trials@uspto.gov
`
`571-272-7822
`
`IPR2015-01892, Paper No. 56
`IPR2016-00890, Paper No. 9
`January 12, 2017
`
`
`
`
`RECORD OF ORAL HEARING
`UNITED STATES PATENT AND TRADEMARK OFFICE
`- - - - - -
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`- - - - - -
`SYMANTEC CORP. and BLUE COAT SYSTEMS, INC.,
`Petitioner,
`v.
`FINJAN, INC.,
`Patent Owner.
`- - - - - -
`Case IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`Technology Center 2400
`Oral Hearing Held: Friday, December 16, 2016
`
`Before: JAMES B. ARPIN (via video link), and ZHENYU
`YANG, and CHARLES J. BOUDREAU (via video link), Administrative
`Patent Judges.
`The above-entitled matter came on for hearing on Friday,
`December 16, 2016, at 1:00 p.m., Hearing Room A, taken at the U.S. Patent
`and Trademark Office, 600 Dulany Street, Alexandria, Virginia.
`REPORTED BY RAYMOND G. BRYNTESON, RMR, CRR,
`
`RDR
`
`
`
`571-272-7822
`
`IPR2015-01892, Paper No. 56
`IPR2016-00890, Paper No. 9
`January 12, 2017
`
`
`
`
`RECORD OF ORAL HEARING
`UNITED STATES PATENT AND TRADEMARK OFFICE
`- - - - - -
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`- - - - - -
`SYMANTEC CORP. and BLUE COAT SYSTEMS, INC.,
`Petitioner,
`v.
`FINJAN, INC.,
`Patent Owner.
`- - - - - -
`Case IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`Technology Center 2400
`Oral Hearing Held: Friday, December 16, 2016
`
`Before: JAMES B. ARPIN (via video link), and ZHENYU
`YANG, and CHARLES J. BOUDREAU (via video link), Administrative
`Patent Judges.
`The above-entitled matter came on for hearing on Friday,
`December 16, 2016, at 1:00 p.m., Hearing Room A, taken at the U.S. Patent
`and Trademark Office, 600 Dulany Street, Alexandria, Virginia.
`REPORTED BY RAYMOND G. BRYNTESON, RMR, CRR,
`
`RDR
`
`
`
`APPEARANCES:
`
`ON BEHALF OF THE PETITIONER:
`
`
`
`
`
`
`
`
`JOSEPH J. RICHETTI, ESQ.
`ALEXANDER WALDEN, ESQ.
`Bryan Cave LLP
`1290 Avenue of the Americas
`New York, New York 10104-3300
`212-541-2000
`
`
`
`
`
`
`
`
`
`ON BEHALF OF THE PATENT OWNER:
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`JAMES HANNAH, ESQ.
`MICHAEL LEE, ESQ.
`Kramer Levin Naftalis & Frankel LLP
`990 Marsh Road
`Menlo Park, California 94025-1949
`650-752-1700
`
`JEFFREY H. PRICE, ESQ.
`Kramer Levin Naftalis & Frankel LLP
`1177 Avenue of the Americas
`New York, New York 10036
`212-715-9100
`
`2
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`
`P R O C E E D I N G S
`
`(1:00 p.m.)
`JUDGE BOUDREAU: Good afternoon, everyone.
`This is the oral hearing in case IPR2015-01892, captioned
`Symantec Corporation versus Finjan, Incorporated, to which
`case IPR2016-00890, captioned Blue Coat Systems,
`Incorporated versus Finjan, Incorporated has been joined.
`I'm Judge Boudreau, appearing from California.
`There in Virginia you are joined by Judge Yang, and you
`should see Judge Arpin on another screen there appearing
`from Colorado.
`Because of the limitations on our audio technology
`Judge Arpin and I will only be able to hear you when you are
`at the podium, so we ask that any time you are speaking,
`please go to the podium and remain there.
`Let's have each counsel come up and enter an
`appearance and state your names for the record. We will start
`with counsel for Petitioner, please.
`MR. RICHETTI: Good afternoon, Your Honors.
`Joseph Richetti from Bryan Cave on behalf of Petitioner.
`With me is my associate, Alex Walden.
`There is also counsel for Blue Coat as well, Your
`
`Honors.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`
`
`
`3
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`
`MR. HANNAH: Good afternoon, Your Honors.
