UNITED STATES PATENT AND TRADEMARK OFFICE
`
`__________________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`___________________
`
`SYMANTEC CORP.,
`
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`
`Patent Owner.
`
`____________________
`
`Case IPR2015-01892
`Patent 8,677,494
`
`__________________________________________________________
`
`PATENT OWNER’S RESPONSE
`
`
`
`
`
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`TABLE OF CONTENTS
`
`Page
`
`I.
` 
`
`II.
` 
`
`Introduction ...................................................................................................... 1 
`
`Facts ................................................................................................................. 1 
`
`A.
`
` 
`
`B.
`
` 
`
`C.
`
` 
`
`THE ‘494 PATENT............................................................................... 1 
`
`Overview of Swimmer .......................................................................... 3 
`
`Overview of Evidence Before the Board .............................................. 4 
`
`1. 
`
`2. 
`
`Dr. Sylvia Hall-Ellis .................................................................... 5 
`
`Dr. Jack Davidson ....................................................................... 5 
`
`
`
`  Claim Construction .......................................................................................... 6 III.
`
`A.
`
` 
`
`B.
`
` 
`
`C.
`
` 
`
`“database” (claims all claims) ............................................................... 6 
`
`“list of suspicious computer operations” (all claims) ......................... 10 
`
`“storing the DSP data in a database” (all claims) ............................... 13 
`
`IV.
`
`  Swimmer does not invalidte the ‘494 Patent ................................................. 16 
`
`A.
`
` 
`
`Swimmer was not Publically Available .............................................. 16 
`
`V.
`
` 
`
`Swimmer Does Not Render Claims 1, 2, 5, 6, 10, 11, 14, and 15
`Obvious Under 35 U.S.C. § 103(a) ............................................................... 18 
`
`A.
`
` 
`
`B.
`
` 
`
`Swimmer Teaches Away from the Invention Claimed in the
`‘494 Patent ........................................................................................... 19 
`
`Petitioner Has Not Demonstrated that Swimmer Discloses “[a
`Downloadable scanner coupled with said receiver, for] deriving
`DSP data, including a list of suspicious computer operations
`that may be attempted by the Downloadable” (claims 1 and 10) ....... 20 
`
`1. 
`
`Swimmer does not disclose “a list of suspicious computer
`operations that may be attempted by the Downloadable”
`
`- i -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`2. 
`
`3. 
`
`4. 
`
`5. 
`
`because Swimmer never deems any operations as
`suspicious .................................................................................. 22 
`
`Petitioner’s Argument That Swimmer Discloses a List of
`Suspicious Computer Operations Fails Because no
`Computer Operations are a priori Suspicious .......................... 24 
`
`Swimmer’s Audit Trail Does not Include a List of
`Suspicious Computer Operations Simply Because it can
`be Used to Detect Viruses ......................................................... 25 
`
`The Claims Require Deriving a List of Suspicious
`Computer Operations ................................................................ 27 
`
`Swimmer’s Activity Data Contained Within an Audit
`Record Cannot Correspond to DSP Data Because an
`Audit Record does not Include a List of Suspicious
`Computer Operations ................................................................ 28 
`
`C.
`
` 
`
`Petitioner Has Not Demonstrated that Swimmer Discloses
`storing the DSP data in a database” (claims 1 and 10) ....................... 30 
`
`1. 
`
`2. 
`
`3. 
`
`4. 
`
`Converting Data Does Not Store the Data in a Database ......... 33 
`
`Swimmer’s Audit Trail Is Not A Database Because
`Swimmer’s Audit Trail Is Undisputedly a Log File ................. 35 
`
`a.  Dr. Davidson Admitted that Swimmer’s Audit
`Trail is a Log File ...................................................................... 36 
`
`b.  Swimmer’s Audit Trail Is Not A Database Due
`to Fundamental Differences in Structure and Function ............ 37 
`
`c.  “Canonical Format” is a Generic File Format
`not a “Database Schema” .......................................................... 41 
`
`Petitioner Provides Insufficient Motivation to Substitute
`Swimmer’s Log File With a Database ...................................... 43 
`
`The Claims of the ‘494 Patent Impose a Timing
`Requirement not Met by Swimmer’s VIDES System .............. 46 
`
`- ii -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`D.
