`
`8,141,154
`
`The statements and documents cited below are solely provided by way of example and based on information
`available to Finjan, Inc. at the time this chart was created, and not to be used by way of limitation or for
`purposes of construing the claim terms. Finjan reserves its right to supplement this chart as additional
`information becomes known to it.
`
`For purposes of this chart, “Websense Products” refers to the following Websense applications or services:
`TRITON Products, Web Security Gateway Products, Data Security Products, the CyberSecurity Intelligence (“CSI”)
`Service and the ThreatSeeker Intelligence Cloud Service. See http://www.websense.com/content/websense‐
`products.aspx (explaining that while Websense appliances/products come in different forms or series, each
`Websense product is “built on the unified Websense TRITON® architecture, and use key Websense technologies
`including Websense ACE (Advanced Classification Engine) and the Websense ThreatSeeker® Intelligence Cloud.”)
`Claim 1
`
`
`1a. A system for protecting a
`computer from dynamically
`generated malicious content,
`comprising: a content
`processor (i) for processing
`content received over a
`network, the content
`including a call to a first
`function, and the call
`including an input, and (ii) for
`invoking a second function
`with the input, only if a
`security computer indicates
`that such invocation is safe;
`
`Websense Products meet the recited claim language because they provide a
`system with a content processor for processing content received over a
`network, the content including a call to a first function, and the call including an
`input, and for invoking a second function with the input, only if a security
`computer indicates that such invocation is safe .
`
`By the way of example, and not limitation, Websense Products meet the recited
`claim language because Websense Products provide ACE defense, including Real‐
`time Security Classification (RTSC), Real‐time Content Classification (RTCC), Anti‐
`Malware Engines and Behavioral Sandboxing to dynamically analyze “lures” and
`“redirects” to sites containing exploit kits, exploit code, obfuscated scripts within
`web content, to prevent delivery of a payload or dropper from another server as
`well as “call home” commands to a command and control server to download
`additional dynamically generated content using ACE in the Cloud (which provides
`data and content analysis of: web page content, active scripts, exploit code,
`obfuscated commands, web redirects, malicious files, PDFs and executables),
`Websense® Cloud Web Security (which analyzes all inbound and outbound traffic
`blocking malware and uses security analysis from Websense ACE and Websense
`ThreatSeeker Intelligence Cloud to defend against malware and blended
`threats), Websense ThreatSeeker Cloud (which collects content such as
`webpages, documents, executables, streaming media, emails, mobile
`applications and other internet traffic; and then applies it to analysis, in the
`cloud sandboxing and application profiling), Websense® Web Security Gateway
`Anywhere or Websense® TRITON® Security Gateway Anywhere (which work in
`conjunction with ThreatSeeker, ACE and CSI) .
`
`This is demonstrated in Websense’s public documents and at
`http://www.websense.com/content/websense‐triton‐security‐products.aspx
`and http://www.websense.com/content/support.aspx.
`
`For example, in a white paper describing the ACE system, various components
`provide dynamic analysis of web content. A computer attempts to access web
`
`Page 1 of 35
`
`
`
`
`
`content with that input sent to the ACE system, the content processor. If the
`ACE system determines the web content to be safe, the computer is able to load
`the web content. http://www.websense.com/assets/white‐papers/whitepaper‐
`ace‐security‐overview‐en.pdf at p. 3 (“As threats have become more dynamic,
`ACE applies machine learning and other dynamic capabilities to proactively
`defeat these attacks through the seven stages of advanced threats. ACE is a key
`real‐time defense engine used inline within Websense gateways and cloud
`security services.”). For example, Real‐time Security Classification (RTSC) and
`Real‐time Content Classification (RTCC) provide real time analysis of web content
`to search for malicious content. Id. at pp. 3‐6, 8‐9 (“Real‐Time Security
`Classification. Empowers social web controls, and inspects all web content for
`malicious or suspicious code such as open or obfuscated scripts, exploit code and
`iframe tags.” “RTCC examines embedded links to other pages, content with
`embedded scripts, streaming media, and file downloads to identify potential
`threats.”). Part of the functionality of ACE is to analyze suspicious code and
`determine if it includes malicious content within other files such as PDF, SWF,
`Flash, JavaScript, iframes. Id. at pp. 3‐6, 14. See also,
`http://csi.websense.com/Content/ACE_Insight_Sample.pdf (showing
`dynamically determining malicious content (Injection.Redirection.Web.Generic)
`within the iframe of a webpage.
