· · · · · UNITED STATES PATENT AND TRADEMARK OFFICE
`· · · · · BEFORE THE PATENT TRIAL AND APPEAL BOARD
`·
`
`·
`
`· · ·-----------------------------x
`
`· · ·SYMANTEC CORP., and BLUE
`· · ·COAT SYSTEMS, INC.,
`·
`· · · · · · · · · Petitioner,· · · Case IPR2015-01892
`·
`· · · · · ·v.
`·
`· · ·FINJAN, INC.,
`·
`· · · · · · · · · Patent Owner.
`·
`· · ·-----------------------------x
`·
`
`·
`
`·
`
`· · · · · ·Videotaped Deposition of JACK W. DAVIDSON,
`
`· · ·as reported by Nancy C. Bendish, Certified Court
`
`· · ·Reporter, RMR, CRR and Notary Public of the
`
`· · ·States of New York and New Jersey, at the
`
`· · ·offices of BRYAN CAVE LLP, 1290 Avenue of the
`
`· · ·Americas, New York, New York, on Wednesday,
`
`· · ·November 2, 2016, commencing at 10:08 a.m.
`
`·
`
`·
`
`·
`
`·
`
`·
`
`Patent Owner Finjan, Inc. - Ex. 2041, p. 1
`
`

`
`·1· ·A P P E A R A N C E S:
`·2
`·3· · · · ·BRYAN CAVE LLP
`· · · · · ·1290 Avenue of the Americas
`·4· · · · ·New York, New York· 10104-3300
`· · · · · ·BY:· ALEXANDER WALDEN, ESQ.
`·5· · · · · · · alexander.walden@bryancave.com
`· · · · · · · · FRANK FABIANI, ESQ.
`·6· · · · · · · frank.fabiani@bryancave.com
`· · · · · ·For the Petitioner, Symantec Corporation
`·7
`·8
`· · · · · ·KRAMER LEVIN NAFTALIS & FRANKEL LLP
`·9· · · · ·990 Marsh Road
`· · · · · ·Menlo Park, California· 94025-1949
`10· · · · ·BY:· MICHAEL LEE, ESQ.
`· · · · · · · · mhlee@kramerlevin.com
`11· · · · ·For the Patent Owner, Finjan, Inc.
`12
`13· · · · ·WILSON SONSINI GOODRICH & ROSATI
`· · · · · ·701 Fifth Avenue, Suite 5100
`14· · · · ·Seattle, WA 98104-7036
`· · · · · ·BY:· ANDREW S. BROWN, ESQ. (via telephone)
`15· · · · · · · asbrown@wsgr.com
`· · · · · ·For the Petitioner, Blue Coat Systems
`16
`17
`· · ·ALSO PRESENT:
`18
`· · · · · ·JUAN TORRES, Videographer
`19
`20
`21
`22
`23
`24
`25
`
`·1· · · · · · · · · · · ·I N D E X
`
`·2
`
`· · ·WITNESS· · · · · · · · · · · · · · · · · · ·PAGE
`
`·3
`
`·4· ·JACK W. DAVIDSON
`
`·5· · ·Examination by Mr. Lee.......................4
`
`·6
`
`·7
`
`·8
`
`·9
`
`10
`
`11
`
`12· · · · · · · · · ·E X H I B I T S
`
`13· ·NUMBER· · · · · · DESCRIPTION· · · · · · · · · ·PAGE
`
`14
`
`· · ·Exhibit 1 Declaration of Jack W. Davidson.........5
`
`15
`
`· · ·Exhibit 2 The Flat File Database Generator Ffg....8
`
`16
`
`· · ·Exhibit 3 Document entitled "cql - A Flat File
`
`17· · · · · · ·Database Query Language"................8
`
`18· ·Exhibit 4 Document entitled "An Intrusion-
`
`· · · · · · · ·Detection Model"........................8
`
`19
`
`· · ·Exhibit 5 Patent Number 6,092,194................84
`
`20
`
`· · ·Exhibit 6 Dynamic Detection and Classification
`
`21· · · · · · ·of Computer Viruses Using General
`
`· · · · · · · ·Behaviour Patterns.....................92
`
`22
`
`23
`
`24
`
`25
`
`Page 2
`
`Page 4
`·1· · · · · · · · ·THE VIDEOGRAPHER:· The time is
`·2· ·10:08 a.m. on November 2nd, 2016 and this begins
`·3· ·media number 1 of the video deposition of
`·4· ·Mr. Jack Davidson in the matter Symantec Corp.
`·5· ·and Blue Coat Systems, Inc. versus Finjan, Inc.
`·6· · · · · · · · ·My name is Juan Torres and I am
`·7· ·the senior legal video specialist with U.S.
`·8· ·Legal Support.· The court reporter today is
`·9· ·Nancy Bendish.