`
` 
`
`E.
`
` 
`
`Swimmer does not Teach or Suggest “a database manager
`coupled with said Downloadable scanner, for storing the DSP
`data in a database” (claim 10) ............................................................. 48 
`
`Swimmer does not Teach or Suggest “wherein the
`Downloadable includes program script” (claims 5 and 15) ................ 52 
`
`VI.
`
`  Secondary Considerations of Non-Obviousness ........................................... 53 
`
`A.
`
` 
`
`B.
`
` 
`
`C.
`
` 
`
`D.
`
` 
`
`Long-Felt But Unresolved Need and Recognition of a Problem ........ 60 
`
`Skepticism and Unexpected Results ................................................... 61 
`
`The Failure of Others .......................................................................... 61 
`
`Teaching away by others ..................................................................... 62 
`
`
`
`  CONCLUSION .............................................................................................. 63 VII.
`
`
`
`- iii -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`TABLE OF AUTHORITIES
`
` Page(s)
`
`Cases
`Apple Inc. v. Int’l Trade Comm’n,
`725 F.3d 1356 (Fed. Cir. 2013) .......................................................................... 62
`
`In re Baxter Int’l, Inc.,
`678 F.3d 1357 (Fed. Cir. 2012) ............................................................................ 9
`
`Blue Calypso, LLC v. Groupon, Inc.,
`815 F.3d 1331 (Fed. Cir. 2016) .......................................................................... 17
`
`In re: Cyclobenzaprine Hydrochloride Extended-Release Capsule
`Patent Litig.,
`676 F.3d 1063 (Fed. Cir. 2012) .................................................................... 61, 62
`
`Demaco Corp. v. F. Von Langsdorff Licensing Ltd.,
`851 F.2d 1387 (Fed. Cir. 1988) .......................................................................... 55
`
`In re Gal,
`980 F.2d 717 (Fed. Cir. 1992) ................................................................ 46, 51, 53
`
`Graftech Int’l Holdgs, Inc., v. Laird Techs., Inc.,
`2016 WL 3357427 (Fed. Cir. June 17, 2016) ..................................................... 54
`
`In re Hall,
`781 F.2d 897 (Fed. Cir. 1986) ............................................................................ 16
`
`Institut Pasteur & Universite Pierre Et Marie Curie v. Focarino,
`738 F.3d 1337 (Fed. Cir. 2013) .......................................................................... 54
`
`KSR Int’l Co. v. Teleflex Inc.,
`550 U.S. 398 (2007) ............................................................................................ 45
`
`Kyocera Wireless Corp. v. Int’l Trade Comm’n,
`545 F.3d 1340 (Fed. Cir. 2008) .................................................................... 17, 18
`
`L-3 Commc’n Holdings, Inc. v. Power Survey, LLC,
`IPR2014-00832, Paper 9 (PTAB Nov. 14, 2014) ............................................... 16
`
`- i -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`Ex parte McGaughey,
`6 U.S.P.Q.2d 1334 (B.P.A.I. 1988) ................................................................ 9, 37
`
`In re McLaughlin,
`443 F.2d 1392 (C.C.P.A. 1971) .......................................................................... 12
`
`mFormation Techs., Inc. v. Research in Motion Ltd.,
`764 F.3d 1392 (Fed. Cir. 2014) .................................................................... 16, 47
`
`Microsoft Corp. v. Proxyconn, Inc.,
`789 F.3d 1292 (Fed. Cir. 2015) .................................................................... 13, 35
`
`Minnesota Mining & Mfg. Co. v. Johnson & Johnson Orthopaedics,
`Inc.,
`976 F.2d 1559 (Fed. Cir. 1992) .......................................................................... 59
`
`OpenTV, Inc. v. Cisco Tech., Inc.,
`IPR2013-00328, Paper No. 13 (PTAB Nov. 29, 2013) ...................................... 51
`
`Orthopedic Equip. Co. v. All Orthopedic Appliances, Inc.,
`707 F.2d 1376 (Fed. Cir. 1983) ...................................................................... 6, 62
`
`Osram Sylvania Inc. v. Am. Induction Technologies Inc.,
`701 F.3d 698 (Fed. Cir. 2012) ............................................................................ 62
`
`Palo Alto Networks, Inc. v. Finjan, Inc.,
`IPR2016-00159, Paper 8 (PTAB May 13, 2016) ................................................. 6
`
`Rambus Inc. v. Rea,
`731 F.3d 1248 (Fed. Cir. 2013) .......................................................................... 62
`
`SAS Institute, Inc. v. Complementsoft, LLC,
`Nos. 2015-01346, -1347, 2016 WL 3213103 (Fed. Cir. June 10,
`2016) ............................................................................................................... 7, 33
`
`Statutes
`
`35 U.S.C. § 103(a) ............................................................................................... 3, 18
`
`35 U.S.C. § 311(b) ................................................................................................... 16
`
`Other Authorities
`
`37 C.F.R. § 42.65(a) ........................................................................................... 37, 43
`
`- ii -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`EXHIBIT LIST
`
`
`
`Description
`
`Exhibit-2001
`
`IBM Dictionary of Computing (Excerpts, page 165)
`
`Exhibit-2002 Finjan, Inc. v. Sophos, Inc., 14-cv-1197-WHO (N.D. Cal.), Dkt.
