`
`IN THE UNITED STATES DISTRICT COURT
`FOR THE EASTERN DISTRICT OF VIRGINIA
`RICHMOND DIVISION
`
`
`
`Civil Action No. 3:13-CV-808
`
` JURY TRIAL DEMANDED
`
`
`
`
`THE TRUSTEES OF COLUMBIA
`UNIVERSITY IN THE CITY OF NEW
`YORK,
`
`
`v.
`
`
`SYMANTEC CORPORATION,
`
`
`Plaintiff,
`
`Defendant.
`
`
`
`
`
`MEMORANDUM ORDER
`
`THIS MATTER is before the Court on Plaintiff’s Motion for Clarification of Claim
`
`Construction Order (“Motion”) (ECF No. 128). Defendant filed a brief opposition on October 10,
`
`2014. The parties have waived oral argument on this matter. Therefore, the issue is ripe for
`
`disposition. The Motion is hereby GRANTED and the Claim Construction Order issued on
`
`October 7, 2014 (“Order”) (ECF No. 123) is clarified below.
`
`On October 9, 2010, Columbia filed the instant Motion asking the Court to clarify its
`
`Order with respect to the terms “probabilistic model of normal compute system usage” in the
`
`‘084/‘306 patents and “anomalous” in the ‘115/‘322 patents. This Court’s Order defined
`
`“probabilistic model of normal computer system usage” as a “[m]odel of typical attack-free
`
`computer system usage that employs probability.” The Court defined “anomalous” as
`
`“[d]eviation/deviating from a model of typical, attack-free computer system usage.” Specifically,
`
`Columbia now seeks clarification on whether the Court intended its construction to mean that
`
`the claimed model may be generated with normal data and also attack data or whether the
`
`model must be generated with only “typical, attack free” data. In the claim construction briefs,
`
`Columbia argued the former interpretation, while Symantec argued the latter.
`
`As an initial matter, the Court notes that its Order construed the specific disputed terms
`
`
`
`1
`
`1
`
`SYMC 1006
`
`
`
`Case 3:13-cv-00808-JRS Document 146 Filed 10/23/14 Page 2 of 2 PageID# 4088
`
`that were originally presented in the parties’ claim construction briefs. Columbia now seeks a
`
`further interpretation of the disputed terms to answer the question Columbia posed at the claim
`
`construction hearing, that is, “What information is used to construct the model?” (See Tr.
`
`Markman Hr’g 75:13–14.) Despite not originally requesting a construction of such issue, the
`
`Court chooses to now clarify its ruling with respect to this question. See U.S. Surgical Corp. v.
`
`Ethicon, Inc., 103 F.3d 1554, 1568 (Fed. Cir. 1997) (emphasis added) (“Claim construction is a
`
`matter of resolution of disputed meanings and technical scope, to clarify and when necessary to
`
`explain what the patentee covered by the claims, for use in the determination of infringement.”).
`
`“Anomaly detectors . . . do not operate by looking for malicious activity directly. Rather,
`
`they look for deviations from normal activity.” (‘084 patent at 7:47–49.) Claim 1 of the ‘084
`
`patent mirrors this concept: “[A]nalyzing features from a record of a process that accesses the
`
`operating system registry to detect deviations from normal computer system usage to
`
`determine whether the access to the operating system registry is an anomaly.” (Id. at 22:30–
`
`34) (emphasis added). Logically, if the anomaly detection systems detect deviations from
`
`normal activity, that normal activity must be “attack-free” activity. Applying this logic to the rest
`
`of claim 1, which gathers “features from records of normal processes” and then generates “a
`
`probabilistic model of normal computer system usage based on [those] features,” it follows that
`
`the model is generated with only attack-free data.
`
`Let the Clerk send a copy of this Order to all counsel of record
`
` ____________________/s/_________________
`James R. Spencer
`Senior U. S. District Judge
`
`It is SO ORDERED.
`
`
`
`
`
`ENTERED this __23rd__ day of October 2014.
`
`
`
`2
`
`2
`
`SYMC 1006
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
