Paper No. ____
`Filed: July 15, 2016
`
`Filed on behalf of: Blue Coat Systems, Inc.
`By: Michael T. Rosato (mrosato@wsgr.com)
`Andrew S. Brown (asbrown@wsgr.com)
`Matthew A. Argenti (margenti@wsgr.com)
`WILSON SONSINI GOODRICH & ROSATI
`701 Fifth Avenue, Suite 5100
`Seattle, WA 98104-7036
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`_____________________________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`_____________________________
`
`
`
`BLUE COAT SYSTEMS, INC.,
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`Patent Owner.
`
`_____________________________
`
`Patent No. 8,225,408
`
`_____________________________
`
`
`
`PETITION FOR INTER PARTES REVIEW OF
`U.S. PATENT NO. 8,225,408
`
`
`
`

`
`
`
`TABLE OF CONTENTS
`
`I.
`
`Introduction .................................................................................................. 1
`
`A.
`
`The ’408 Patent, Prosecution History, and Priority Date ..................... 1
`
`B.
`
`Overview of the Prior Art ................................................................... 3
`
`Page
`
`i.
`
`ii.
`
`Chandnani (EX1007) ................................................................ 4
`
`Kolawa (EX1008) ..................................................................... 6
`
`iii. Knuth (EX1009) ....................................................................... 7
`
`iv. Huang (EX1010) ....................................................................... 8
`
`v. Walls (EX1011) ........................................................................ 8
`
`vi.
`
`Chandnani, Kolawa, Knuth, Huang, and Walls Are All
`Analogous Art........................................................................... 9
`
`C.
`
`Level of Skill in the Art .................................................................... 10
`
`II.
`
`Grounds for Standing .................................................................................. 10
`
`III. Mandatory Notices under 37 C.F.R. § 42.8 ................................................. 11
`
`A.
`
`Real Party-in-Interest (37 C.F.R. § 42.8(b)(1)).................................. 11
`
`B.
`
`C.
`
`Related Matters (37 C.F.R. § 42.8(b)(2)) .......................................... 11
`
`Lead and Back-Up Counsel (37 C.F.R. § 42.8(b)(3)) ........................ 12
`
`D.
`
`Service Information (37 C.F.R. § 42.8(b)(4)) .................................... 12
`
`IV. Statement of the Precise Relief Requested for Each Claim Challenged ....... 13
`
`V.
`
`Statement of Non-Redundancy ................................................................... 13
`
`VI. Claim Construction ..................................................................................... 14
`
`A.
`
`“parse tree” ....................................................................................... 14
`
`-i-
`
`

`
`B.
`
`C.
`
`D.
`
`“dynamically building ... while said receiving receives the
`incoming stream” .............................................................................. 15
`
`“dynamically detecting ... while said dynamically building
`builds the parse tree” ......................................................................... 15
`
`“instantiating ... a scanner for the specific programming
`language” .......................................................................................... 15
`
`
`
`VII. Detailed Explanation Of Grounds For Unpatentability ................................ 16
`
`A.
`
`Chandnani and Kolawa Disclose or Render Obvious Each
`Element of Independent Claims 1, 9, 23, and 29 ............................... 16
`
`i.
`
`ii.
`
`Independent Claim 1 ............................................................... 16
`
`Independent Claim 23 ............................................................. 36
`
`iii.
`
`Independent Claims 9 and 29 .................................................. 40
`
`B.
`
`C.
`
`D.
`
`[Ground 1] Claims 2, 11, 24-28, and 30-34 are Obvious under
`35 U.S.C. § 103 over Chandnani in view of Kolawa and Knuth ........ 41
`
`[Ground 2] Claim 8 is Obvious under 35 U.S.C. § 103 over
`Chandnani in view of Kolawa and Huang ......................................... 50
`
`[Ground 3] Claims 2, 11, 24-28, and 30-34 are Obvious under
`35 U.S.C. § 103 over Chandnani in view of Kolawa, Knuth, and
`Walls ................................................................................................ 56
`
`i.
`
`ii.
`
`Dynamically building a parse tree ........................................... 56
`
`Dynamically detecting potential exploits ................................ 58
`
`E.
`
`[Ground 4] Claim 8 is Obvious under 35 U.S.C. § 103 over
`Chandnani in view of Kolawa, Huang, and Walls ............................. 59
`
`VIII. Conclusion .................................................................................................. 60
`
`IX. Certificate of Compliance ........................................................................... 61
`
`X.
`
`Payment of Fees under 37 C.F.R. §§ 42.15(a) and 42.103........................... 62
`
`XI. Appendix – List of Exhibits ........................................................................ 63
`
`-ii-
`
`