`No. 73 (“Claim Construction Order”)
`
`Exhibit-2003 Sophos, Inc. v. Finjan, Inc., Case No. IPR2015-00907, Paper 8,
`Decision on Institution (P.T.A.B. Sept. 24, 2015)
`
`Exhibit-2004 Sophos, Inc. v. Finjan, Inc., Case No. IPR2015-01022, Paper 7,
`Decision on Institution (P.T.A.B. Sept. 24, 2015)
`
`Exhibit-2005 Finjan, Inc. v. Symantec Corp., Case No. 14-cv-02998-HSG (N.D.
`Cal.), Plaintiff Finjan, Inc.’s Objections and Responses to
`Defendant Symantec Corp.’s Second Set of Interrogatories (Nos.
`12-16), dated April 27, 2015.
`
`Exhibit-2006 Sophos, Inc. v. Finjan, Inc., Case No. IPR2015-01022, Paper 9,
`Decision Denying Request for Rehearing (P.T.A.B. Jan. 28, 2016)
`
`Exhibit-2007 Declaration of Dr. Nenad Medvidovic on the Validity of Claims 1,
`2, 5, 6, 10, 11, 14, and 15 of U.S. Patent No. 8,677,494 in Support
`Patent Owner Response in Case No. IPR2015-01892
`
`Exhibit-2008 Curriculum Vitae of Dr. Nenad Medvidovic
`
`Exhibit-2009 List of Documents Considered by Dr. Nenad Medvidovic
`
`Exhibit-2010 Declaration of S.H. Michael Kim in Support of Patent Owner
`Response in Case No. IPR2015-01892
`
`Exhibit-2011 Deposition Transcript of Sylvia Hall-Ellis in Case No. IPR2015-
`01892, taken on May 26, 2016
`
`Exhibit-2012 Deposition Transcript of Jack W. Davidson in Case No. IPR2015-
`01892, taken on May 27, 2016
`
`- i -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`
`
`Description
`
`Exhibit-2013 Finjan, Inc. v. Websense, Inc., Case No. 14-cv-01353 (N.D. Cal.),
`Plaintiff Finjan, Inc.’s Disclosure of Asserted Claims and
`Infringement Contentions, dated April 22, 2014
`
`Exhibit-2014 Claim charts created by Dr. Nenad Medvidovic regarding the
`products of Finjan’s licensees and the ‘494 Patent
`
`Exhibit-2015 Gartner - Magic Quadrant for Secure Web Gateways, May 28,
`2013
`
`Exhibit-2016 Gartner - Magic Quadrant for Secure Email Gateways, July 2,
`2013
`
`Exhibit-2017 Finjan Holdings, Inc. 8-K, dated April 7, 2015
`
`Exhibit-2018 Finjan Holdings, Inc. 8-K, dated December 30, 2015
`
`Exhibit-2019 Finjan Holdings, Inc. 8-K, dated May 14, 2015
`
`Exhibit-2020 Finjan Holdings, Inc. 8-K, dated May 20, 2016
`
`Exhibit-2021 Finjan Holdings, Inc. 8-K, dated November 15, 2015
`
`Exhibit-2022 Finjan Holdings, Inc. 8-K, dated September 24, 2014
`
`Exhibit-2023 Proofpoint Inc. 10-K, dated February 25, 2016
`
`Exhibit-2024 Microsoft Press Computer Dictionary, Third Edition - Excerpts,
`Pages 74, 199, 262, 269, 288, 421, 451
`
`Exhibit-2025 Dictionary of Computing, Fourth Edition - Excerpts, Pages 40, 280
`
`Exhibit-2026 Dictionary of Computer Words - An A to Z Guide to Today’s
`Computers (1995) - Excerpts, Page 62
`
`Exhibit-2027
`
`IBM Dictionary of Computing, Pages 149, 653
`
`Exhibit-2028 U.S. Patent No. 6,804,780 (“‘780 Patent)
`
`Exhibit-2029 Definition of Logfile from Wikipedia, available at
`http://en.wikipedia.org/wiki/Logfile
`
`- ii -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`
`
`Description
`
`Exhibit-2030 Log File, available at http://techterms.com/definition/logfile.
