
`in the art as a virtual environment, such as VMWare.
`
`
`
`An application may be executed using the techniques
`described herein at a variety of different times. The application
`may be executed during normal usage, when purposefully testing
`it for the presence of MC, or when analyzing the MC embedded
`within the application. An execution of the application may also
`be emulated or simulated.
`
`
`
`Ex. 1010 ¶¶ 111–112. Patent Owner, through its Declarant, argues that this
`
`quoted text refers to emulating or simulating the detection tool rather than
`
`the program that is being analyzed. See generally Ex. 1014, 143–73. In the
`
`hearing, Patent Owner clarified that
`
`The broadest definition of emulator means to imitate the
`functions of another computer by means of software. And so to
`simply say you are emulating a program generically could mean
`that you are just running that program, another piece of software.
`It doesn’t mean that you are selecting that program for
`emulation. It doesn’t mean that you are selecting that program
`for monitoring and the ability to selectively execute all or a
`portion of the program. That would be the distinction we're
`talking about.
`
`Tr. 51:7–16. We are not persuaded by this argument. Patent Owner parses
`
`the construction and requirements of the prior art too finely. There is no
`
`explicit requirement in the claims or the agreed-upon construction that the
`
`emulation occur in a single “off the shelf” emulator. Petitioner relies on the
`
`19
`
`
`
`IPR2015-00375
`Patent 8,074,115 B2
`
`
`
`detection tool running the application in the virtual environment to meet the
`
`claim; there is no reason that Petitioner cannot do so. Pet. 12–13.
`
`Patent Owner cites to Net MoneyIN, Inc. v. VeriSign, Inc., 545 F.3d
`
`1359, 1371 (Fed. Cir. 2008) for the proposition that a reference cannot be
`
`anticipatory if it requires combining separate parts of the reference to
`
`produce a single entity recited in the claims. Net MoneyIN does not go that
`
`far. In Net MoneyIN the Federal Circuit states “differences between the
`
`prior art reference and a claimed invention, however slight, invoke the
`
`question of obviousness, not anticipation . . . . [To anticipate], it is not
`
`enough that the prior art reference discloses . . . multiple, distinct teachings
`
`that the artisan might somehow combine to achieve the claimed invention.”
`
`Net MoneyIN, 545 F.3d at 1371 (citations omitted). Here, the detection tool
`
`and VM Ware are not distinct teachings, rather they work in concert as
`
`described by Khazan. See Pet. 22 (citing Ex. 1010 ¶¶ 111, 112, Ex. 1003, ¶
`
`66); see Wm
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