`10· · · · · · · · ·Will counsel please introduce
`11· ·themselves beginning with the party noticing
`12· ·this proceeding.
`13· · · · · · · · MR. LEE:· Michael Lee from Kramer
`14· ·Levin representing Finjan.
`15· · · · · · · · MR. WALDEN:· Alex Walden from
`16· ·Bryan Cave, representing Symantec.
`17· · · · · · · · MR. FABIANI:· Frank Fabiani, also
`18· ·from Bryan Cave, representing Symantec.
`19· · · · · · · · MR. BROWN:· Andy Brown of Wilson
`20· ·Sonsini representing petitioner Blue Coat.
`21· · · · · · · · THE VIDEOGRAPHER:· Will the court
`22· ·reporter swear in the witness.
`23· ·J A C K· ·W.· ·D A V I D S O N, sworn.
`24· ·EXAMINATION BY MR. LEE:
`25· · · · ·Q.· · ·Please spell your full name and
`
`Page 3
`
`Page 5
`
`·1· ·address for the record.
`·2· · · · ·A.· · ·Jack, J-a-c-k, W, Davidson,
`·3· ·D-a-v-i-d-s-o-n.
`·4· · · · ·Q.· · ·Do you understand why you're here
`·5· ·today, Dr. Davidson?
`·6· · · · ·A.· · ·Yes, I do.
`·7· · · · ·Q.· · ·Why are you here today?
`·8· · · · ·A.· · ·I'm here to testify on behalf of
`·9· ·Symantec as an expert witness, my analysis of
`10· ·the '494 patent.
`11· · · · ·Q.· · ·Is this for IPR2015-01892?
`12· · · · ·A.· · ·I believe it is.· I don't have the
`13· ·number in front of me but, yes, it's an IPR.
`14· · · · · · · · (Exhibit 1 marked for
`15· ·identification.)
`16· · · · ·Q.· · ·I'm handing you an exhibit marked
`17· ·Exhibit No. 1.· Exhibit No. 1 is entitled
`18· ·"Declaration of Jack W. Davidson in Support of
`19· ·Petitioner Pursuant to 37 CFR section 42.120"
`20· ·and it's labeled Symantec 1027, IPR2015-01892.
`21· · · · · · · · Do you recognize Exhibit No. 1?
`22· · · · ·A.· · ·Yes, I do.
`23· · · · ·Q.· · ·What is Exhibit No. 1?
`24· · · · ·A.· · ·This is my declaration in support
`25· ·of the petitioner, second response, kind of
`
`Patent Owner Finjan, Inc. - Ex. 2041, p. 2
`
`

`
`Page 6
`
`·1· ·following Dr. Medvidovic's declaration or
`·2· ·testimony.
`·3· · · · ·Q.· · ·So this is your second declaration
`·4· ·for this proceeding, correct?
`·5· · · · ·A.· · ·That's correct.
`·6· · · · ·Q.· · ·Can you go to page 69.· Is that
`·7· ·your signature on page 69 of Exhibit 1?
`·8· · · · ·A.· · ·Yes, that is my signature.
`·9· · · · ·Q.· · ·Did you sign Exhibit No. 1 on
`10· ·September 16th, 2016?
`11· · · · ·A.· · ·Yes, I did.
`12· · · · ·Q.· · ·Was it your understanding that as
`13· ·of September 16th, 2016 you're supposed to put
`14· ·in to your declaration all the opinions you had
`15· ·in this case?
`16· · · · ·A.· · ·I'm sorry, say the last part.· All
`17· ·of the what?
`18· · · · ·Q.· · ·All of the opinions that you had
`19· ·in this case?
`20· · · · ·A.· · ·Yes.· I worked with the counsel
`21· ·here to make sure that I covered all the
`22· ·relevant points.
`23· · · · ·Q.· · ·As you sit here on November 2nd,
`24· ·2016, is there anything concerning the bases of
`25· ·your opinion that are not included in Exhibit
`
`Page 8
`·1· ·we've been in contact and working over that
`·2· ·period of time back and forth.
`·3· · · · ·Q.· · ·Would you say it was sometime
`·4· ·around August 2016?
`·5· · · · ·A.· · ·I think that's right, partly
`·6· ·because, you know, part of the timestamp for me
`·7· ·is I was in a big competition that was held at
`·8· ·the beginning of August, and up until that time
`·9· ·I was busy.· So basically it was only after, you
`10· ·know, that that -- in fact, I remember Frank,
`11· ·Mr. Fabiani contacted me and congratulated me on
`12· ·where we, you know, had finished in this
`13· ·competition.· So I think that is where I had
`14· ·been -- you know, kind of the middle of August,
`15· ·late August, after that.· The competition was
`16· ·August 4th and so I was pretty much tied up with
`17· ·that until then.
`18· · · · · · · · (Exhibit 2, Exhibit 3 and Exhibit 4
`19· ·marked for identification.)