`
`Exhibit-2031 Microsoft MS-DOS Programmer’s Reference - The Official
`Technical Reference to MS-DOS (1993)
`
`Exhibit-2032 Abdelaziz Mounji, “User Guide for Implementing NADF
`Adaptors,” Institut d’ Informatique (Jan. 1995)(“MOU95”)
`
`Exhibit-2033 Finjan, Inc. v. Sophos, Inc., 14-cv-1197-WHO (N.D. Cal.), Dkt.
`No. 58-12, Declaration of Nenad Medvidovic in Support of
`Plaintiff Finjan, Inc.’s Opening Claim Construction Brief, dated
`December 1, 2014
`
`Exhibit-2034 Websense, Inc. brochure - Triton APX (2015), available at
`https://www.websense.com/assets/brochures/brochure-triton-apx-
`en.pdf.
`
`Exhibit-2035 F-Secure Whitepaper - F-Secure DeepGuard, available at
`https://www.f-
`secure.com/documents/996508/1030745/deepguard_whitepaper.pd
`f.
`
`Exhibit-2036 Proofpoint, Inc.’s 10-K, dated December 31, 2014
`
`Exhibit-2037 F-Secure 2015 revenue and financials, available at https://www.f-
`secure.com/en/web/investors_global/financials.
`
`Exhibit-2038 Websense, Inc. Revenue and Financial Data, available at
`http://www.hoovers.com/company-information/cs/revenue-
`financial.websense_inc.89ee9262879a5b65.html.
`
`Exhibit-2039 Proofpoint, Inc. Press Release - Proofpoint Announces Fourth
`Quarter and Full Year 2015 Financial Results (Jan. 28, 2016),
`available at
`http://investors.proofpoint.com/releasedetail.cfm?releaseid=95229
`5
`
`- iii -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`
`
`Description
`
`Exhibit-2040 Reuters news article - Avast worth ‘upwards of $2 billion’; no IPO
`before 2017, available at http://www.reuters.com/article/us-avast-
`ceo-idUSKCN0SN2MJ20151029
`
`- iv -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`
`I.
`
`INTRODUCTION
`
`Petitioner has failed to meet its burden of proof that the challenged claims
`
`are unpatentable, because (1) its only reference, Swimmer, fails to disclose several
`
`of the challenged claim elements, and there is no legal or technical basis for filling
`
`these gaping holes as Petitioner requests, (2) its declarants failed to provide
`
`adequate factual basis for their opinions—relying instead on conclusory statements
`
`to support their position—and could not support their positions when challenged in
`
`deposition, (3) it failed to show that Swimmer was publically available prior to the
`
`critical date, and (4) it did not even address the abundant secondary considerations
`
`that demonstrate that the challenged claims are not obvious, let alone provide
`
`adequate factual proof refuting such evidence. For these reasons, and those stated
`
`below, Petitioner’s obviousness challenge to the asserted claims of U.S. Patent
`
`8,677,494 (Ex. 1001)(the “‘494 Patent”) should be denied and all claims found
`
`patentable.