`
`
`
`I.
`
`INTRODUCTION
`
`Blue Coat Systems, Inc., (“Blue Coat”) hereby requests inter partes review
`
`of U.S. Patent No. 8,225,408 to Rubin et al. (“the ’408 patent,” EX1001) that
`
`issued on July 17, 2012, and is currently assigned to Finjan, Inc. (“Patent Owner”).
`
`This Petition demonstrates that there is a reasonable likelihood that Petitioner will
`
`prove by a preponderance of the evidence that claims 2, 8, 11, 24-28, and 30-33 of
`
`the ’408 patent are unpatentable for failing to distinguish over prior art. Thus,
`
`claims 2, 8, 11, 24-28, and 30-33 of the ’408 patent should be found unpatentable
`
`and canceled.
`
`The Board has previously instituted inter partes review of the ’408 patent,
`
`including of the independent claims from which claims 2, 8, 11, 24-28, and 30-33
`
`depend, in Nos. IPR2015-02001 and IPR2016-00157 (“the PAN IPRs”). This
`
`Petition presents essentially the same disclosure and arguments for those
`
`independent claims. The additional requirements of the challenged dependent
`
`claims 2, 8, 11, 24-28, and 30-33 are insufficient to lend them patentability.
`
`A. The ’408 Patent, Prosecution History, and Priority Date
`
`Application No. 10/930,884 was filed on August 30, 2004 and issued on
`
`July 17, 2012 as U.S. Patent No. 8,225,408. The ’408 patent is entitled “METHOD
`
`AND SYSTEM FOR ADAPTIVE RULE-BASED CONTENT SCANNERS.” The
`
`’408 patent is directed at protecting computers against potentially malicious
`
`1
`
`

`
`
`
`programs using programming language-specific sets of rules and a “parse tree”
`
`data structure. EX1001 at Title, Abstract. The ’408 patent describes scanning an
`
`incoming stream of computer code by creating tokens, generating a parse tree
`
`using patterns in those tokens, and identifying patterns of tokens in the parse tree
`
`as potential exploits. See id. Patterns are identified using “parser rules” and
`
`“analyzer rules” specific to one of multiple programming languages.
`
`When the application that led to the ’408 patent was filed in 2004, there was
`
`already a crowded field of prior art security software that analyzed computer code
`
`for security problems such as viruses and other malicious code. After
`
`approximately four years of prosecution without a single allowed claim, the
`
`patentee was forced to amend each of the independent claims from which the
`
`challenged claims depend to add two elements: (1) multi-language scanning
`
`capability; and (2) the ability to “dynamically” analyze a parse tree as it was being
`
`built. See EX1004 at 40-53, 69-71. But as discussed below, numerous prior art
`
`references that were not before the Examiner—including the primary references
`
`discussed in this Petition—confirm that these features were both well-known and
`
`obvious for use in security scanners.
`
`The application that led to the ʼ408 patent was a continuation-in-part of
`
`Application No. 09/539,667 (now U.S. Patent No. 6,804,780), filed on March 30,
`
`2000, which is itself a continuation of Application No. 08/964,388 (now U.S.
`
`-2-
`
`

`
`
`
`Patent No. 6,092,194), filed on November 6, 1997. Although filed as a
`
`continuation-in-part, however, the ʼ408 patent shares almost nothing with these
`
`earlier-filed applications. The ʼ667 and ʼ388 applications describe a system that
`
`simply compares a downloadable application to a security policy and blocks the
`
`application if it violates the policy. See EX1005, EX1006. Neither of those
`
`applications describes a scanner that parses a data stream into tokens and searches
`
`for patterns that represent potential exploits. See id. Neither of those applications
`
`includes any of the figures that appear in the ʼ408 patent. See id. In fact, neither of
`
`those applications even mentions the terms “token,” “parse tree,” “analyzer rule,”
`
`“parser rule,” or “exploit”—and each of these terms appears throughout all
`
`independent claims of the ʼ408 patent. See id; see also EX1002 ¶¶19-20. In short,
`
`the ʼ667 and ʼ388 applications contain no disclosure supporting the challenged
`
`claims, which are therefore entitled to a priority date no earlier than August 30,
`
`2004, the ʼ408 patent’s own filing date.
`
`B. Overview of the Prior Art
`
`As explained in detail in the corresponding Declaration of Azer Bestavros,
`
`Ph.D. (EX1002) and addressed in further detail below (Supra Section VII), the
`
`challenged claims would not have been considered new or nonobvious to a person
`
`of ordinary skill in the art at the relevant time.
`
`-3-
`
`