`James Hannah from Kramer Levin representing Finjan. And
`with me is Michael Lee.
`We also have Jeff Price. And Dr. Medvidovic is
`also here if there are any questions for him during the
`proceeding.
`JUDGE YANG: Okay. Welcome to all.
`JUDGE BOUDREAU: Thank you, counsel. Now,
`we set out the procedure for today's hearing in our R evised
`Hearing Order, which was Paper 50, but I will just take a few
`minutes to remind you of how to proceed.
`Petitioner and Patent Owner will each have 30
`minutes of total time today to present their arguments. And
`Petitioner will go first, present its case regarding the
`challenged claims of the '494 patent and may reserve time for
`rebuttal. Patent Owner may then respond to Petitioner's
`presentation.
`The fundamental rule governing our hearings is
`that the party bearing the burden of persuasion on any issue
`may speak last on that issue. So Petitioner will have the
`opportunity to use any reserved rebuttal time to respond to
`Patent Owner's arguments.
`Also, because Patent Owner has filed a Motion to
`Exclude Evidence in this case, which was Paper 41, and a
`Motion for Observation on Cross-Examination of Petitioner's
`
`
`
`4
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`declarant, Jack Davidson, that was Paper 42, Patent Owner
`may also discuss both of those motions during its time. And
`Petitioner may use a portion of its rebuttal time to respond to
`Patent Owner's arguments regarding those motions.
`But as stressed in the Hearing Order, Petitioner ay
`only respond if Patent Owner actually raises those during its
`presentation.
`Just a few other points before we begin. First,
`keep in mind that although I believe that you both requested
`overhead projectors, Judge Arpin and I can't actually see the
`screen from our remote locations. We both have copies of all
`of the demonstratives and all of the papers in the case, so if
`you are using the screen for Judge Yang's benefit, and you are
`referring to any specific slide or figure in your
`demonstratives, or any document in the record, we ask that
`you just call out the slide number, figure number, or the
`exhibit and page number so that the record is complete both in
`the transcript, and so Judge Arpin and I can remotely follow
`along.
`
`Second, just as a common courtesy, if you believe
`that the other party is arguing -- is presenting a new argument
`in substance that wasn't presented in its briefs or if you have
`any other objections, we ask that you just please wait until
`your turn at the podium rather than interrupting opposing
`counsel.
`
`
`
`5
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`
`With that, unless there are any other questions
`from either party before we begin, you may proceed. Counsel
`for Petitioner.
`MR. RICHETTI: Good afternoon, Your Honors.
`JUDGE BOUDREAU: Good afternoon. Oh, and
`before we begin, could I just ask, would you like to reserve
`any time for rebuttal?
`MR. RICHETTI: Yes, Your Honor. We would
`like to reserve 10 minutes, please.
`JUDGE BOUDREAU: Okay. Thank you. You
`may proceed.
`MR. RICHETTI: The Board instituted trial on
`ground 3 in the Petition. The claims that are being challenged
`are 1, 2, 5, 6, 10, 11 and 14 and 15 of the '494 patent, and the
`reference is the Swimmer reference.
`There are only two pairs of claims that are actually
`in dispute when we go through the papers, claims 1 and 5 and
`claims 10 and 14. To try to streamline things, claim 10
`mirrors claim 1, albeit in a system format whereas claim 1 is
`in a method format. And claim 14 mirrors claim 5, which
`specifies that the downloadable is a program script. So those
`are the sets of claims that we'll be discussing today.
`Turning to just a quick overview of the '494 patent
`as the Patent Owner in their P reliminary Response lays out,
`the '494 patent basically is directed to deriving the security
`
`
`
`6
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`profile data for an incoming downloadable. The downloadable
`security profile data for each downloadable includes a list of
`all potentially hostile or suspicious computer operations that
`may be attempted by the specific downloadable. And the last
`step that will be reflected in the claims is that the derived
`DSP data is stored in a database.
`JUDGE ARPIN: Counselor, you are on slide 3,
`isn't that correct?
`MR. RICHETTI: That's correct. I'm sorry.
`JUDGE ARPIN: Could you please identify the
`slides as you go along? Thank you.
`MR. RICHETTI: I will. Turning to slide 5, this is
`just claim 1, which reflects that structure. We see there is a
`receiving step, a deriving the security profile data step, and
`the storing the downloadable security profile data in the
`database. And so those are the three steps.