`
`
`II.
`
`FACTS
`
`A.
`
` THE ‘494 PATENT
`
`The invention described in the ‘494 Patent1 is an Internet-based technology
`
`that protects personal computers from the risk of “suspicious or other ‘malicious’
`
`1 The ‘494 Patent claims priority to U.S. Patent Nos. 8,079,086 (“the ‘086 Patent”),
`
`7,613,926 (“the ‘926 Patent”), 7,058,822 (“the ‘822 Patent”), 6,804,780 (Ex.
`
`- 1 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`operations that might otherwise be effectuated by remotely operable code” from
`
`the Internet. ‘494 Patent at 2:51–56. The invention described in the ‘494 Patent
`
`protects against potentially malicious content by receiving incoming content (i.e. a
`
`Downloadable) from the Internet and establishing that the code will not cause any
`
`harm before it is allowed to run on the computer. The Downloadable is reviewed
`
`and Downloadable security profile (“DSP”) data, 2 which includes a list of
`
`suspicious computer operations that the Downloadable may attempt, is derived.
`
`‘194 Patent at 5:45–48.
`
`Importantly, the DSP is stored in a database. ‘494 Patent at 21:24–25; ‘194
`
`Patent at 4:14–18; 9:52–55. Accordingly, DSP data can be readily retrieved when
`
`a known Downloadable is detected, thereby allowing security decisions to be made
`
`without generating security profiles for all incoming Downloadables. Indeed, the
`
`storage of the DSP in a database is one of the key features that distinguished the
`
`‘494 Patent over the prior art.
`
`
`2028)(“the ‘780 Patent”), 6,092,194 (“the ‘194 Patent”), 6,480,962 (“the ‘962
`
`Patent”), and 6,167,520 (“the ‘520 Patent”). The ‘494 Patent incorporates the
`
`disclosures of these patents by reference.
`
`2 This paper refers to the terms “security profile data for a Downloadable” and
`
`“Downloadable security profile data” as “DSP data.”
`
`- 2 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`Petitioner submitted a Petition to institute IPR on September 10, 2015,
`
`challenging claims 1, 2, 5, 6, 10, 11, 14, and 15 of the ‘494 Patent. Paper No. 1.
`
`Although Petitioner challenged the claims based on Swimmer, Cline, Ji, and
`
`Forrest (Paper No. 1), the Board only instituted IPR based on Swimmer under 35
`
`U.S.C. § 103(a) for claims 1, 2, 5, 6, 10, 11, 14, and 15. Paper No. 9. Claims 1
`
`and 10 are independent claims. Paper No. 9. Claims 2, 5, and 6 are dependent on
`
`claim 1, and claims 11, 14, and 15 are dependent on claim 10. Claim 10 is
`
`illustrative and is reproduced below:
`
`10. A system for managing Downloadables, comprising:
`
`a receiver for receiving an incoming Downloadable;
`
`a Downloadable scanner coupled with said receiver, for
`deriving security profile data for the Downloadable, including a list of
`suspicious computer operations that may be attempted by the
`Downloadable; and
`
`
`a database manager coupled with said Downloadable
`scanner, for storing the Downloadable security profile data in a
`database.
`
`‘494 Patent at 22:7-16.
`
`B.
`
` Overview of Swimmer
`
`Swimmer discloses a DOS-based theoretical system that is of interest to
`
`virus researches and is not designed to be of practical use to end users. Swimmer
`
`at 000002, ¶ 3. Swimmer teaches that to overcome the proliferation of
`
`- 3 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`polymorphic viruses that are able to circumvent database-based solutions,
`
`Swimmer analyzes a real-time stream of data from an emulator and processes all
`
`opcodes corresponding to program events within that activity stream. Id. at
`
`000001, ¶ 1 (“ASAX is used to analyse the stream of data which the emulator
`
`produces”); see also id. at 000009 ¶6 (“The audit system was integrated into an
`
`existing PC emulation by placing hooks into the module for processing all opcodes
`
`corresponding with the events.”). Swimmer does not teach a network based
`
`solution that is able to identify a list of suspicious computer operations and teaches
`
`against the use of a database. Id. at 000003, ¶¶ 1–3 (teaching away from the use of
`
`scanners and databases because they allegedly cannot detect polymophic viruses).