`
`
`
`The grounds presented below all use the same base references: a
`
`combination of Chandnani’s multi-language scanner with Kolawa’s disclosure of
`
`parse trees for storing and analyzing code. The Board previously instituted trial of
`
`the independent claims of the ’408 patent against this combination in the PAN
`
`IPRs.
`
`Ground 1 combines Chandnani and Kolawa with Knuth. Knuth is cited for
`
`an explicit teaching of the well-known shift-and-reduce process, and to provide a
`
`basic description of the process for building a parse tree. Ground 2 combines
`
`Chandnani and Kolawa with Huang.1 Huang is cited for an explicit teaching of
`
`parsing embedded program code, which again was well-known Grounds 3 and 4
`
`are images of Grounds 1 and 2 with one additional prior art reference, Walls, that
`
`teaches pipelining techniques that satisfy the “dynamically building” and
`
`“dynamically detecting” limitations of the challenged claims. In the PAN IPRs,
`
`the Board instituted otherwise identical grounds both with and without Walls.
`
`Below is an overview of each prior art reference.
`
`i. Chandnani (EX1007)
`
`U.S. Patent Appl. Pub. No. 2002/0073330 (“Chandnani”), titled “Detection
`
`of Polymorphic Script Language Viruses by Data Driven Lexical Analysis,” was
`
`
`1 The Board has previously instituted trial against other dependent claims on
`
`the basis of the combination including Huang in the PAN IPRs.
`
`-4-
`
`

`
`
`
`filed on July 14, 2001. 2 Chandnani is prior art under 35 U.S.C. § 102(b) because it
`
`was published on June 13, 2002, more than one year before the filing date of the
`
`ʼ408 patent.
`
`Chandnani teaches detecting polymorphic script language viruses using
`
`data-driven lexical analysis. EX1007 at [0002]. Like the ʼ408 patent, Chandnani
`
`scans for polymorphic viruses—those that have slightly different code but the same
`
`malicious functionality—by converting a data stream into a stream of tokens and
`
`then searching for patterns that indicate the presence of potentially malicious
`
`programs. Id. at [0014]-[0020], [0056]-[0065]. Also like the ʼ408 patent,
`
`Chandnani scans a continuous stream of data, and continues to receive upstream
`
`data while analyzing downstream data. See, e.g., id. at [0057] (describing the data
`
`stream as a series of characters), [0060] (describing a two-stage detection process),
`
`Fig. 2. Although Chandnani may not expressly describe how tokens are parsed and
`
`analyzed, Chandnani suggests the use of a parse tree for storing tokens. EX1007 at
`
`[0040]-[0046]; EX1002 ¶¶ 29-32.
`
`
`2 This is the publication that corresponds with the date relied on in the PAN
`
`IPRs. Its disclosure is the same as the issued U.S. Patent No. 7,636,945 (EX1032)
`
`that was cited in the PAN IPRs.
`
`-5-
`
`

`
`
`
`ii. Kolawa (EX1008)
`
`
`
`U.S. Patent No. 5,860,011 (“Kolawa”), titled “Method and System for
`
`Automatically Checking Computer Source Code Quality Based on Rules,” was
`
`filed on February 29, 1996. Kolawa is prior art under 35 U.S.C. § 102(b) because
`
`it issued on January 12, 1999, more than one year before the August 30, 2004
`
`filing date of the ʼ408 patent.
`
`Kolawa teaches a method and system for rule-based evaluation of source
`
`code quality. EX1008 at 1:19-22. In particular, Kolawa discloses using a
`
`“conventional” lexical analyzer that scans code, groups it into tokens, and
`
`organizes the tokens using a parse tree:
`
`-6-
`
`