`Based on the Patent Owner's Response and the
`papers that have been filed, there hasn't been a real dispute
`about receiving an incoming downloadable so we're going to
`focus on the other two steps and, in particular, the three terms
`that have been bolded on slide 5, namely, the deriving the
`security profile data which includes a list of suspicious
`computer operations, the storing, the word "storing" in the
`storing step, and where the downloadable security profile data
`is stored, namely, the database.
`
`
`
`7
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`
`JUDGE YANG: Can we start with database? I
`have two questions there.
`First, can a log file be included or interpreted as a
`database and, second, if so, does the Swimmer reference, you
`know, that Figure 3, does it teach a log file or something else?
`MR. RICHETTI: Right. So I think starting the
`other way, Petitioner's position is that F igure 3 is a flat file
`database, not a log file, but I think your question also goes to
`what is a database.
`And I think the court has a proposed construction
`that was based off Finjan's construction in their Preliminary
`Response. The Board adopted it, and, for the purpose of the
`proceeding, Symantec has, too.
`And what we see in their papers is that they try to
`narrow down now their prior construction. And so you will
`see they interpret the word database schema, so they are
`actually trying to construe the court's construction. They then
`construe the word that is in the database schema definition
`they propose, and the DBMS, and they provide a construction
`for that.
`
`And then finally they sprinkle in some things, I
`think as you are mentioning, Your Honor, that it can't be a log
`file, it can't be an event log, and it can't be a flat file.
`These are all labels that are put on different
`references. I think what is most important isn't the label.
`
`
`
`8
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`What is important is whether or not the features that are in the
`audit trail from Swimmer actually meets the construction of
`what a database is.
`And so here when we look to this -- and maybe we
`can go to slide 25 -- Swimmer's audit trail we believe are a
`flat file databases, as I mentioned. It has certain fields, there
`is an order, and there is a schema to it.
`And when we look at -- can you go to 26, please,
`turn to slide 26, please?
`JUDGE BOUDREAU: Mr. Richetti, when you say
`that the audit trail is a flat file database, is that the raw audit
`trail or are you talking about the NADF file?
`MR. RICHETTI: We believe, Your Honor, both
`are. I think, you know, the raw file, the native file is, as well
`as the NADF file that is converted from the raw file.
`JUDGE BOUDREAU: How does the NADF file
`actually differ from the raw audit trail?
`MR. RICHETTI: I think the difference -- I'm
`sorry, Your Honor. Please continue.
`JUDGE BOUDREAU: No, maybe you didn't hear
`me. I was just asking how the NADF file actually differs
`from the raw audit trail.
`MR. RICHETTI: I think the raw audit data file --
`the audit -- the native one is in a native format which is
`specific to the OS. The NADF file is going to be something
`
`
`
`9
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`that is more universal, so that the ASAX system which, again,
`is something outside the scope of the claim, but the ASAX
`system in Swimmer can then interpret that and determine
`whether or not something is or is not harmful.
`JUDGE BOUDREAU: So when we're looking at
`Figure 3, is that the raw audit trail that we're looking at or is
`that the NADF file?
`MR. RICHETTI: I believe, Your Honor, that's the
`NADF file that we are looking at in F igure 3, but we can
`double-check that as well.
`Looking --
`JUDGE ARPIN: Counsel, before you go on, could
`you answer Judge Yang's first question, is a log file a
`database?
`MR. RICHETTI: I believe a database is exactly
`what the court proposed and adopted in its Institution
`Decision. Can we turn to that slide?
`And so on slide 7, the Board construed database
`based on Finjan's construction to be a collection of
`interrelated data organized according to a database schema to
`serve one or more applications.
`We believe that is the claimed database, and we
`believe that a log file, in certain circumstances, a log file
`might do that. A flat file database certainly does it. But what
`we do know is Swimmer's audit trail fits this description.
`
`
`
`10
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`And if it would help, I could go through a couple slides to
`show that.
`
`JUDGE ARPIN: Counsel, if you could turn to
`your slide 8.
`MR. RICHETTI: Okay. Sure.
`JUDGE ARPIN: At the bottom of that slide you
`say a database cannot be a flat file. I guess your answer to
`that supposed assertion by the Patent Owner would be that
`that is incorrect?