`
`C.
`
` Overview of Evidence Before the Board
`
`As noted above, the Board instituted trial based on Swimmer only.
`
`Accordingly, the only evidence that Petitioner submitted that is relevant in this IPR
`
`is:
`
` Morton Swimmer et al., Dynamic Detection and Classification of Computer
`Viruses Using General Behaviour Patterns, Virus Bulletin Conference,
`Virus Bulletin Ltd. (Ex. 1005, “Swimmer”)
`
` Dr. Sylvia Hall-Ellis’ Declaration and Curriculum Vitae (Ex. 1006; Ex.
`1007)
`
` Dr. Jack Davidson’s Declaration (“Davidson Decl.”) and Curriculum Vitae
`(Ex. 1018; Ex. 1019)
`
`- 4 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`1.
`
`Dr. Sylvia Hall-Ellis
`
`Petitioner introduced Dr. Sylvia Hall-Ellis’ declaration to establish the date
`
`that Swimmer was allegedly publicly available. Paper No. 1 at 4. On May 26,
`
`2016, Patent Owner deposed Dr. Hall-Ellis. Dr. Hall-Ellis testified that she had no
`
`first-hand knowledge as to the public availability of the Swimmer reference. Ex.
`
`2011 (“Hall-Ellis Tr.”) at 25:8-26:15. In fact, the first time she learned of
`
`Swimmer was in August of 2015. Hall-Ellis Tr. at 37:14-38:16. Notably, she
`
`acknowledged that just because the record stated that a reference was available at a
`
`conference, does not necessarily mean it was distributed at the conference. Hall-
`
`Ellis Tr. at 36:9-37:6. Thus, the record demonstrates that the Petitioner lacks
`
`sufficient evidence that Swimmer was publically available.
`
`2.
`
`Dr. Jack Davidson
`
`Petitioner submitted the declaration of Dr. Jack Davidson with its Petition to
`
`establish the grounds of obviousness. On May 27, 2016, Patent Owner deposed
`
`Dr. Davidson regarding his declaration. During his deposition, Dr. Davidson
`
`admitted that the audit trail in Swimmer was indeed a log file, not a database as
`
`required by the challenged claims. Ex. 2012 (“Davidson Tr.”) at 76:12–78:19. Dr.
`
`Davidson further confirmed that the claims require that the DSP be generated
`
`before it can be stored in a database, and Swimmer does not disclose this element.
`
`Davidson Tr. at 83:19–86:4. When asked to identify exactly what in Figure 3 of
`
`- 5 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`Swimmer constituted a suspicious computer operation, Dr. Davidson stated that all
`
`operating system calls are suspicious computer operations—an understanding that
`
`is explicitly belied by the intrinsic evidence. Davidson Tr. at 169:21–181:13 (“·Q·
`
`So you can’t tell me by looking at your declaration whether any of the functions
`
`you listed here are considered suspicious? A· They are all suspicious because they
`
`are -- they are operating system calls.”). Accordingly, the record demonstrates that
`
`several key limitations are missing from the Swimmer reference, including a
`
`database and the identification of suspicious operations.
`
` CLAIM CONSTRUCTION
`III.
`
`A.
`
`
`
`“database” (claims all claims)
`
`The term “database” is properly construed as “a collection of interrelated
`
`data organized according to a database schema to serve one or more applications.”
`
`In its Institution Decision, the Board agreed that this construction “represents the
`
`broadest reasonable construction of ‘database’ in light of the claim language and
`
`the specification of the ‘494 Patent.” Institution Decision for IPR2015-01892
`
`(“Institution Decision”), Paper 9 at 10. This construction is also consistent with
`
`the Board’s construction for other cases involving the ‘494 Patent, including
`
`Sophos, Inc. v. Finjan, Inc., IPR2015-01022, Paper 7 at 9–10 (PTAB Sept. 24,
`
`2015) (declining to institute trial on the ‘494 Patent due to similar reasons), and
`
`Palo Alto Networks, Inc. v. Finjan, Inc., IPR2016-00159, Paper 8 at 7–8 (PTAB
`
`- 6 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`May 13, 2016). As such, this construction controls in this proceeding. SAS
`
`Institute, Inc. v. Complementsoft, LLC, Nos. 2015-01346, -1347, 2016 WL
`
`3213103, at *7 (Fed. Cir. June 10, 2016).