`
`
`
`The source code 10 is read as input to a lexical analyzer/parser 11
`
`which is conventional in the art. The lexical analyzer scans the source
`
`code 10 and groups the instructions into tokens. The parser performs
`
`the hierarchical analysis which groups the tokens into grammatical
`
`phrases that are represented by a parse tree 12.
`
`Id. at 3:66-4:4; see also id. at Fig. 1. Kolawa then searches the parse tree to
`
`identify problematic code based on a set of rules. See id. at 4:48-59. Kolawa
`
`reports rule violations as error messages that describe the corresponding quality
`
`concern. Id. at 4:59-60; EX1002 ¶¶33-34.
`
`iii. Knuth (EX1009)
`
`“On the Translation of Languages from Left to Right” (“Knuth”) was
`
`published in Information and Control in 1965. Knuth is prior art under 35 U.S.C.
`
`§ 102(b) because it was published more than one year before the August 30, 2004
`
`filing date of the ’408 patent.
`
`Knuth is a foundational paper describing the parsing of programming
`
`languages from left-to-right. EX1009 at Abstract; EX1002 ¶36. Knuth provides
`
`examples of parsing code and building parse trees using a shift-and-reduce process.
`
`EX1009 at 618-625, Tables I and II. In one example, detailed in Table I, Knuth
`
`describes the shift and reduce process: “’Shift’ means ‘perform the shift left
`
`operation’ mentioned in step 2; ‘reduce p’ means ‘perform the transformation (21)
`
`with production p.’” EX1009 at 620. Knuth also describes the basic parsing steps
`
`-7-
`
`

`
`
`
`of recursively matching patterns in strings and generating parent nodes attached to
`
`those patterns, thereby generating a parse tree. EX1009 at 609-610; EX1002 ¶36.
`
`iv. Huang (EX1010)
`
`U.S. Patent No. 6,968,539 (“Huang”), titled “Methods and Apparatus for a
`
`Web Application Processing System,” was filed on August 4, 2000. Huang is prior
`
`art under 35 U.S.C. § 102(e) because it was filed before the August 30, 2004 filing
`
`date of the ʼ408 patent.
`
`Huang teaches a method and system for processing web applications written
`
`in the form of web pages using, e.g., the programming language HTML. EX1010
`
`at Abstract, 5:7-20; EX1002 ¶38. Huang further teaches that scripting languages
`
`such as JavaScript are commonly used in web content such as HTML documents,
`
`and that they can be provided as program code embedded in an HTML document.
`
`EX1010 at 8:57-64; EX1002 ¶39.
`
`v. Walls (EX1011)
`
`U.S. Patent No. 7,284,274 (“Walls”), titled “System and Method for
`
`Identifying and Eliminating Vulnerabilities in Computer Software Applications,”
`
`was filed on January 18, 2002. Walls is prior art under 35 U.S.C. § 102(e) because
`
`it was filed before the August 30, 2004 filing date of the ʼ408 patent.
`
`Walls, like Kolawa, teaches a methodology for identifying potential source
`
`code vulnerabilities. EX1011 at Abstract. Like Kolawa, Walls also generates a
`
`-8-
`
`

`
`
`
`parse tree of the code being analyzed and then searches the parse tree for matches
`
`that indicate potential vulnerabilities. Id. at 7:25-31, 8:31-36. Walls uses a
`
`“pipelined” approach to analyze code in stages, such that different parts of a single
`
`code stream can be parsed and analyzed at the same time. Id. at 7:3-6; EX1002
`
`¶41. One advantage of this technique is “the advantage of pipelining the process
`
`where multiple components can be analyzed simultaneously.” EX1011 at 7:7-11.
`
`vi. Chandnani, Kolawa, Knuth, Huang, and Walls Are All
`Analogous Art
`
`Each prior art reference used in this Petition is analogous to the ʼ408 patent
`
`because it is in the same field of endeavor and/or is highly pertinent to the
`
`problems at which the ʼ408 patent is directed. EX1002 ¶¶ 42-55.
`
`The ʼ408 patent is directed to the field of rule-driven “content scanners” for
`
`program code. See EX1001 at Title, Abstract. Although the ʼ408 patent focuses
`
`on detecting malicious code, a person of ordinary skill in the art understood that
`
`scanning for malware involves the same or similar techniques as scanning for
`
`related code quality and security issues. See EX1002 ¶¶ 44-48.
`
`Each reference combined in this Petition is directed to scanning and
`
`analyzing programming code and to scanning for potential exploits and/or other
`
`security concerns. See EX1002 ¶¶50-55. For example, Chandnani is directed to
`
`analyzing code to detect potential viruses. See id. ¶50; EX1007. Kolawa discloses
`
`rule-based systems for detecting potential problems in source code. See EX1008 at
`
`-9-
`
`