`
`
`For example, http://www.websense.com/assets/white‐papers/whitepaper‐7‐
`stages‐of‐advanced‐threats‐cyber‐attack‐kill‐chain‐en.pdf describes how TRITON
`
`Page 2 of 35
`
`
`
`
`
`
`
`
`
`
`
`powereed by Websense ACE (Advvanced Classiffication Enginne), with real‐‐time
`
`
`
`
`defenses informed bby global threeat intelligencce detects se
`
`ven stages off a “cyber
`attack
`
`
`
`
`
`kill chain” and has “the abbility to stop aan attack at aany of these ddiscreted
`
`stages””
`
`
`
`
`
`Paage 3 of 35
`
`
`
`
`
`
`
`
`
`
`
`
`http:///community.wwebsense.comm/blogs/secuuritylabs/archhive/2013/09//09/malici
`
`
`
`
`ous‐emmails‐target‐financial‐instittutions‐in‐asiaa.aspx descri
`
`bes the correesponding
`
`
`
`
`infringiing Websensee technologiees for each staage:
`
`
`
`
`
`
`
`
`
`
`In anotther example, the Websennse Data Secuurity productss (TRITON sysstem)
`etwork
`
`
`
`
`
`includee a content prrocessor for pprocessing coontent receiveed over the n
`to
`
`with a first function
`
`
` to prevent mmalicious conttent from upl
`loading data
`
`
`
`
`
`Paage 4 of 35
`
`
`
`
`
`another location. The content processor invokes a second function with the
`input only if a security computer indicates the invocation is safe. The Web DLP
`system monitors a first function (uploading data) to a website. After hitting a
`threshold (see below), the Web DLP performs an analysis to determine if it is
`safe. If it is determined to be safe, the computer can upload to the website.
`http://www.websense.com/content/support/library/data/v77/release_notes/v7
`.7_ReleaseNotes.pdf.
`
`The cumulative incident memory provides a method of determinging if there is
`suspicious user behavior or activity, thus determinging if malicious content is on
`the end user’s computer. Once a threshold has been met, the Data Security
`product determines if the upload is a result of malicious software. Id. at 3.
`
`Similarly, Data Security detects malware and advance persistent threats to
`prevent unauthorized uploads of sensitive files. Id. at 4.
`
`Examples of the “dynamically generated malicious content” that Websense’s
`ACE “content processor” protects against are highlighted with the Websense
`document below:
`
`
`Page 5 of 35
`
`
`
`
`
`
`
`per‐ace‐secuurity‐
`
`
`
`
`
`
`overvieew‐en.pdf at pg. 14.
`
`, Websense®
`In anotther example
`
`
`
` TRITON® Seccurity Gatewaay Anywhere
`also
`
`
`
`providees the above described funnctionality ussing “Gatewa
`
`y threat analyysis”
`
`
`
`which ““uses real‐timme, inline sec
`
`
`
`urity analysiss from Webseense ACE (Advvanced
`
`
`Classifiication Enginee) and threat
`
`
`
`intelligence ffrom the Webbsense ThreaatSeeker®
`ts:
`
`
`Intelliggence Cloud too defend aga
`
`inst advancedd malware, b
`lended threa
`
`
`
`http:///www.websennse.com/asseets/white‐pappers/whitepa
`
`
`
`Paage 6 of 35
`
`
`
`http:///www.websennse.com/conttent/websen
`
`se‐triton‐sec
`
`
`
`urity‐gatewayy‐
`
`
`
`
`
`
`anywhere‐features.aspx
`
`To the
`
`
`
`
`
`extent that WWebsense conntends that itt does not liteerally infringee this
`
`
`
`
`
`claim, WWebsense inffringes underr the doctrinee of equivalennts. The abov
`e
`
`
`
`
`describbed functionaality of Webseense is at mosst insubstant
`
`ially differentt from the
`
`function in thhe same way
` to
`
`
`claimedd functionalitty and perfor
`ms the same
`
`
`
`njan receivess non‐infringeement positioons, if any,
`
`
`achievee the same reesult. Once Fi
`
`
`
`
`
`
`Finjan may supplemment its discloosure. In addittion, Finjan mmay supplemeent its
`
`
`
`
`
`ure once it reeceives Webssense’s produuction of docuuments with rrelevant
`disclos
`
`
`
`
`and noon‐public information, partticularly relatted to its sourrce code.