`20· · · · ·Q.· · ·The court reporter handed you
`21· ·three exhibits.
`22· · · · ·A.· · ·Yes.
`23· · · · ·Q.· · ·Exhibit number 2 is entitled "The
`24· ·Flat File Database Generator Ffg."· Exhibit
`25· ·number 3 is entitled "cql - A Flat File Database
`
`Page 7
`
`Page 9
`
`·1· ·No. 1?
`·2· · · · ·A.· · ·No.· I mean, I think there are
`·3· ·some typos in here, when I was going back over
`·4· ·it, but other than that, these are my opinions.
`·5· · · · ·Q.· · ·When did you -- strike that.
`·6· · · · · · · · Did you write your declaration?
`·7· · · · ·A.· · ·I worked with, you know, counsel,
`·8· ·Mr. Walden and Mr. Fabiani, to write it, worked
`·9· ·with them on structuring the arguments and
`10· ·providing analysis.· You know, we worked
`11· ·together to write it.· We carefully went over
`12· ·it, made sure that it was exactly what I, you
`13· ·know, my opinions, that I agreed with all the
`14· ·arguments.
`15· · · · ·Q.· · ·When did you start working with
`16· ·counsel on your declaration?
`17· · · · ·A.· · ·You know, I couldn't tell you the
`18· ·exact date.· We've been working on it, you know,
`19· ·once we got the deposition of Dr. Medvidovic.
`20· · · · ·Q.· · ·Medvidovic.
`21· · · · ·A.· · ·Say it again.
`22· · · · ·Q.· · ·I believe it's pronounced
`23· ·Medvidovic.
`24· · · · ·A.· · ·Medvidovic, thank you.· But, yeah.
`25· ·But, you know, I can't recall the exact date but
`
`·1· ·Query Language."· And exhibit number 4 is
`·2· ·entitled "An Intrusion-Detection Model."
`·3· · · · · · · · Do you recognize these three
`·4· ·exhibits?
`·5· · · · ·A.· · ·Yes, I do.
`·6· · · · ·Q.· · ·What are these three exhibits?
`·7· · · · ·A.· · ·These three exhibits are things
`·8· ·that are referenced in my declaration.· And so
`·9· ·they're included here because I rely on them for
`10· ·some of the analysis that I did.· These would, I
`11· ·think, be categorized as prior art.
`12· · · · ·Q.· · ·These are only referenced in your
`13· ·2016 declaration, correct?
`14· · · · ·A.· · ·I believe that's correct, yes.
`15· ·That's only in the declaration that I have here,
`16· ·Symantec 1027.
`17· · · · ·Q.· · ·Could you have cited Exhibits 2
`18· ·through 4 in your previous declaration that you
`19· ·on September 15th, 2015?
`20· · · · · · · · MR. WALDEN:· Objection, form.
`21· · · · ·A.· · ·The reason -- I could have, but
`22· ·the reason that they're cited here is that, you
`23· ·know, this is based on looking at patent owner's
`24· ·response and I'm going to say, you know, if it's
`25· ·okay with you I'm just going to say Dr. M, Dr.
`
`Patent Owner Finjan, Inc. - Ex. 2041, p. 3
`
`

`
`Page 10
`·1· ·M's declaration.· So, you know, it was based on
`·2· ·looking at that and formulating this declaration
`·3· ·in response to that.
`·4· · · · ·Q.· · ·So you could have cited and
`·5· ·described Exhibits 2 through 4 in your previous
`·6· ·declaration?
`·7· · · · ·A.· · ·Certainly the Denning, you know,
`·8· ·reference I was certainly familiar with.· I know
`·9· ·Dorothy, I know Doug.· Again, they seemed --
`10· ·when they were looking at the patent owner
`11· ·response in Dr. M's declaration it was like,
`12· ·okay, this will help explain, you know, some of
`13· ·the terms being used and again, you know, prior
`14· ·art.
`15· · · · ·Q.· · ·So you were aware of these three
`16· ·references on September --
`17· · · · ·A.· · ·I was not aware of the Glen Fowler
`18· ·one.· This is one that I think Symantec, you
`19· ·know, in the process of understanding what a
`20· ·flat file database is, that they came up with.
`21· ·So that was not one that I was aware of.
`22· · · · ·Q.· · ·So you were aware of the Comer
`23· ·reference and the Denning reference as of
`24· ·September 15th, 2015?
`25· · · · ·A.· · ·Is that September -- yeah, I mean,
`
`Page 12
`·1· ·you know, whether a relational database would
`·2· ·have been obvious.· That's what the Denning
`·3· ·reference, which is referenced by Swimmer.· So
`·4· ·these then seem to become more important and
`·5· ·worth, you know, including.