`
`
`
`2:34-36 (“automatically checking source code quality based on rules”); EX1002
`
`¶¶51-52. Knuth is a foundational paper describing the parsing of programming
`
`languages from left-to-right. EX1009 at Abstract; EX1002 ¶53. Huang is directed
`
`to analyzing the code of web application to ensure, among other things, that no
`
`security rules are violated. See EX1010; EX1002 ¶54. Walls scans for security
`
`vulnerabilities in programming code. See EX1011; EX1002 ¶55.
`
`C. Level of Skill in the Art
`
`The ʼ408 patent is directed at the field of computer security programs,
`
`including content scanners for analyzing program code. EX1002 ¶57. At the time
`
`of the alleged invention in or around August 2004, a person of ordinary skill in the
`
`art held a bachelor’s degree or the equivalent in computer science (or related
`
`academic fields) and three to four years of additional experience in the field of
`
`computer security, or equivalent work experience. Id. ¶¶58-59.
`
`II. GROUNDS FOR STANDING
`
`Blue Coat certifies that, under 37 C.F.R. § 42.104(a), the ’408 patent is
`
`available for inter partes review, and Blue Coat is not barred or estopped from
`
`requesting inter partes review of the ’408 patent on the grounds identified.
`
`-10-
`
`

`
`
`
`III. MANDATORY NOTICES UNDER 37 C.F.R. § 42.8
`
`A. Real Party-in-Interest (37 C.F.R. § 42.8(b)(1))
`
`Petitioner Blue Coat Systems, Inc., a subsidiary of Blue Coat, Inc., is the real
`
`party-in-interest.
`
`On June 12, 2016, Blue Coat, Inc. and Symantec Corporation announced
`
`that they have entered into a definitive agreement under which Symantec will
`
`acquire Blue Coat, Inc. The transaction is expected to close in the third quarter of
`
`2016. As of the filing date of this Petition the transaction has not been executed
`
`and Symantec is not a privy of Blue Coat Systems, Inc. See, e.g., Synopsys, Inc. v.
`
`Mentor Graphics Corp., IPR2012-00042, Paper 16 at 15-16 (Feb. 22, 2013)
`
`(agreement to acquire insufficient to establish privity). Moreover, Symantec has
`
`not controlled or had the ability to control the filing of this petition, whether
`
`through funding or strategy. Symantec is not a real party-in-interest.
`
`B. Related Matters (37 C.F.R. § 42.8(b)(2))
`
`Finjan, Inc. (“Patent Owner” or “Finjan”) has asserted the ’408 patent in
`
`Finjan, Inc. v. Blue Coat Systems, Inc., No. 5-15-cv-03295 (N.D. Cal.); Finjan,
`
`Inc. v. Palo Alto Networks, Inc., No. 3-14-cv-04908 (N.D. Cal.); Finjan, Inc. v.
`
`FireEye, Inc., No. 4-13-cv-03113 (N.D. Cal.); and Finjan, Inc. v. Proofpoint, Inc.,
`
`No. 3-13-cv-05808 (N.D. Cal.).
`
`-11-
`
`