`MR. RICHETTI: That's correct. I don't think
`putting labels --
`JUDGE ARPIN: With regard to the line directly
`above that, that says a database cannot be an event file or a
`log file, your answer to that would be sometimes it can?
`MR. RICHETTI: That's correct, Your Honor. It
`really depends on the context and the system and what
`information is being stored and for what purpose. And if
`there is a schema, then it does fit. It fits. And if it is going
`to be used by one or more applications.
`So when you look at Swimmer's audit trail, if you
`turn to slide 27, it is going to be based on a collection of data,
`right, so the audit record is going to be -- the emulator in
`Swimmer is going to be reading the incoming downloadable.
`It is going to be creating audit records that are characterizing
`the behavior of the downloadable.
`
`
`
`11
`
`
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`
`And if you turn to 28, so it is organized to a
`schema. It actually has a format, a final format. It has code
`segment, record types, start time, end time. So that is the
`schema, the canonical format that the records are always
`going to be in.
`And then the aggregation of them in an audit trail
`is going to be -- if you could turn to -- we're on 28 now -- is
`that that is going to be the database itself. And then to serve
`one or more applications, the whole point of Swimmer is so
`that ASAX can take this audit trail and analyze these
`operating system calls to determine whether or not it is
`harmful, any of these particular ones are harmful.
`So the audit record pulls out the ones that are
`potentially harmful, potentially hostile, that's the list of
`suspicious operations, and then ASAX is working on that file
`and actually doing the determination. And that ASAX step is
`actually not part of the claims, but that's the one or more
`applications that are being served by the audit trail.
`JUDGE BOUDREAU: Is the raw audit trail ever
`stored by Swimmer?
`MR. RICHETTI: We believe it is, Your Honor, in
`a file. And I think this is a good point, which is to us storing
`really isn't in dispute. You know, after looking at everyone's
`arguments and, you know, I think the first point is everybody
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`
`
`
`12
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`knows what storing is, so from a claim construction purpose it
`is unnecessary. The experts all agree storing is storing.
`But from a standpoint of when you look at Finjan's
`response, you will see they say it is stored in a file. So I
`don't think the fight is about whether or not it is stored. What
`it appears to us is the fight is really about is it stored in a file,
`they make the argument file versus database, well, that's
`unhelpful, right, because it is what the database means and
`what this audit trail does.
`You know, there are flat file databases. So the
`distinction between a file and a database, that's not mutually
`exclusive. So the point being is just, you know, again, we see
`over and over there is a lot of discussion about these labels
`rather than just focusing on the claim language.
`You know, the database limitation, right, there is
`no discussion in the '494 patent spec, or the '194 patent about
`the specific structure of this database.
`Back in 1995 this isn't the key feature. Storing
`information in the database is not the key feature. Now, we
`see that Finjan goes through lots of hoops to reinterpret the
`court's construction, to then interpret the construction that
`they are interpreting, and then explaining what it isn't.
`But under the BRI standard it is based on what the
`word means to one of ordinary skill in the art in light of the
`specification. The specification doesn't limit it at all. There
`
`
`
`13
`
`
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`is no disavowal. What this is is an attempt to try to narrow
`the scope of the claim down to a relational database. And
`that's improper, especially under the BRI standard, but it is
`improper under any claim construction standard.
`JUDGE ARPIN: Counselor, on your slide 28 you
`identify a database schema for Swimmer. What is the
`database schema that is identified in the '494 patent?
`MR. RICHETTI: We don't know, Your Honor,
`because it doesn't talk about database schema. It doesn't talk
`about DBMS, the '494 patent.
`JUDGE ARPIN: Is that a problem with our claim
`construction?
`MR. RICHETTI: No, because I think one of
`ordinary skill in the art understands that a database has a
`schema, right, that's the structure in which the record is
`stored. I mean, the fact that it doesn't have it, if anything,
`would indicate that database in the '494 patent is broader, but,
`you know, I don't -- for us that's not the fight because
`Swimmer has a schema, a very clear-cut one.
`But to your point, it doesn't speak to the schema.
`It doesn't speak -- the '494 patent doesn't speak to the
`database because the database is not what is novel. This is
`not an important feature at this time in computer-based
`software.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`
`
`
`14
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`
`And that is the same thing for Swimmer. Swimmer
`calls it an audit trail and Finjan makes much of, wait a sec,
`they used the word database somewhere but they call this an
`audit trail. There is a pretty simple, when you read the
`documents, ASAX is a system, a tool, that analyzes audit
`trails.