`·6· · · · ·Q.· · ·Just so the record is clear, is it
`·7· ·okay if we refer to your previous declaration as
`·8· ·the 2015 declaration and the current one as the
`·9· ·2016 declaration?
`10· · · · ·A.· · ·Okay.· So when I say included, I
`11· ·was saying included in my 2016, you know, the
`12· ·one signed on September 16th.
`13· · · · ·Q.· · ·So the Denning and Comer
`14· ·references are only cited in your 2016
`15· ·declaration, but you were aware of them as of
`16· ·2015, correct?
`17· · · · ·A.· · ·Yeah.· I've been aware -- again,
`18· ·these are, like I said, I know these people so
`19· ·I'm familiar with their work over the years.
`20· · · · ·Q.· · ·So therefore you could have cited
`21· ·the Comer and Denning reference in your 2015
`22· ·declaration, correct?
`23· · · · · · · · MR. WALDEN:· Objection, form.
`24· · · · ·A.· · ·I, you know, could have but we
`25· ·decided not to.· Again, this is something I
`
`Page 11
`·1· ·at the time of the -- you know, the declaration,
`·2· ·yes.· These are referenced in my declaration.
`·3· · · · ·Q.· · ·The previous declaration.
`·4· · · · ·A.· · ·Oh, I'm sorry, you're talking
`·5· ·about not this current one?
`·6· · · · ·Q.· · ·Correct.
`·7· · · · ·A.· · ·Yeah.· I mean, like I said, I
`·8· ·worked in, you know, these areas and so these
`·9· ·are things that, you know, in the past, you
`10· ·know, I teach in this area.· And so these are
`11· ·things that, you know, where I know Doug Comer,
`12· ·so I'm familiar with his work.
`13· · · · · · · · At some point when this became
`14· ·relevant I was like, oh, okay, here's some prior
`15· ·art that based on the patent owner's response
`16· ·and the declaration that would be relevant for
`17· ·my subsequent declaration.
`18· · · · ·Q.· · ·They weren't relevant before?
`19· · · · · · · · MR. WALDEN:· Object to the form.
`20· · · · ·A.· · ·I think, you know, they're
`21· ·relevant but I didn't reference them in my
`22· ·declaration.· Partly it's to, in terms of making
`23· ·sure that people understand the terms.· I think
`24· ·in these -- two of these cases we're talking
`25· ·about, you know, what a flat file database is,
`
`Page 13
`·1· ·worked with counsel on deciding what references
`·2· ·to include.· You know, I think there's some
`·3· ·desire to not have a huge number of references
`·4· ·in these things, and so you decide -- I mean,
`·5· ·again, I think this is part of the decision
`·6· ·process, but I definitely rely on counsel in
`·7· ·terms of, you know, what to include and not
`·8· ·include.
`·9· · · · ·Q.· · ·Can you go to paragraph 8 of
`10· ·Exhibit 1.
`11· · · · ·A.· · ·Paragraph 8.
`12· · · · ·Q.· · ·Do you see where you state, "In my
`13· ·opinion, the term 'storing' is well understood
`14· ·by those of ordinary skill in the art and
`15· ·requires no further construction"?
`16· · · · ·A.· · ·I do.
`17· · · · ·Q.· · ·What is the well understood
`18· ·meaning of the term "storing"?
`19· · · · ·A.· · ·Storing is putting information in
`20· ·a storage, you know, to save information in some
`21· ·kind of medium.· It could be, you know, RAM or
`22· ·disk, file, nonvolatile memory, but it's putting
`23· ·information somewhere potentially, you know, for
`24· ·retrieval or manipulation later.
`25· · · · ·Q.· · ·What do you mean by putting
`
`Patent Owner Finjan, Inc. - Ex. 2041, p. 4
`
`

`
`Page 14
`
`Page 16
`
`·1· ·information?
`·2· · · · ·A.· · ·So, storage devices you would
`·3· ·write information.· So like, for instance, the
`·4· ·declaration has definition of storage device, or
`·5· ·write from main memory, there would be a store
`·6· ·instruction that would place a data in, let's
`·7· ·say, a memory location or a register.· And it's
`·8· ·common, we store this information in this
`·9· ·location.· We stored it in this file.
`10· · · · ·Q.· · ·How is saving something in a file
`11· ·or storing something in a file different from
`12· ·creating a file?
`13· · · · ·A.· · ·Different from creating a file?
`14· · · · ·Q.· · ·Yes.
`15· · · · ·A.· · ·So, you could create a file and
`16· ·not put anything in it.· So, you know, creating,
`17· ·kind of creates kind of the, I'll call it the
`18· ·logical kind of structure.· But it may not
`19· ·have -- you may not have stored any information
`20· ·in it yet.
`21· · · · ·Q.· · ·What's required to store
`22· ·information in a file?
`23· · · · ·A.· · ·What's required?· I mean,
`24· ·typically there would be some operation.· For
`25· ·instance, on a machine there are what we often
`
`·1· ·information in the storage unit.