`
`
`
`Two inter partes reviews involving different claims of the ’408 patent,
`
`Nos. IPR2015-02001 and IPR2016-00157, each styled Palo Alto Networks, Inc. v.
`
`Finjan, Inc., were instituted on March 29, 2016 and consolidated into a single
`
`proceeding by the Board. Blue Coat has filed petitions and accompanying motions
`
`to join the PAN IPRs, which have been assigned Nos. IPR2016-00955 and -00956.
`
`This Petition challenges dependent claims not at issue in the PAN IPRs, though it
`
`relies on the same prior art and arguments with respect to the independent claims.
`
`C. Lead and Back-Up Counsel (37 C.F.R. § 42.8(b)(3))
`
`Lead Counsel: Michael T. Rosato (Reg. No. 52,182)
`
`Back-Up Counsel: Andrew S. Brown (Reg. No. 74,177)
`
`Matthew A. Argenti (Reg. No. 61,846)
`
`D.
`
`Service Information (37 C.F.R. § 42.8(b)(4))
`
`Blue Coat hereby consents to electronic service.
`
`Email: mrosato@wsgr.com; margenti@wsgr.com; asbrown@wsgr.com
`
`Post: WILSON SONSINI GOODRICH & ROSATI
`
`701 Fifth Avenue, Suite 5100
`
`Seattle, WA 98104-7036
`
`Tel.: 206-883-2529
`
`Fax: 206-883-2699
`
`-12-
`
`

`
`
`
`IV. STATEMENT OF THE PRECISE RELIEF REQUESTED FOR EACH
`CLAIM CHALLENGED
`
`Blue Coat requests inter partes review of claims 2, 8, 11, 24-28, and 30-33
`
`of the ’408 patent under 35 U.S.C. § 311 and AIA § 6 and that each challenged
`
`claim be determined unpatentable and canceled. The grounds of unpatentability
`
`are as follows:
`
`Ground
`
`Claims
`
`Description
`
`1
`
`2
`
`4
`
`5
`
`
`
`V.
`
`2, 11, 24-28,
`
`Obvious under § 103 over Chandnani, Kolawa, and
`
`30-34
`
`Knuth
`
`8
`
`Obvious under § 103 over Chandnani, Kolawa, and
`
`Huang
`
`2, 11, 24-28,
`
`Obvious under § 103 over Chandnani, Kolawa, Knuth,
`
`30-34
`
`and Walls
`
`8
`
`Obvious under § 103 over Chandnani, Kolawa, Huang,
`
`and Walls
`
`STATEMENT OF NON-REDUNDANCY
`
`Although Blue Coat has filed earlier petitions for IPR of the ’408 patent, this
`
`Petition is not redundant, because it does not challenge the same claims previously
`
`challenged. As noted above in the identification of related matters, Blue Coat filed
`
`joinder petitions seeking to join the PAN IPRs. Those earlier, still-pending joinder
`
`petitions are limited to challenging claims 1, 3-7, 9, 12-16, 18-23, 29, and 35, the
`
`same claims for which the Board instituted trial in those proceedings. Blue Coat
`
`-13-
`
`

`
`
`
`could not reasonably have addressed claims 2, 8, 11, 24-28, and 30-33 in those
`
`petitions, because doing so would have raised issues not present in the PAN IPRs
`
`and jeopardized Blue Coat’s joinder requests. Accordingly, this Petition advances
`
`challenges to claims 2, 8, 11, 24-28, and 30-33 not previously presented by Blue
`
`Coat, and is not redundant of Blue Coat’s joinder petitions. See, e.g., Life Techs.
`
`Corp. v. Unisone Strategic IP, Inc., CBM2016-00035, Paper 7 at 18-19 (July 5,
`
`2016) (declining to exercise discretion to deny petition under § 325(d) where
`
`second CBM petition challenged different set of claims than first).
`
`VI. CLAIM CONSTRUCTION
`
`A claim subject to inter partes review receives the broadest reasonable
`
`construction in light of the specification of the patent in which it appears. Cuozzo
`
`Speed Techs., Inc. v. Lee, -- S. Ct. ----; 2016 WL 3369425 *10 (June 20, 2016); see
`
`also 37 C.F.R. § 42.100(b).
`
`A.
`
`“parse tree”
`
`The broadest reasonable interpretation of the term “parse tree” includes “a
`
`hierarchical structure of interconnected nodes built from scanned content.” The
`
`Board adopted this construction in the PAN IPRs. IPR2015-02001, Paper 7 at 8.
`
`Moreover, this construction is consistent with the understanding of a person of
`
`ordinary skill in the art in view of the specification. EX1002 ¶62.
`
`-14-
`
`