`
`The practical import of this construction excludes log files from being
`
`databases. As explained in the District Court’s claim construction order in Finjan,
`
`Inc. v. Sophos, Inc., 3:14-cv01197-WHO, Dkt. 73, “the term ‘database’ is not
`
`broad enough to include a log file.” Ex. 2002 at 7, Claim Construction Order; see
`
`also Ex. 2033; Medvidovic, ¶¶ 133-136. The Court based its reasoning on the
`
`intrinsic record which demonstrates that databases and log files are separate and
`
`distinct entities. For example, the specification designates the database that stores
`
`DSP with box “Security Database 240” while an event log is designated with box
`
`“Event Log 245”:
`
`
`
`- 7 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`See ‘194 Patent at FIG. 2. The ‘494 Patent further describes how databases and log
`
`files function differently by describing how logging results in an event log is an
`
`action that is distinct from storing in a security database. “[T]he logical engine 333
`
`forwards a status report to the record-keeping engine 335, which stores the reports
`
`in event log 245 in the data storage device 230 for subsequent review, for example,
`
`by the MIS director.” ‘194 Patent at 7:2–6. This logging functionality is distinct
`
`from storing in a database, which allows DSP to be efficiently retrieved from the
`
`database, as shown by the bidirectional arrow between the DSP data 310 stored
`
`within Security Database 240 and Code Scanner 325 as compared to the arrow
`
`from logical engine 333 to record-keeping engine 335 to event log 245:
`
`
`
`- 8 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`See id. at FIG. 3; see also id. at 3:47–50 (“The data storage device 230 stores a
`
`security database 240, which includes security information for determining
`
`whether a received Downloadable is to be deemed suspicious.”). Because the
`
`District Court’s holding is based on sound reasoning, it should generally be
`
`followed in these proceedings. In re Baxter Int’l, Inc., 678 F.3d 1357, 1365 (Fed.
`
`Cir. 2012) (“[E]ven with a more lenient standard of proof, the PTO ideally should
`
`not arrive at a different conclusion.”).
`
`With this construction, the Petition cannot withstand scrutiny, as Petitioner’s
`
`expert has admitted that Swimmer’s audit trail is a log file, not a database. See Ex
`
`parte McGaughey, 6 U.S.P.Q.2d 1334, 1337 (B.P.A.I. 1988) (explaining that an
`
`admission as to what is in the prior art is simply that, an admission, and requires no
`
`independent proof. It is an acknowledged, declared, conceded, or recognized fact
`
`or truth.). This admission is decisive because Petitioner already attempted to
`
`broaden the “database” to encompass log files and lost. See Petition at 12 (“[Patent
`
`Owner’s proposed construction] appears to be nothing more than attempt to
`
`salvage the challenged claims by excluding certain types of databases described in
`
`the prior art, such as log files.”). Accordingly, Petitioner has failed to meet its
`
`burden to show that Swimmer’s audit trail teaches the claimed “database” because
`
`(1) the practical import of adopting Patent Owner’s construction is that the term
`
`- 9 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`“database” is not broad enough to include a log file; and (2) Petitioner admitted
`
`that Swimmer’s audit trail is a log file.
`
`B.
`
`
`
`“list of suspicious computer operations” (all claims)
`
`A “list of suspicious computer operations” is properly construed as “a list of
`
`computer operations deemed suspicious.” The ‘494 Patent requires this
`
`construction, specifically that the operations are deemed to be suspicious. For
`
`example, the ‘194 Patent, which is incorporated by reference into the ‘494 Patent,
`
`explains how generating the “list of suspicious computer operations” first requires
`
`that a determination be made as to whether the operations to be listed are
`
`suspicious:
`
`The code scanner 325 in step 710 resolves a respective command in
`the machine code, and in step 715 determines whether the resolved
`command is suspicious (e.g., whether the command is one of the
`operations identified in the list described above with reference to FIG
`3).
`
`‘194 Patent at 9:24–29 (emphasis added); see also ‘194 Patent, Fig. 7, 9:20–42; Ex.