`·2· · · · ·Q.· · ·So how is the storing operation
`·3· ·different from the creating operation?
`·4· · · · · · · · MR. WALDEN:· Object to the form.
`·5· · · · ·A.· · ·So, the creating, you can create
`·6· ·data, you know, but to manipulate the data in a
`·7· ·modern, in fact in a machine, it's in a storage
`·8· ·device.· It may be like, for instance, adding
`·9· ·something that's going to create a sum, but in
`10· ·the process of doing that, that result is
`11· ·stored.
`12· · · · · · · · So they're kind of, you know, we
`13· ·distinguish them in terms of we're talking about
`14· ·the operation, but they're again always
`15· ·manipulating storage elements.
`16· · · · ·Q.· · ·Can you go to paragraph 10 of
`17· ·Exhibit No. 1.
`18· · · · ·A.· · ·Yes.
`19· · · · ·Q.· · ·Do you see where you talk about a
`20· ·"stream of data"?
`21· · · · ·A.· · ·Yes.· On page 4.
`22· · · · ·Q.· · ·Is a stream of data in Swimmer the
`23· ·same thing as Swimmer's audit trail, or are you
`24· ·talking about something different?
`25· · · · ·A.· · ·So, this term "stream of data,"
`
`Page 15
`·1· ·call store instruction or sometimes they're
`·2· ·called move instructions where you move a piece
`·3· ·of data from one storage element to another or
`·4· ·you move it, you know, from a register, which is
`·5· ·also being stored.
`·6· · · · · · · · So there's some operation in terms
`·7· ·of, let's say, a file on disk.· The operation
`·8· ·would be a write operation, which would write
`·9· ·some data into, you know, to that file.
`10· · · · · · · · Again, there's underlying
`11· ·mechanisms that are happening in terms of, you
`12· ·know, depending on the device, how that
`13· ·information is actually, you know, stored in
`14· ·that device.
`15· · · · · · · · In the case of a disk, there are
`16· ·two kinds of, you know, storage devicing.
`17· ·There's kind of the magnetic one.· There's a
`18· ·storing the bits in terms of magnetization, and
`19· ·now we have these things called SSD, solid state
`20· ·devices, which it's much more like storing in
`21· ·a -- it's not a transistor, but in a kind of
`22· ·capacitor kind of way.
`23· · · · · · · · So anyway, there's an operation
`24· ·that takes place, writes or moves, depending on
`25· ·what level you're talking about that puts that
`
`Page 17
`·1· ·yeah.· What's happening is there's -- in terms
`·2· ·of Swimmer, the emulator is emulating the
`·3· ·downloadable and observing, you know, and then
`·4· ·writing to the audit trail, the suspicious
`·5· ·operations which are, in this case, the
`·6· ·operating -- typically the operating system
`·7· ·commands.
`·8· · · · ·Q.· · ·So just to be clear, I'm asking
`·9· ·about two terms, Swimmer's stream of data and
`10· ·then another term in Swimmer called the audit
`11· ·trail.· My question is, are you saying that
`12· ·these two are completely different from each
`13· ·other?
`14· · · · ·A.· · ·No.· The stream of data that the
`15· ·emulator is producing and then, you know, is
`16· ·stored, it's stored in the audit trail.
`17· · · · · · · · So there's this process of
`18· ·emulating and that's creating this, determining
`19· ·this data that then is stored in the audit
`20· ·trail.
`21· · · · ·Q.· · ·In your opinion, how is a stream
`22· ·of data different from Swimmer's audit trail?
`23· · · · ·A.· · ·The stream of data is what's being
`24· ·stored in audit trail, it's being created, you
`25· ·know, by the emulator and stored in the audit
`
`Patent Owner Finjan, Inc. - Ex. 2041, p. 5
`
`

`
`Page 18
`·1· ·trail.· So in that, you know -- I mean, what's
`·2· ·being stored is what's being created.· It's
`·3· ·being created and then stored.
`·4· · · · ·Q.· · ·What type of data structure is a
`·5· ·stream of data?
`·6· · · · · · · · MR. WALDEN:· Object to the form.
`·7· · · · ·A.· · ·You know, it's, you know, it could
`·8· ·be many different things.· I think in the case
`·9· ·of Swimmer it's the data that's being determined
`10· ·by, you know, the emulator that they're using to
`11· ·emulate the downloadable.· That's the -- and we
`12· ·call it a stream because basically as each
`13· ·operation is performed that, you know, data is
`14· ·being created.· And it is depending on if it's
`15· ·determined to be a potentially suspicious
`16· ·operation and it's written to the audit trail.
`17· · · · ·Q.· · ·Isn't Swimmer's stream of data in
`18· ·the form of a file?
`19· · · · ·A.· · ·The audit trail is in the form of
`20· ·a file.