`
`So that's why it is called an audit trail. But,
`again, it is not the name. It is what it is, what structurally is
`it. And here it fits perfectly in with the court's prior
`construction.
`JUDGE BOUDREAU: But the claims do require
`storing the downloadable security profile data in a database,
`not simply in a file, and so I think we do need to resolve
`whether or not the audit trail data is being stored in a
`database, and whether that is the raw audit trail database --
`raw audit trail data or if that is the NADF file, but we need to
`resolve whether or not either of those is stored in a database.
`MR. RICHETTI: Right, and we would submit,
`Your Honor, that a flat file database, right, there is only a few
`known databases at this time, and the experts have talked
`through this on their testimony, right, there is
`object-orientated databases, there is flat file databases, and
`there is relational databases.
`So databases were well known. And the fact that
`it is an NADF file doesn't preclude it from being a database.
`
`
`
`15
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`It is just -- the NADF file is what ASAX is looking to to be
`able to analyze it, the universal formats that it can analyze it.
`So let me just see here --
`JUDGE BOUDREAU: Counsel, what is the
`difference between an audit record and an audit trail?
`MR. RICHETTI: So the audit record is what is
`created by the emulator when it is trying to model the
`behavior of the incoming downloadable. The collection of
`audit records is going to be the audit trail.
`And so those audit records are contained in the
`native file, the raw file, right, all of the audit records, and
`then it gets converted over to the NADF file. And it is just,
`again, it is just converting format so that the ASAX system
`can work on it, process it.
`JUDGE BOUDREAU: Where is that explained in
`Swimmer?
`(Pause)
`MR. RICHETTI: I apologize, Your Honor, we're
`just looking to get you an exact cite.
`(Pause)
`JUDGE BOUDREAU: So as long as you are
`looking at Swimmer, my next question is going to be --
`MR. RICHETTI: Page 12.
`JUDGE BOUDREAU: -- where Swimmer discloses
`storing either a raw audit trail or NADF file?
`
`
`
`16
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`
`MR. RICHETTI: Your Honor, it is on page 12 of
`Swimmer, and, I'm sorry, I didn't hear the second part.
`JUDGE BOUDREAU: I said while you're looking
`at Swimmer, if you could point us to where in Swimmer it is
`disclosed that the NADF file is stored, or that the raw audit
`trail data is stored, for that matter?
`MR. RICHETTI: Sure. So going to the first one
`that you asked about, Swimmer talks about in the context of
`this paper the sequential file is the activity data recorded
`produced by the PC emulator.
`The universality is obtained by translating native
`files to a generic format, which is the only one supported by
`the evaluator, namely, you know, ASAX. The format is
`simple and flexible enough to allow straightforward
`conversion of most file formats.
`This generic format is referred to as the
`Normalized Audit Data Format, NADF. And that is Swimmer
`at 12.
`
`JUDGE BOUDREAU: Just to be clear, it is your
`position that that is the database. Is that correct?
`MR. RICHETTI: That is where Swimmer's audit
`trail is storing the database, that's correct, Your Honor.
`JUDGE BOUDREAU: In the NADF file?
`MR. RICHETTI: Correct, Your Honor, which is a
`flat file database.
`
`
`
`17
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`
`So, Your Honor, have I answered your questions?
`I apologize because I know it is a little bit broken up going
`through the video.
`JUDGE BOUDREAU: Well, I think I was also
`asking where it is disclosed that the NADF file is stored?
`MR. RICHETTI: I think the answer to that, Your
`Honor, is files are stored. Right? Files -- to be in a file, it
`exists. Right? Data isn't created in the ether. Right? On
`computer systems it is created in files and those files are
`stored in memory, on hard drives.
`So the fact that someone -- and one of ordinary
`skill in the art and the record will reflect this -- the fact that
`it is talking about the NADF file means it is being stored.
`The fact that it is going to be acted upon and further
`processed to do that, it needs to be in some form of being
`stored, namely the NADF file.
`JUDGE ARPIN: Counselor, is that an inherency
`argument then?
`MR. RICHETTI: I think it is what one of ordinary
`skill in the art would understand the reference to be
`disclosing. I don't even think it needs to rise to the level of
`inherency. I think it rises to the level of what the words of
`Swimmer means to one of ordinary skill in the art.