`
`
`
`
`
`anguage becacited claim las meet the recWebseense Products
`
`use they incluude a
`
`
`transmmitter for transmitting the
`
`
`
`input to the ssecurity compputer for insppection
`
`
`
`when tthe first functtion is invokedd.
`
`By the
`
`
`way of example, and not l
`
`limitation, W
`
`
`
`Websense Prodducts meet thhe recited
`
`
`
`Paage 7 of 35
`
`
`
`transmitting tthe input to the
`
`
`1b. a transmittter for
`
`
`
`security compputer for
`hen the first
`nspection, w
`
`function is invvoked; and
`
`1tsif
`
`
`
`
`
`claim language because Websense Products are separately contains a
`transmitter for sending dynamically generated malicious content including
`payloads or droppers from another server as well as “call home” commands to a
`command and control server to download additional dynamically generated
`content to ACE in the Cloud (which provides data and content analysis of: web
`page content, active scripts, exploit code, obfuscated commands, web redirects,
`malicious files, PDFs and executables), Websense® Cloud Web Security (which
`analyzes all inbound and outbound traffic blocking malware and uses security
`analysis from Websense ACE and Websense ThreatSeeker Intelligence Cloud to
`defend against malware and blended threats), Websense ThreatSeeker Cloud
`(which collects content such as webpages, documents, executables, streaming
`media, emails, mobile applications and other internet traffic; and then applies it
`to analysis, in the cloud sandboxing and application profiling), Websense® Web
`Security Gateway Anywhere or Websense® TRITON® Security Gateway
`Anywhere (which work in conjunction with ThreatSeeker, Ace and CSI) for
`performing the combination of URL Analysis, Threat Data, Event Correlation,
`Content Analysis with payload Analysis.
`
`This is demonstrated in Websense’s public documents and at
`http://www.websense.com/content/websense‐triton‐security‐products.aspx
`and http://www.websense.com/content/support.aspx.
`
`For example, in a white paper describing the ACE system, various components
`provide dynamic analysis of web content. A computer attempts to access web
`content with that input transmitted to the security computer, the ACE system. If
`the ACE system determines the web content to be safe, the ACE system
`communicates with the end user’s computer to allow the second function.
`http://www.websense.com/assets/white‐papers/whitepaper‐ace‐security‐
`overview‐en.pdf at p. 3 (“As threats have become more dynamic, ACE applies
`machine learning and other dynamic capabilities to proactively defeat these
`attacks through the seven stages of advanced threats. ACE is a key real‐time
`defense engine used inline within Websense gateways and cloud security
`services.”). For example, Real‐time Security Classification (RTSC) and Real‐time
`Content Classification (RTCC) provide real time analysis of web content to search
`for malicious content. Id. at pp. 3‐6, 8‐9 (“Real‐Time Security Classification.
`Empowers social web controls, and inspects all web content for malicious or
`suspicious code such as open or obfuscated scripts, exploit code and iframe
`tags.” “RTCC examines embedded links to other pages, content with embedded
`scripts, streaming media, and file downloads to identify potential threats.”). Part
`of the functionality of the ACE system is to analyze suspicious code and
`determine if it includes malicious content within other files such as PDF, SWF,
`Flash, JavaScript, iframes. Id. at pp. 3‐6, 14. See also,
`http://csi.websense.com/Content/ACE_Insight_Sample.pdf (showing
`dynamically determining malicious content (Injection.Redirection.Web.Generic)
`within the iframe of a webpage.)
