`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`
`SAN JOSE DIVISION
`
`CASE NO.: 15-cv-03295-BLF-SVK
`
`REBUTTAL EXPERT REPORT OF
`DR. SETH NIELSON REGARDING
`NONINFRINGEMENT OF U.S.
`PATENT NOS. 6,154,844; 6,965,968;
`7,418,731; 8,079,086; 8,225,408;
`8,566,580; 8,677,494; 9,141,786;
`9,189,621; AND 9,219,755
`
`CERTAIN PORTIONS CONTAIN
`HIGHLY CONFIDENTIAL –
`OUTSIDE COUNSELS’ EYES ONLY
`– SOURCE CODE INFORMATION
`
`))))))))))))))
`
`FINJAN, INC., a Delaware Corporation,
`
`Plaintiff,
`
`v.
`
`BLUE COAT SYSTEMS LLC, a Delaware
`Corporation,
`
`Defendant.
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 1
`
`
`
`HHIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY - SOURCE CODE
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`67.
`
`As for dynamic analysis, this can be performed in two ways: emulation (otherwise
`
`known as “Sandbox” or “SBX” in MAA) or virtualization (otherwise known as “iVM” or
`
`“intelliVM” in MAA).
`
` For dynamic analysis,
`
`rather than reading the code of the sample to check for signatures, the sample is actually run, and
`
`the events it performs are monitored. This is sometimes referred to as “detonation,” since the file
`
`is executed, then permitted to run as intended.
`
` In iVM, operations are configured to intercept various actions performed both in user
`
`programs (such as Adobe) and in the operating system kernel.
`
`
`
`- 21 -
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 2
`
`
`
`HHIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY - SOURCE CODE
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`328.
`
`Specifically, as discussed in Section III.E, my analysis of MAA shows that it
`
`receives a sample uploaded from requesting clients, and then “detonates” the sample by running
`
`it in either a virtualized or emulated sandbox. As the sample is running, MAA keeps track of its
`
`behavior, called “events,” such as network events and file system events. A static analysis of the
`
`sample may also be performed by NSE. The events are saved to disk in a “Google Protocol
`
`Buffers” serialization format.
`
`
`
`329.
`
`- 113 -
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 3
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`HHIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY - SOURCE CODE
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`332.
`
`
`
`assertion that these data stores hold “task results,” the cited testimony and exhibits reflect that, at
`
`most, the only thing they can store is a log of all events generated during detonation.
`
`But, contrary to Dr. Cole’s
`
`- 114 -
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 4
`
`
`
`HHIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY - SOURCE CODE
`
` Event data cannot be “a list of suspicious computer operations”—it is a list of all
`computer operations performed by a sample. Most of these events are not suspicious—in fact, it
`
`may be that none are.
`
`
`
`333.
`
`
`
`
`
`
`
`
`
`
`
`a listing of all events observed during detonation is not “a list of suspicious operations,” and
`
`therefore does not comprise the claimed security profile data.
`
`As stated above,
`
`334.
`
`
`
`
`
`- 115 -
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 5
`
`
`
`HHIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY - SOURCE CODE
`
`Dated: April 21, 2017
`
`
`
`______________________________________________________________________________ ________________________________________ ______________________________
`__________________________
`
`Seth Nielson, Ph.D.
`
`- 217 -
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 6
`
`
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