`JUDGE ARPIN: But we are here looking at
`particular references, or a particular reference in this case,
`
`
`
`18
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`and the IPR is based on a printed publication or a patent, so
`we need to find that somewhere that document supplies this
`limitation. Isn't that correct?
`MR. RICHETTI: That's absolutely correct, Your
`Honor, but what we don't need to have is that the reference
`uses the word storing. If in computer parlance one of
`ordinary skill in the art would understand when a system says
`an emulator generates an audit record that is stored in an audit
`trail in a file that is ultimately converted into an NADF file,
`that one of ordinary skill in the art, the Board is completely
`entitled to understand that that, just because the term stored
`doesn't appear, that that means to one of ordinary skill in the
`art that once it is in that file it has been stored.
`And just one other piece that I will just introduce
`to the record to try to add some clarity is page 7 from
`Swimmer which reads: The first ASAX system reads the raw
`audit trail, converts it into generic data, pipes its output as an
`NADF file for further processing.
`It refers to Section 5. Using an ASAX filter it
`allows it to reduce the complexity but, again, the point is it is
`showing the further processing that ASAX is going to be
`doing on this file.
`So -- Your Honor, how much time do we have left?
`I don't want to run over too far, but I want to make sure I
`answer all of the questions.
`
`
`
`19
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`
`JUDGE BOUDREAU: You're actually at 19
`minutes, but I have a question regarding Figure 3 of Swimmer.
`Are all of the operations listed in Figure 3 of
`Swimmer -- let's back up for a second. If we look at Figure 3,
`I believe you have taken the position that the DOS functions
`that are listed in Figure 3, that each of those is what the
`patent would term a suspicious computer operation. Is that
`right?
`
`MR. RICHETTI: That's correct, Your Honor.
`JUDGE BOUDREAU: Are all of the operations
`listed in Figure 3 of Swimmer suspicious computer
`operations?
`MR. RICHETTI: Yes, Your Honor. So I think it
`is an important point you raise because Swimmer is not taking
`every, every operation that is happening in the downloadable
`and putting it into an audit record. It is picking out ones that
`are for certain types of computer operations, namely the OS
`calls.
`
`And so when the downloadable is attempting to
`invoke in this instance DOS system functions, OS calls, that is
`what it is deeming as potentially suspicious, right, because
`those are the types of operations that can create harm to a
`computer. That's how a virus works.
`So that is the whole idea. The records are created
`not on everything, so it is not cataloguing everything, it is
`
`
`
`20
`
`
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`cataloguing the ones that could be potentially hostile, the ones
`that could harm the computer. And that is what it emulates.
`And that is -- both experts have agreed that there
`are other operations, such as arithmetic operations , add,
`subtract, et cetera. Just for the sake of the record, Petitioner's
`expert, it would be at reply declaration, the Exhibit 1027 in
`paragraphs 69 and 71. And for Patent Owner's expert, it
`would be in his deposition transcript, page 126, column 19,
`and through 127 to 22.
`And so that is where we would be showing -- there
`is a lot more going on than what you see in just Figure 3 in
`the downloadable, but it is picking out the ones that are
`potentially hostile, and those are the ones that the ASAX
`system will ultimately evaluate to determine whether or not it
`is harmful.
`Now, when we look at --
`JUDGE ARPIN: Counselor, what is the
`significance in Figure 3 of the repetition of functions 48, 50,
`and 51?
`
`MR. RICHETTI: I don't know, Your Honor, but I
`will look into it and provide you a response.
`JUDGE ARPIN: Thank you.
`JUDGE BOUDREAU: But, counsel, Patent Owner
`also contends that you conflated claim terms by mapping
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`
`
`
`21
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`Swimmer's generation of an audit trail to both the claims
`deriving DSP data and storing the DSP data in the database.
`Why isn't Patent Owner correct that you have
`conflated those terms?
`MR. RICHETTI: Because the emulator in
`Swimmer is what is generating the audit record. Right?
`That's what is creating the DSP data that includes suspicious
`operations.
`Now, when you look to what is the storing step,
`that's the audit trail. It is the aggregation of the audit
`records. So they are two completely different things.