`
`Page 8 of 35
`
`
`
`
`
`For example, http://www.websense.com/assets/white‐papers/whitepaper‐ace‐
`security‐overview‐en.pdf at p. 9 (“ThreatSeeker Intelligence Cloud processes up
`to 5 billion requests each day to provide content analysis through more than 900
`million endpoints. This content takes the form of web pages, documents,
`executables, streaming media, Emails, mobile applications and other Internet
`traffic…. Popular websites are scheduled for regular assessment, viral sites and
`content are monitored, geographical hot spots are tracked and hot topics in the
`media or social networks are used to identify and locate websites hosting related
`content for frequent, proactive content assessment.”).
`
`For example, ThreatSeeker performs the combination of URL Analysis, Threat
`Data, Event Correlation, Content Analysis with Payload Analysis:
`
`Page 9 of 35
`
`
`
`
`
`
`
`http:///www.websennse.com/asseets/datasheetts/datasheet‐‐cloud‐email‐‐security‐
`
`
`An exa
`
`
`mple of paylooad analysis i
`s where TRITTON ThreatSc
`
`ope URL sanddboxing
`isolate
`s suspicious l
`
`ed in emails aand analyzes
`the payload’
`inks embedd
`s content
`
`
`
`of the ccorrespondinng web page aat the recipie
`
`
`nt’s point‐of‐‐click, which hhelps
`
`
`
`thwart malicious weeb pages thatt bypassed in
`itial gateway
`analysis.
`
`
`
`
`
`
`en.pdf
`
`
`
`
`
`
`
`In anotther example, the Websennse Data Secuurity productss (TRITON sysstem)
`etwork
`
`
`
`
`
`includee a content prrocessor for pprocessing coontent receiveed over the n
`to
`loading data
`
`with a first function
`
`
` to prevent mmalicious conttent from upl
`
`
`
`
`
`
`anotheer location. The informatioon is transmittted from thee end user’s ccomputer
`
`
`
`
`
`
`to the ssecurity compputer with WWebsense Dataa Security prooducts. The ccontent
`
`
`
`
`processor invokes a second functtion with thee input only if
`
`a security coomputer
`
`
`indicates the invocaation is safe.
`
`
`The Web DLPP system monnitors a first f
`unction
`e Web
`
`
`
`(uploadding data) to a website. AAfter hitting a
`
`threshold (seee below), th
`
`
`
`DLP peerforms an analysis to deteermine if it is
`
`
`safe. If it is ddetermined too be safe,
`
`
`the commputer can upload to the
`website.
`
`
`
`
`
`
`.7_ReleeaseNotes.pddf.
`
`http:///www.websennse.com/conttent/supportt/library/data
`
`/v77/release
`
`_notes/v7
`
`The cu
`
`
`
`
`
`mulative inciddent memoryy provides a mmethod of deeterminging iff there is
`suspici
`tent is on
`
`
`
`
`ous user behavior or activvity, thus deteerminging if mmalicious con
`
`
`
`Pagge 10 of 35
`
`
`
`
`
`the end user’s computer. Once a threshold has been met, the Data Security
`product determines if the upload is a result of malicious software. Id. at 3.
`
`Similarly, Data Security detects malware and advance persistent threats to
`prevent unauthorized uploads of sensitive files. Id. at 4.