`21· · · · ·Q.· · ·How about the stream of data?
`22· · · · ·A.· · ·Again, in terms of Swimmer, you
`23· ·know, you kind of distinguish between this data
`24· ·has to be created, it has to be derived and
`25· ·then, you know, written to the audit trail.· And
`
`Page 20
`·1· · · · ·A.· · ·It's what we call a flat file
`·2· ·database.· It's basically a way of representing
`·3· ·a table.· You know, a table is basically a set
`·4· ·of records or rows where the columns are, you
`·5· ·know, particular attributes that you're
`·6· ·interested in.· So that's the kind of file that
`·7· ·you're logging, so it's a flat file database.
`·8· · · · ·Q.· · ·So just to be clear, a flat file
`·9· ·database is a file?
`10· · · · ·A.· · ·Yeah.· It's stored on disk as a
`11· ·file, yes.· It's kind of implied by the name
`12· ·flat file database.
`13· · · · ·Q.· · ·How about flat file, is that a
`14· ·file as well?
`15· · · · ·A.· · ·It says file, so I'm going to
`16· ·assume, yes, it's a file.· It's basically --
`17· ·when you say file, the normal kind of, one
`18· ·skilled in the art would think of, you know,
`19· ·that's stored somewhere.· Typically on a disk,
`20· ·but you could have kind of an in-core or
`21· ·in-memory file as well.· It's kind of an
`22· ·aggregate of data.
`23· · · · ·Q.· · ·So a flat file and a flat file
`24· ·database are both files.· What's the difference
`25· ·between those two?
`
`Page 19
`·1· ·so the audit trail, you know, would distinguish
`·2· ·like when something is created and then it's
`·3· ·stored in this audit trail, which is a file.
`·4· · · · ·Q.· · ·So in what form is Swimmer's
`·5· ·stream of data?
`·6· · · · ·A.· · ·It's internally in the emulator,
`·7· ·they're again storing information as they're
`·8· ·emulating this downloadable and emulating the
`·9· ·instructions that are being, you know, done.
`10· ·They're keeping track of the operations, they're
`11· ·keeping track of the arguments.· And so that's
`12· ·being created, that's the stream of data.· And
`13· ·then it's being written to the audit trail.
`14· · · · ·Q.· · ·Just to be clear, the stream of
`15· ·data is different from an audit trail in your
`16· ·opinion, correct?
`17· · · · · · · · MR. WALDEN:· Objection, form.
`18· · · · ·A.· · ·The stream of data is being
`19· ·created and then, you know, what that is, it's
`20· ·being written to the audit trail.
`21· · · · ·Q.· · ·Previously you said that Swimmer's
`22· ·audit trail is in the form of a file, correct?
`23· · · · ·A.· · ·That's correct.
`24· · · · ·Q.· · ·Can you elaborate what type of
`25· ·file?
`
`Page 21
`·1· · · · · · · · MR. WALDEN:· Object to the form.
`·2· · · · ·A.· · ·So, the difference is, you know,
`·3· ·how the data is organized.· In a flat file
`·4· ·database the data is organized according to a
`·5· ·table.· A table we can think of kind of rows and
`·6· ·columns kind of things.· And so they're
`·7· ·individual rows or records, and within a record
`·8· ·there are fields or atts, sometimes we call
`·9· ·them, attributes that mean specific things.· So
`10· ·there's a logical structure there.
`11· · · · ·Q.· · ·How about a flat file?
`12· · · · ·A.· · ·You know, without more context, I
`13· ·mean, when you say what about, I'm not sure what
`14· ·you're asking.
`15· · · · ·Q.· · ·How is a flat file different?
`16· · · · ·A.· · ·You know, I think if you said flat
`17· ·file and didn't distinguish it in any way, you
`18· ·wouldn't know what kind of logical organization
`19· ·there was, if any.· There might be but, you
`20· ·know, it's not being specified.
`21· · · · ·Q.· · ·Any other differences between a
`22· ·flat file and a flat file database?
`23· · · · · · · · MR. WALDEN:· Object to the form.
`24· · · · ·A.· · ·No, I think the main one is that
`25· ·there's this, you know, logical structure in
`
`Patent Owner Finjan, Inc. - Ex. 2041, p. 6
`
`

`
`Page 22
`·1· ·terms of it's organized as a table with, you
`·2· ·know, records.· You can kind of think of those
`·3· ·as rows and columns where each column represents
`·4· ·a particular attribute.
`·5· · · · ·Q.· · ·So a flat file does not have this
`·6· ·logical structure, correct?
`·7· · · · ·A.· · ·Well, like I said, without knowing
`·8· ·more about it, you said flat file.· Nothing is
`·9· ·being conveyed there that would tell you one way
`10· ·or the other, so I can't really answer, give you
`11· ·an answer.