`
`
`
`B.
`
`“dynamically building ... while said receiving receives the
`incoming stream”
`
`The broadest reasonable interpretation of the term “dynamically building ...
`
`while said receiving receives the incoming stream” includes “a time period for
`
`dynamically building overlaps with a time period during which the incoming
`
`stream is being received.” The Board adopted this construction in the PAN IPRs.
`
`IPR2015-02001, Paper 7 at 8. Moreover, this construction is consistent with the
`
`understanding of a person of ordinary skill in the art in view of the specification.
`
`EX1002 ¶63.
`
`C.
`
`“dynamically detecting ... while said dynamically building builds
`the parse tree”
`
`The broadest reasonable interpretation of the term “dynamically detecting ...
`
`while said dynamically building builds the parse tree” includes “a time period for
`
`dynamically detection overlap with a time period during which the parse tree is
`
`built.” The Board adopted this construction in the PAN IPRs. IPR2015-02001,
`
`Paper 7 at 9. Moreover, this construction is consistent with the understanding of a
`
`person of ordinary skill in the art in view of the specification. EX1002 ¶64.
`
`D.
`
`“instantiating ... a scanner for the specific programming
`language”
`
`The broadest reasonable interpretation of the term “instantiating ... a scanner
`
`for the specific programming language” includes “substituting specific data,
`
`instructions, or both into a generic program unit to make it usable for scanning the
`
`-15-
`
`

`
`
`
`specific programming language.” The Board adopted this construction in the PAN
`
`IPRs. IPR2015-02001, Paper 7 at 10. Moreover, this construction is consistent with
`
`the understanding of a person of ordinary skill in the art in view of the
`
`specification. EX1002 ¶65.
`
`VII. DETAILED EXPLANATION OF GROUNDS FOR
`UNPATENTABILITY
`
`A. Chandnani and Kolawa Disclose or Render Obvious Each
`Element of Independent Claims 1, 9, 23, and 29
`
`Although not directly challenged in this Petition, each of the challenged
`
`claims depend from one of claim 1, 9, 23, or 29. These independent claims recite
`
`essentially the same elements in method (claims 1 and 23) and system (claims 9
`
`and 29) form. As described in more detail below, each and every element of
`
`independent claims 1, 9, 23, and 29 is obvious under 35 U.S.C. § 103 over
`
`Chandnani and Kolawa. This is the same combination of prior art over which the
`
`Board instituted review of claims 1, 9, 23, and 29 in the PAN IPRs.
`
`i.
`
`Independent Claim 1
`
`To the extent that the claim 1 preamble is limiting, Chandnani in view of
`
`Kolawa discloses the claim 1 preamble:
`
`’408 Patent
`
`1. A computer
`processor-based
`multi-lingual
`method for
`scanning
`
`Chandnani in view of Kolawa
`
`“The data stream corresponding to a file to scan is tokenized
`by lexical analysis .... To tokenize the data stream, a script
`language used in the data stream is determined using the
`language check data. The data stream is analyzed using the
`language check data to select the language definition data to
`
`-16-
`
`

`
`incoming
`program code,
`comprising:
`
`
`
`use for the detection process.” EX1007 at [0062].
`
`“In one embodiment, the method includes preparing language
`description data corresponding to at least one script
`language ....” EX1007 at [0014].
`
`“FIG. 1 illustrates a computer system or computer 70 on
`which a potentially infected file may execute and/or reside
`(and which thus may be a target of a script language virus).
`Computer system 70 comprises a processor 71 ....” Chandnani
` at [0030].
`
`See also EX1002 ¶69-77.
`
`Chandnani discloses a computer system, including a processor, that scans an
`
`incoming data stream. EX1007 at [0014] (“method of detecting a script language
`
`virus” includes “analyzing a data stream”), [0030] (“Computer system 70
`
`comprises a processor 71”), [0062], Figs. 1-3. Chandnani’s system and method are
`
`multi-lingual, using “language check data” to determine the language used in the
`
`stream, and “select[ing] the language definition data to use for the detection
`
`process.” Id. at [0062], [0035].
`
`Chandnani in view of Kolawa discloses element 1.1:
`
`’408 Patent
`
`[1.1] receiving,
`by a computer,
`an incoming
`stream of
`program code;
`
`Chandnani in view of Kolawa
`
` “This disclosure provides tools (in the form of apparatus,
`systems and methods) for detecting script language viruses by
`performing a lexical analysis of a data stream on a computing
`device/system. The data stream may be generated from a
`potentially infected file (“subject file”). The subject file may
`be stored on a storage medium, such as hard disk or floppy
`disk, or received via a network, such as the Internet, or a wired
`or wireless transmission medium, such as telephone landlines
`or RF airwaves.” EX1007 at [0029].
`
`See also EX1002 ¶78.
`
`-17-
`
`