`
`In another example, Websense® TRITON® Security Gateway Anywhere also
`provides the above described functionality using “Gateway threat analysis”
`which “uses real‐time, inline security analysis from Websense ACE (Advanced
`Classification Engine) and threat intelligence from the Websense ThreatSeeker®
`Intelligence Cloud to defend against advanced malware, blended threats:
`
`Page 11 of 35
`
`
`
`http:///www.websennse.com/conttent/websen
`
`se‐triton‐sec
`
`
`
`urity‐gatewayy‐
`
`
`
`
`
`
`anywhere‐features.aspx
`
`To the
`
`
`
`
`
`extent that WWebsense conntends that itt does not liteerally infringee this
`
`
`
`
`
`claim, WWebsense inffringes underr the doctrinee of equivalennts. The abov
`e
`
`
`
`
`describbed functionaality of Webseense is at mosst insubstant
`
`ially differentt from the
`
`function in thhe same way
` to
`
`
`claimedd functionalitty and perfor
`ms the same
`
`
`
`njan receivess non‐infringeement positioons, if any,
`
`
`achievee the same reesult. Once Fi
`
`
`
`
`
`
`Finjan may supplemment its discloosure. In addittion, Finjan mmay supplemeent its
`
`
`
`
`
`ure once it reeceives Webssense’s produuction of docuuments with rrelevant
`disclos
`
`
`
`
`and noon‐public information, partticularly relatted to its sourrce code.
`
`
`
`
`
`anguage becacited claim las meet the recWebseense Products
`
`use they sendd
`
`
`
`
`
`
`information to a recceiver for receeiving an indiicator from thhe security coomputer
`
`
`
`
`
`whetheer it is safe too invoke the ssecond functioon with the innput.
`
`By the
`
`
`
`
`
`
`way of example, and not llimitation, WWebsense Prodducts meet thhe recited
`
`
`
`
`
`
`
`Pagge 12 of 35
`
`
`
`1ictw
`
`
`
`1c. a receiver for receivingg an
`
`
`ndicator fromm the securityy
`
`
`computer whether it is saffe
`
`
`to invoke the second functtion
`
`with the input
`
`
`
`
`
`claim language because Websense Products receive indicators of whether it is
`safe to invoke the second function with the input from ACE in the Cloud (which
`provides data and content analysis of: web page content, active scripts, exploit
`code, obfuscated commands, web redirects, malicious files, PDFs and
`executables), Websense® Cloud Web Security (which analyzes all inbound and
`outbound traffic blocking malware and uses security analysis from Websense
`ACE and Websense ThreatSeeker Intelligence Cloud to defend against malware
`and blended threats), Websense ThreatSeeker Cloud (which collects content
`such as webpages, documents, executables, streaming media, emails, mobile
`applications and other internet traffic; and then applies it to analysis, in the
`cloud sandboxing and application profiling), Websense® Web Security Gateway
`Anywhere or Websense® TRITON® Security Gateway Anywhere (which work in
`conjunction with ThreatSeeker, Ace and CSI) ..
`
`This is demonstrated in Websense’s public documents and at
`http://www.websense.com/content/websense‐triton‐security‐products.aspx
`and http://www.websense.com/content/support.aspx.
`
`For example, in a white paper describing the ACE system, various components
`provide dynamic analysis of web content. A computer attempts to access web
`content with that input transmitted to the security computer, the ACE system. If
`the ACE system determines the web content to be safe, the ACE system
`communicates with the end user’s computer to allow the second function.
`http://www.websense.com/assets/white‐papers/whitepaper‐ace‐security‐
`overview‐en.pdf at p. 3 (“As threats have become more dynamic, ACE applies
`machine learning and other dynamic capabilities to proactively defeat these
`attacks through the seven stages of advanced threats. ACE is a key real‐time
`defense engine used inline within Websense gateways and cloud security
`services.”). For example, Real‐time Security Classification (RTSC) and Real‐time
`Content Classification (RTCC) provide real time analysis of web content to search
`for malicious content. Id. at pp. 3‐6, 8‐9 (“Real‐Time Security Classification.
`Empowers social web controls, and inspects all web content for malicious or
`suspicious code such as open or obfuscated scripts, exploit code and iframe
`tags.” “RTCC examines embedded links to other pages, content with embedded
`scripts, streaming media, and file downloads to identify potential threats.”). Part
`of the functionality of the ACE system is to analyze suspicious code and
`determine if it includes malicious content within other files such as PDF, SWF,
`Flash, JavaScript, iframes. Id. at pp. 3‐6, 14. See also,
`http://csi.websense.com/Content/ACE_Insight_Sample.pdf (showing
`dynamically determining malicious content (Injection.Redirection.Web.Generic)
`within the iframe of a webpage.)