`12· · · · · · · · It could be.· I mean, it could be,
`13· ·you know, have a particular structure to it.
`14· ·It's just when you say flat file, it's just a
`15· ·file really.
`16· · · · ·Q.· · ·If a flat file does have a logical
`17· ·structure, then is that flat file a flat file
`18· ·database?
`19· · · · ·A.· · ·I'd have to know what the
`20· ·structure.· Again, a flat file database, the
`21· ·particular structure is a table.· Again, it's
`22· ·impossible when you say flat file, you know, to
`23· ·know how it might be organized, if at all.
`24· · · · ·Q.· · ·In your opinion a flat file
`25· ·database is in the form of a file; is that
`
`Page 24
`
`·1· ·of information from another."
`·2· · · · · · · · So that thing where I said it's
`·3· ·kind of an aggregate that's being collected
`·4· ·together.
`·5· · · · ·Q.· · ·So in your opinion a file means a
`·6· ·basic unit of storage, correct?
`·7· · · · · · · · MR. WALDEN:· Objection, form.
`·8· · · · ·A.· · ·Yeah, it's one of the basic units
`·9· ·used in computer.· We store information in
`10· ·files.· Your phone, your contacts databases
`11· ·typically are stored in a file on disk.· That's
`12· ·important because it's nonvolatile storage.· So
`13· ·you power off your phone and you come back, turn
`14· ·it on, your contacts are still in that contacts
`15· ·file.
`16· · · · ·Q.· · ·Is an NADF file in the form of a
`17· ·file?
`18· · · · ·A.· · ·Yes.
`19· · · · ·Q.· · ·Is an NADF file the same thing as
`20· ·an audit trail in Swimmer?
`21· · · · ·A.· · ·It's a converted form of the audit
`22· ·trail.· It's going to be called, I think the
`23· ·term is normalized audit data file.· So it has a
`24· ·slightly different, you know, format, but the
`25· ·information contained in an NADF file is the
`
`Page 23
`
`·1· ·correct?
`·2· · · · ·A.· · ·A flat file database is, kind of
`·3· ·the name indicates is, you know, yes, a file
`·4· ·that's stored, typically stored on disk or in
`·5· ·some storage medium.
`·6· · · · ·Q.· · ·How about relational databases;
`·7· ·are they in the form of a file as well?
`·8· · · · ·A.· · ·Typically a relational database
`·9· ·would be stored on disk and, you know, typically
`10· ·here may be a set of files.
`11· · · · ·Q.· · ·In your opinion are all databases
`12· ·in the form of files?
`13· · · · ·A.· · ·As I said, you know, depending on
`14· ·how you want to think of a file, you think of a
`15· ·file being -- you can actually have something in
`16· ·memory but, again, the logical organization
`17· ·would typically be a file and that would be how
`18· ·you would manipulate it.· It's through kind of
`19· ·what I call potentially file operations.· But it
`20· ·depends on where it's stored.
`21· · · · ·Q.· · ·When you use the term "file," can
`22· ·you elaborate what you mean by the term "file"?
`23· · · · ·A.· · ·I think there's a definition here,
`24· ·on page 7.· "A file is the basic unit of storage
`25· ·that enables a computer to distinguish one set
`
`Page 25
`·1· ·same as what was, you know, would be in an audit
`·2· ·trail file.· They're semantically equivalent and
`·3· ·they have exactly the same information.
`·4· · · · ·Q.· · ·Can you explain what you mean by a
`·5· ·normalized audit trail.
`·6· · · · ·A.· · ·In terms of, you know, Swimmer,
`·7· ·yeah, the audit trail is sometimes called the
`·8· ·native audit trail or audit file.· And there
`·9· ·it's actually the recording of, again, the
`10· ·operating system calls that are being made, you
`11· ·know, the suspicious operations.
`12· · · · · · · · In order to kind of achieve some
`13· ·generality, you know, across maybe let's say
`14· ·different operating systems, what they do is
`15· ·they map the operations, the operating system
`16· ·calls from the native operating system calls to
`17· ·kind of a more uniform, universal, you know,
`18· ·numbering.· And that way if you had another
`19· ·operating system, let's say Unix, and the system
`20· ·calls there had a different numbering, they're
`21· ·then kind of mapped similar to the same
`22· ·universal set of numbers.
`23· · · · · · · · And this is nice from the
`24· ·standpoint of then the, you know, security
`25· ·system that's then processing this security
`
`Patent Owner Finjan, Inc. - Ex. 2041, p. 7
`
`

`
`Page 26
`·1· ·profile would work whether the profile came
`·2· ·from, say, a Unix system or, say, Windows MS-DOS
`·3· ·or Windows 32.· So it's kind of a translation
`·4· ·that's done to kind of achieve this kind of
`·5· ·uniformity.· That way I don't have to change my
`·6· ·rules for detecting whether, you know, a
`·7· ·downloadable is actually hostile.· That set of
`·8· ·rules should, you know, essentially be the same
`·9· ·on both operating systems.