`
`2007, Declaration of Dr. Medvidovic (“Medvidovic”), ¶¶ 47–48, 65.
`
`Petitioner’s argument—that the MS-DOS function numbers identified by
`
`Swimmer’s audit system correspond to the same types of operations identified in
`
`the ‘639 Provisional (Ex. 1002)—is factually incorrect. See Petition at 17–18.
`
`First, the portion of the ‘639 Provisional cited by Petitioner relates to
`
`- 10 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`“fundamental computer operations,” not “suspicious computer operations. See
`
`‘639 Provisional, Pg. 18, l. 9–13. Petitioner ignores the disclosure from the ‘194
`
`Patent, which actually relates to “suspicious computer operations.” ‘194 Patent at
`
`5:50–54 (disclosing listing the operations that could be deemed potentially hostile).
`
`Additionally, the ‘194 Patent provides “An Example List of Operations Deemed
`
`Potentially Hostile,” meaning that there is no a priori understanding of what
`
`constitutes a “suspicious computer operation.” See ‘194 Patent at 5:58–6:4
`
`(emphasis added). Rather, some subset of all possible computer operations must
`
`first be deemed suspicious in order to derive a list of suspicious computer
`
`operations for a Downloadable. See id. at FIG. 7; 9:20–42.
`
`Furthermore, this argument is contrary to the law as the Board now attempts
`
`to equate standard MS-DOS functions as “suspicious computer operations” by
`
`relying on knowledge gleaned from the ‘494 Patent itself—namely the insight to
`
`deem some subset of “calls made to an operating system, a file system, a network
`
`system, and to memory” as suspicious in deriving a list of the suspicious computer
`
`operations that may be attempted by a Downloadable. See Institution Decision at
`
`22 (“Petitioner provides evidence that such function numbers were known in the
`
`prior art to correspond to, among other functions, the same four types of operations
`
`that are recited as ‘suspicious computer operations in challenged dependent claims
`
`6 and 15.”). To the contrary, in assessing obviousness Petitioner may consider
`
`- 11 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`“only knowledge which was within the level of ordinary skill in the art at the time
`
`the claimed invention was made,” but may not consider the claimed invention
`
`itself. In re McLaughlin, 443 F.2d 1392, 1395 (C.C.P.A. 1971). Because it is
`
`improper to rely on knowledge gleaned from the ‘494 Patent itself, Petitioner has
`
`not met its burden to show that Swimmer teaches the derived “list of suspicious
`
`computer operations.”
`
`Furthermore, the Board appears to have misunderstood how dependent
`
`claims 6 and 15 limit claims 1 and 10, respectively. In particular, claims 6 and 15
`
`do not equate all “calls made to an operating system, a file system, a network
`
`system, and to memory” with suspicious computer operations as implied in the
`
`Board’s Institution Decision. See Institution Decision at 22 (finding that the four
`
`types of operations in claims 6 and 15 are “recited as ‘suspicious computer
`
`operations.’”). Rather, “a person of ordinary skill in the art would understand
`
`these claims to require that certain ‘calls made to an operating system, a file
`
`system, a network system, and to memory’ be among those computer operations
`
`that have been deemed ‘suspicious.’” Medvidovic, ¶¶ 69, 97.
`
`Consequently, Patent Owner’s construction must be adopted because it is
`
`consistent with the specification of the ‘494 Patent and also prevents the
`
`imposition of an unreasonably broad interpretation that Petitioner tacitly proposed
`
`in an attempt to read the cited prior art onto the challenged claims. See generally
`
`- 12 -
`
`

`
`Patent Owner’s Response
`IPR2015-01892 (U.S. Patent No. 8,677,494)
`
`Microsoft Corp. v. Proxyconn, Inc., 789 F.3d 1292, 1298 (Fed. Cir. 2015) (“A
`
`construction that is ‘unreasonably broad’ and which does not ‘reasonably reflect
`
`the plain language and disclosure’ will not pass muster.”) (citation omitted).
`
`C.
`
`
`
`“storing the DSP data in a database” (all claims)
`
`The term “storing the DSP data in a database” is properly construed as
`
`“placing the deriv