`
`Page 13 of 35
`
`
`
`
`
`
`Examples of the types of “indicator from the security computer whether it is safe
`to invoke the second function with the input” that Websense utilizes are
`highlighted with the Websense document below:
`
`
`Page 14 of 35
`
`
`
`
`
`
`
`http:///www.websennse.com/asseets/white‐pappers/whitepa
`
`
`
`per‐ace‐secuurity‐
`
`
`
`
`
`
`overvieew‐en.pdf at pg. 14.
`
`
`
`
`
`
`, the Websennse Data Secuurity productss (TRITON sysstem)
`In anotther example
`etwork
`
`
`
`
`
`includee a content prrocessor for pprocessing coontent receiveed over the n
`to
`loading data
`
`with a first function
`
`
` to prevent mmalicious conttent from upl
`
`
`
`
`
`
`anotheer location. The informatioon is transmittted from thee end user’s ccomputer
`
`
`
`
`
`
`to the ssecurity compputer with WWebsense Dataa Security prooducts. The ccontent
`
`
`
`
`processor invokes a second functtion with thee input only if
`
`a security coomputer
`
`
`indicates the invocaation is safe.
`
`
`The Web DLPP system monnitors a first f
`unction
`e Web
`
`
`
`(uploadding data) to a website. AAfter hitting a
`
`threshold (seee below), th
`
`
`
`DLP peerforms an analysis to deteermine if it is
`
`
`safe. If it is ddetermined too be safe,
`website.
`
`
`the commputer can upload to the
`
`
`
`
`
`
`.7_ReleeaseNotes.pddf.
`
`http:///www.websennse.com/conttent/supportt/library/data
`
`/v77/release
`
`_notes/v7
`
`
`
`Pagge 15 of 35
`
`
`
`
`
`The cumulative incident memory provides a method of determinging if there is
`suspicious user behavior or activity, thus determinging if malicious content is on
`the end user’s computer. Once a threshold has been met, the Data Security
`product determines if the upload is a result of malicious software. Id. at 3.
`
`Similarly, Data Security detects malware and advance persistent threats to
`prevent unauthorized uploads of sensitive files. Id. at 4.
`
`To the extent that Websense contends that it does not literally infringe this
`claim, Websense infringes under the doctrine of equivalents. The above
`described functionality of Websense is at most insubstantially different from the
`claimed functionality and performs the same function in the same way to
`achieve the same result. Once Finjan receives non‐infringement positions, if any,
`Finjan may supplement its disclosure. In addition, Finjan may supplement its
`disclosure once it receives Websense’s production of documents with relevant
`and non‐public information, particularly related to its source code.
`
`
`Websense Products meet the recited claim language because they include a
`content processor that suspends processing of the content after said transmitter
`transmits the input to the security computer, and resumes processing of the
`
`Page 16 of 35
`
`Claim 2
`
`2. The system of claim 1
`wherein said content
`processor (i) suspends
`
`
`
`
`
`processing of the content
`after said transmitter
`transmits the input to the
`security computer, and (ii)
`resumes processing of the
`content after said receiver
`receives the indicator from
`the security computer.
`
`content after said receiver receives the indicator from the security computer.
`
`By the way of example, and not limitation, Websense Products meet the recited
`claim language because Websense Products seek to protect a computer from
`dynamically generated malicious content. Websense Products provide dynamic
`analysis of web content to prevent malicious content from reaching the end
`user. If the content is determined to be safe, the content will be delivered to the
`end user.
`
`This is demonstrated in Websense’s public documents and at
`http://www.websense.com/content/websense‐triton‐security‐products.aspx
`and http://www.websense.com/content/support.aspx.