`10· · · · · · · · So it's kind of a standard
`11· ·technique that we do in computer science to
`12· ·avoid having to create additional programs.
`13· ·That way, you know, one program can process the
`14· ·list of operations that we're examining, no
`15· ·matter whether it came from MS-DOS, Windows 32,
`16· ·Windows XP or, let's say, Unix or VSD Unix,
`17· ·different operating systems.
`18· · · · ·Q.· · ·Would you agree that normalizing
`19· ·means to standardize?
`20· · · · ·A.· · ·Well, again, in the case of
`21· ·Swimmer, what it means is we're gonna remap
`22· ·those operating system numbers to kind of a
`23· ·uniform thing that's operating system
`24· ·independent.· And that way, like I said, the
`25· ·security system doesn't need to, you know,
`
`Page 28
`·1· ·here.· Again, if that -- well, anyway, that's
`·2· ·exactly what's happening.
`·3· · · · ·Q.· · ·Does normalized mean to convert
`·4· ·data from one format to another?
`·5· · · · · · · · MR. WALDEN:· Objection, form.
`·6· · · · ·A.· · ·I wouldn't say it necessarily
`·7· ·means convert, you know, data from one format to
`·8· ·another.· I mean, again, it could but, again, in
`·9· ·terms of the Swimmer patent, the point is that
`10· ·there's this renumbering going on.· It could be
`11· ·in a different format, but all of the same
`12· ·information, you know, is there.
`13· · · · ·Q.· · ·In your opinion converting is no
`14· ·different from storing, correct?
`15· · · · ·A.· · ·Converting is no different from
`16· ·storing?· Well, in the process of converting,
`17· ·that certainly would be storing information. I
`18· ·mean, if you're referring to storing in terms of
`19· ·running through the audit trail, those are kind
`20· ·of separate operations.
`21· · · · · · · · But, you know, to do any kind of
`22· ·processing in a computer is going to involve
`23· ·storing information at one level or another,
`24· ·potentially in the registers.· If I add two
`25· ·things, I have to store the results somewhere.
`
`Page 27
`
`·1· ·concern itself of which, you know, which
`·2· ·operating system these things came from.
`·3· · · · · · · · So, in terms of, you know, kind of
`·4· ·the information that's there, it's actually the
`·5· ·same information.· It's just kind of been
`·6· ·remapped.
`·7· · · · ·Q.· · ·So you would not agree that
`·8· ·normalizing means standardized?
`·9· · · · ·A.· · ·I'm not sure what you mean by
`10· ·standardized.· I explained what in the context
`11· ·of Swimmer what's happening here.· And I think
`12· ·you know Swimmer explains it as well.· I mean,
`13· ·it's this mapping of the system calls.
`14· · · · · · · · It's kind of a renumbering, a
`15· ·uniform renumbering across operating systems.
`16· ·Because the operating system calls the
`17· ·numbering -- typically the way you do an
`18· ·operating system call, there's a number, oh,
`19· ·okay, we're going to do an open.· On MS-DOS that
`20· ·might be, you know, system call 23.· The open on
`21· ·Unix might be system call, the number might be
`22· ·42.· And what we're doing is basically, you
`23· ·know, kind of taking those and creating a single
`24· ·numbering that works across those.
`25· · · · · · · · So that's what normalized means
`
`Page 29
`·1· · · · ·Q.· · ·So in your opinion does converting
`·2· ·necessarily require storing in a database?
`·3· · · · ·A.· · ·Does converting require storing in
`·4· ·a database?· You could convert something and
`·5· ·store it in some other entity if you wanted to.
`·6· ·In terms of Swimmer, the conversion is they're
`·7· ·writing it to a file, you know, flat file
`·8· ·database.· But certainly that's specific to what
`·9· ·Swimmer teaches.
`10· · · · ·Q.· · ·In your opinion the Swimmer's
`11· ·audit trail is a flat file database, correct?
`12· · · · ·A.· · ·That's correct.
`13· · · · ·Q.· · ·Is it also your opinion that
`14· ·Swimmer's NADF file is also a flat file
`15· ·database?
`16· · · · ·A.· · ·Yes.
`17· · · · ·Q.· · ·So, Swimmer converts an audit
`18· ·trail in the form of a flat file database to
`19· ·another flat file database?
`20· · · · ·A.· · ·That's correct.
`21· · · · ·Q.· · ·What's the purpose of converting a
`22· ·flat file database into another flat file
`23· ·database?
`24· · · · ·A.· · ·Well, as I explained, the reason
`25· ·he wants to do this is to create something that
`
`Patent Owner Finjan, Inc. - Ex. 2041, p. 8
`
`

`
`Page 30
`·1· ·works, in terms of in the application that then