`So, you know, I guess we don't see it even though
`the emulator, yes, that's what is doing the analysis on the
`incoming downloadable, and that is what is creating the audit
`record. And the audit record, that's the deriving step, that's
`the emulator, the emulator is deriving, and the audit trail is
`the storing of the DSP data in the database.
`So there is no -- to us there is no conflation at all.
`JUDGE BOUDREAU: What does it mean to derive
`DSP data?
`MR. RICHETTI: I would believe that it means,
`Your Honor, that you are identifying the potentially hostile
`operations. So you are analyzing an incoming downloadable
`and you are trying to pick and choose and say, okay, is this
`something that could cause harm?
`
`
`
`22
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`
`And that's all based on -- and the spec is very
`clear that it is about potentially hostile. Right? And that is
`the purpose of the deriving step.
`JUDGE BOUDREAU: And so in Petitioner's view
`all of the DOS operations are potentially hostile?
`MR. RICHETTI: Absolutely, yes, and our expert
`has testified to that.
`And it makes sense, and these are the very same
`operations that the '494 patent calls out. Alex, could you put
`on the slide? You know, just as an example, this is all in our
`papers, but slide 23 we've highlighted the '494 is on the left
`and Swimmer is on the right.
`But this isn't surprising because these are the very
`types of calls that are going to do harm. And back in this
`time period, the whole point of Swimmer is you are trying to
`detect unknown viruses, and so you have to, because they are
`unknown, right, I mean, again, Finjan makes much about how
`they teach away from databases and scanners.
`No. What Swimmer is saying is there was the old
`way of pattern matching and trying to use a lookup table for
`known viruses. That doesn't work very well in today's -- in
`1995. Swimmer says what we care about is we care about
`unknown viruses, and this is how they do it.
`They go about finding these functions that could
`be potentially harmful. They create audit records. Those
`
`
`
`23
`
`
`
`IPR2015-01892 and IPR2016-00890
`Patent 8,677,494 B2
`
`audit records get aggregated together to become an audit trail,
`and the audit trail ultimately gets analyzed by ASAX.
`Again, Your Honor, I'm concerned about my time
`but I do want to make sure I answer questions.
`JUDGE BOUDREAU: Yeah, I know that you
`wanted to reserve about 10 minutes and we are already five
`minutes into the 10 minutes. But we asked so many questions,
`we will take that into account and we won't penalize you.
`I will just give you another couple minutes to just
`sum up if there were any additional points that you wanted to
`make, and then we will give Patent Owner an equal amount of
`extra time.
`MR. RICHETTI: I appreciate that, Your Honor.
`JUDGE ARPIN: Counselor, before you begin your
`sum-up, though, turning back to F igure 3, the caption of that
`figure is: Excerpt f rom an Audit Trail of the Vienna V irus.
`Was the Vienna virus a known virus or an
`unknown virus when this trail was created?
`MR. RICHETTI: I don't believe I know that
`answer, Your Honor. I apologize. But, again, we can try to
`see if we can find it in the interim.
`JUDGE ARPIN: Well, I ask the question b
Accessing this document will incur an additional charge of $.
After purchase, you can access this document again without charge.
Accept $ Charge
Still Working On It
This document is taking longer than usual to download. This can happen if we need to contact the court directly to obtain the document and their servers are running slowly.
Give it another minute or two to complete, and then try the refresh button.
A few More Minutes ... Still Working
It can take up to 5 minutes for us to download a document if the court servers are running slowly.
Thank you for your continued patience.
This document could not be displayed.
We could not find this document within its docket. Please go back to the docket page and check the link. If that does not work, go back to the docket and refresh it to pull the newest information.
Your account does not support viewing this document.
You need a Paid Account to view this document. Click here to change your account type.
Your account does not support viewing this document.
Set your membership
status to view this document.
With a Docket Alarm membership, you'll
get a whole lot more, including:
- Up-to-date information for this case.
- Email alerts whenever there is an update.
- Full text search for other cases.
- Get email alerts whenever a new case matches your search.
One Moment Please
The filing “” is large (MB) and is being downloaded.
Please refresh this page in a few minutes to see if the filing has been downloaded. The filing will also be emailed to you when the download completes.
Your document is on its way!
If you do not receive the document in five minutes, contact support at support@docketalarm.com.
Sealed Document
We are unable to display this document, it may be under a court ordered seal.
If you have proper credentials to access the file, you may proceed directly to the court's system using your government issued username and password.
Access Government Site