`
`For example, in a white paper describing the ACE system, various components
`provide dynamic analysis of web content. A computer attempts to access web
`content with that input transmitted to the security computer, the ACE system. If
`the ACE system determines the web content to be safe, the ACE system
`communicates with the end user’s computer to allow the second function. If it is
`determined to be a threat, the ACE system stops data from being sent.
`http://www.websense.com/assets/white‐papers/whitepaper‐ace‐security‐
`overview‐en.pdf at p. 3 (“As threats have become more dynamic, ACE applies
`machine learning and other dynamic capabilities to proactively defeat these
`attacks through the seven stages of advanced threats. ACE is a key real‐time
`defense engine used inline within Websense gateways and cloud security
`services.” “Unique to ACE is an embedded enterprise‐class DLP engine that
`enables containment defenses to stop data theft and loss. For example, it can
`detect and stop password files (e.g., AD/SAM database, text files) from
`exfiltration, and detect and stop the uploading of suspicious, custom‐encrypted
`files. More advanced uses involve drip (behavioral) DLP that, over a series of
`events for a defined time period, detects slow data leaks; geolocation
`destination awareness; and optical character recognition (OCR ) of text in image
`files to detect data theft or loss (the ability of mobile phones to quickly capture
`images from screens, slides or documents is a growing security concern).”). For
`example, Real‐time Security Classification (RTSC) and Real‐time Content
`Classification (RTCC) provide real time analysis of web content to search for
`malicious content. Id. at pp. 3‐6, 8‐9 (“Real‐Time Security Classification.
`Empowers social web controls, and inspects all web content for malicious or
`suspicious code such as open or obfuscated scripts, exploit code and iframe
`tags.” “RTCC examines embedded links to other pages, content with embedded
`scripts, streaming media, and file downloads to identify potential threats.”). Part
`of the functionality of the ACE system is to analyze suspicious code and
`determine if it includes malicious content within other files such as PDF, SWF,
`Flash, JavaScript, iframes. Id. at pp. 3‐6, 14. See also,
`http://csi.websense.com/Content/ACE_Insight_Sample.pdf (showing
`dynamically determining malicious content (Injection.Redirection.Web.Generic)
`within the iframe of a webpage.)
`
`Page 17 of 35
`
`
`
`
`
`
`In another example, the Websense Data Security products (TRITON system)
`include a content processor for processing content received over the network
`with a first function to prevent malicious content from uploading data to
`another location. The information is transmitted from the end user’s computer
`to the security computer with Websense Data Security products. The content
`processor invokes a second function with the input only if a security computer
`indicates the invocation is safe. The Web DLP system monitors a first function
`(uploading data) to a website. After hitting a threshold (see below), the Web
`DLP performs an analysis to determine if it is safe. If it is determined to be safe,
`the computer can upload to the website. If the content is determined to be
`malicious in nature, then the Web DLP prevents further uploads.
`http://www.websense.com/content/support/library/data/v77/release_notes/v7
`.7_ReleaseNotes.pdf.
`
`Page 18 of 35
`
`
`
`
`
`The cumulative incident memory provides a method of determinging if there is
`suspicious user behavior or activity, thus determinging if malicious content is on
`the end user’s computer. Once a threshold has been met, the Data Security
`product determines if the upload is a result of malicious software. Id. at 3.
`
`Similarly, Data Security detects malware and advance persistent threats to
`prevent unauthorized uploads of sensitive files. Id. at 4.
`
`To the extent that Websense contends that it does not literally infringe this
`claim, Websense infringes under the doctrine of equivalents. The above
`described functionality of Websense is at most insubstantially different from the
`claimed functionality and performs the same function in the same way to
`achieve the same result. Once Finjan receives non‐infringement positions, if any,
`Finjan may supplement its disclosure. In addition, Finjan may supplement its
`disclosure once it receives Websense’s production of documents with relevant
`and non‐public information, particularly related to its source code.
`
`
`Websense Products meet the recited claim language because they provide a
`system wherein the input is dynamically generated by the content processor
`prior to being transmitted by the transmitter.