`
`
`
`Chandnani discloses that “[t]he data stream may be generated from a
`
`potentially infected file,” which may be “received via a network, such as the
`
`Internet.” EX1007 at [0029]; see also id. at [0057].
`
`Chandnani in view of Kolawa discloses element 1.2:
`
`’408 Patent
`
`[1.2]
`determining, by
`the computer,
`any specific one
`of a plurality of
`programming
`languages in
`which the
`incoming stream
`is written;
`
`Chandnani in view of Kolawa
`
`“The present disclosure provides for detecting script language
`viruses by lexical analysis. Before the analysis is commenced,
`target script languages, including their constituent parts,
`which may be used by the script language viruses, are
`identified/defined.” EX1007 at [0034].
`
`See also EX1007 at [0062].
`
`See also EX1002 ¶79.
`
`Chandnani determines the programming language of the data stream using
`
`“language check data” to determine the script language used in the data stream,
`
`and then “select[ing] the language definition data to use for the detection process.”
`
`EX1007 at [0062]. “Language check rules, which define characteristics of the
`
`target script languages, differentiate one language (or group of languages) from
`
`another language (or group of languages).” Id. at [0035].
`
`Chandnani in view of Kolawa discloses element 1.3:
`
`’408 Patent
`
`Chandnani in view of Kolawa
`
`[1.3]
`instantiating, by
`the computer, a
`scanner for the
`
`“The data stream corresponding to a file to scan is tokenized
`by lexical analysis. The data stream is fed to a lexical analyzer
`(not shown) in the detection engine which generates a stream
`of tokens. To tokenize the data stream, a script language used
`
`-18-
`
`

`
`
`
`specific
`programming
`language, in
`response to said
`determining,
`
`in the data stream is determined using the language check
`data. The data stream is analyzed using the language check
`data to select the language definition data to use for the
`detection process. Next, the selected language definition data
`and the data stream are supplied to the lexical analyzer. The
`data stream is lexically analyzed again, this time using the
`language definition data, to generate a stream of tokens.”
`EX1007 at [0062].
`
`See also EX1007 at Figs. 2, 6, and 7.
`
`See also EX1002 ¶¶80-81.
`
`The term “instantiating . . . a scanner for the specific programming
`
`language” is interpreted as “making a language-specific scanner available for use.”
`
`See supra § VI. Chandnani discloses a “lexical analyzer” (part of the “detection
`
`engine” shown in Figure 2). See EX1007 at Fig. 2, [0062]; EX1002 ¶¶ 80-81.
`
`Chandnani’s detection engine uses “language check data” to determine the script
`
`language used in the data stream, and then “select[s] the language definition data to
`
`use for the detection process.” EX1007 at [0062]; see also id. at Figs. 2, 6, 7.
`
`Chandnani makes a language-specific scanner available for use by supplying the
`
`selected language definition data and the data stream to the lexical analyzer, which
`
`scans the incoming data stream. See id. at [0062].
`
`Chandnani in view of Kolawa discloses element 1.4:
`
`’408 Patent
`
`Chandnani in view of Kolawa
`
`[1.4] the scanner
`comprising
`parser rules and
`analyzer rules for
`the specific
`
`“An exemplary process for generating language description
`data for target script languages will be described with
`reference to FIGS. 2 and 4. Sets of language definition rules
`are defined for the respective target script languages and
`stored in rule base 54 (step 11). Language check rules are
`
`-19-
`
`

`
`programming
`language,
`
`
`
`defined and also stored in rule base 54 (step 13). Next, the
`language definition rules and language check rules are
`processed by script language processor 51 to generate
`language description data for the respective target script
`languages (step 15). The language description data for the
`target script languages are stored in the language description
`data module 55 (step 17).” EX1007 at [0037].
`
`“The language description data