`
`IN THE UNITED STATES DISTRICT COURT
`
`FOR THE NORTHERN DISTRICT OF CALIFORNIA
`
`SAN JOSE DIVISION
`
`CASE NO.: 15-cv-03295-BLF-SVK
`
`REBUTTAL EXPERT REPORT OF
`DR. SETH NIELSON REGARDING
`NONINFRINGEMENT OF U.S.
`PATENT NOS. 6,154,844; 6,965,968;
`7,418,731; 8,079,086; 8,225,408;
`8,566,580; 8,677,494; 9,141,786;
`9,189,621; AND 9,219,755
`
`CERTAIN PORTIONS CONTAIN
`HIGHLY CONFIDENTIAL –
`OUTSIDE COUNSELS’ EYES ONLY
`– SOURCE CODE INFORMATION
`
`))))))))))))))
`
`FINJAN, INC., a Delaware Corporation,
`
`Plaintiff,
`
`v.
`
`BLUE COAT SYSTEMS LLC, a Delaware
`Corporation,
`
`Defendant.
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 1
`
`
`
`HHIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY - SOURCE CODE
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`67.
`
`As for dynamic analysis, this can be performed in two ways: emulation (otherwise
`
`known as “Sandbox” or “SBX” in MAA) or virtualization (otherwise known as “iVM” or
`
`“intelliVM” in MAA).
`
` For dynamic analysis,
`
`rather than reading the code of the sample to check for signatures, the sample is actually run, and
`
`the events it performs are monitored. This is sometimes referred to as “detonation,” since the file
`
`is executed, then permitted to run as intended.
`
` In iVM, operations are configured to intercept various actions performed both in user
`
`programs (such as Adobe) and in the operating system kernel.
`
`
`
`- 21 -
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 2
`
`
`
`HHIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY - SOURCE CODE
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`328.
`
`Specifically, as discussed in Section III.E, my analysis of MAA shows that it
`
`receives a sample uploaded from requesting clients, and then “detonates” the sample by running
`
`it in either a virtualized or emulated sandbox. As the sample is running, MAA keeps track of its
`
`behavior, called “events,” such as network events and file system events. A static analysis of the
`
`sample may also be performed by NSE. The events are saved to disk in a “Google Protocol
`
`Buffers” serialization format.
`
`
`
`329.
`
`- 113 -
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 3
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`HHIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY - SOURCE CODE
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`332.
`
`
`
`assertion that these data stores hold “task results,” the cited testimony and exhibits reflect that, at
`
`most, the only thing they can store is a log of all events generated during detonation.
`
`But, contrary to Dr. Cole’s
`
`- 114 -
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 4
`
`
`
`HHIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY - SOURCE CODE
`
` Event data cannot be “a list of suspicious computer operations”—it is a list of all
`computer operations performed by a sample. Most of these events are not suspicious—in fact, it
`
`may be that none are.
`
`
`
`333.
`
`
`
`
`
`
`
`
`
`
`
`a listing of all events observed during detonation is not “a list of suspicious operations,” and
`
`therefore does not comprise the claimed security profile data.
`
`As stated above,
`
`334.
`
`
`
`
`
`- 115 -
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 5
`
`
`
`HHIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY - SOURCE CODE
`
`Dated: April 21, 2017
`
`
`
`______________________________________________________________________________ ________________________________________ ______________________________
`__________________________
`
`Seth Nielson, Ph.D.
`
`- 217 -
`
`Patent Owner Finjan, Inc. - Ex. 2050, p. 6
`
`