`
`Page 19 of 35
`
`Claim 3
`
`3. The system of claim 1
`wherein the input is
`dynamically generated by
`
`
`
`
`
`said content processor prior
`to being transmitted by said
`transmitter.
`
`
`By the way of example, and not limitation, Websense Products meet the recited
`claim language because Websense Products seek to protect a computer from
`dynamically generated malicious content. Websense Products provide dynamic
`analysis of web content to prevent malicious content from reaching the end
`user. If the content is determined to be safe, the content will be delivered to the
`end user. Websense Products also scour the Internet to predetermine the safety
`of web content prior to a request by an end user.
`
`This is demonstrated in Websense’s public documents and at
`http://www.websense.com/content/websense‐triton‐security‐products.aspx
`and http://www.websense.com/content/support.aspx.
`
`For example, in a white paper describing the ACE system, various components
`provide dynamic analysis of web content. A computer attempts to access web
`content with that input transmitted to the security computer, the ACE system. If
`the ACE system determines the web content to be safe, the ACE system
`communicates with the end user’s computer to allow the second function. If it is
`determined to be a threat, the ACE system stops data from being sent. Part of
`the ACE system is the Websense ThreatSeeker Intelligence Cloud, which
`searches the Internet for potential threats prior to content being requested by
`an end user. http://www.websense.com/assets/white‐papers/whitepaper‐ace‐
`security‐overview‐en.pdf at p. 3 (“ACE is a key real‐time defense engine used
`inline within Websense gateways and cloud security services. ACE is also
`integrated with Websense ThreatSeeker® Intelligence Cloud, which unites more
`than 900 million endpoints that generate up to 5 billion requests of potential
`threat activity every day.” “Unique to ACE is an embedded enterprise‐class DLP
`engine that enables containment defenses to stop data theft and loss. For
`example, it can detect and stop password files (e.g., AD/SAM database, text files)
`from exfiltration, and detect and stop the uploading of suspicious, custom‐
`encrypted files. More advanced uses involve drip (behavioral) DLP that, over a
`series of events for a defined time period, detects slow data leaks; geolocation
`destination awareness; and optical character recognition (OCR ) of text in image
`files to detect data theft or loss (the ability of mobile phones to quickly capture
`images from screens, slides or documents is a growing security concern).”). The
`Websense ThreatSeeker Intelligence Cloud analyzes web content to search for
`malicious content. Id. at pp. 3‐6, 8‐9 (“ThreatSeeker Intelligence Cloud processes
`up to 5 billion requests each day to provide content analysis through more than
`900 million endpoints. This content takes the form of web pages, documents,
`executables, streaming media, Emails, mobile applications and other Internet
`traffic.” “ThreatSeeker Intelligence Cloud is designed to be there with you—
`often before you get there.”). See also,
`http://csi.websense.com/Content/ACE_Insight_Sample.pdf (showing
`dynamically determining malicious content (Injection.Redirection.Web.Generic)
`within the iframe of a webpage.)
`
`Page 20 of 35
`
`
`
`
`
`
`To the extent that Websense contends that it does not literally infringe this
`claim, Websense infringes under the doctrine of equivalents. The above
`described functionality of Websense is at most insubstantially different from the
`claimed functionality and performs the same function in the same way to
`achieve the same result. Once Finjan receives non‐infringement positions, if any,
`Finjan may supplement its disclosure. In addition, Finjan may supplement its
`disclosure once it receives Websense’s production of documents with relevant
`and non‐public information, particularly related to its source code.
`
`
`Websense Products meet the recited claim language because they include a non‐
`transitory computer‐readable storage medium storing program code for causing
`a computing device to process content received over a network with the content
`including a call to a first function and an input.
`
`By the way of example, and not limitation, Websense Products meet the recited
`claim language because Websense Products seek to protect a computer from
`dynamically generated malicious content. Websense Products provide dynamic
`analysis of web content to prevent malicious content from reaching the end
`user. If the content is determined to be safe, the content will be delivered