BACnet
`
`May15, 2017
`
`BRYAN CAVELLP 1290 Avenueof the Americas, New York, NY 10104-3300
`
`T:2125412000 F:2125414630 bryancave.com
`
`Teresa Concia Rodriguez
`Paralegal
`Direct: 212-541-1214
`
`tcrodriguez@bryancave.com
`
`VIA EXPRESS MAIL
`(Express Mail Label No. EL 383828039 US)
`
`Office of the General Counsel
`
`United States Patent and Trademark Office
`P.O. Box 1450
`Alexandria, VA 22313-1450
`
`Re:=Symantec Corp. and Blue Coat Systems LLC, v. Finjan, Inc.
`Inter Partes Renew No. 2015-01892 (U.S. Patent No. 8,677,494)
`United States Patent and Trademark Office, Patent Trial and Appeal Board
`
`Dear Director:
`
`Enclosed herewith in connection with the above-identified case, please find the
`original “Petitioner’s Notice of Appeal”.
`
`Very truly yours,
`
`Teresa C. Rodriguez
`Paralegal
`
`/ter
`Enclosures
`
`
`
`

`

`Case IPR 2015-01892
`U.S. Patent No. 8,677,494
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`SYMANTEC CORP., and
`BLUE COAT SYSTEMSLLC,
`Petitioner
`
`V.
`
`FINIAN,INC.
`Patent Owner
`
`Case: IPR2015-01892'
`USS. Patent No. 8,677,494
`
`CONSOLIDATED FILING:
`
`
`
`PETITIONER’S NOTICE OF APPEAL
`
`' Case IPR2016-00890 has been joined with the instant proceeding
`
`

`

`Case IPR 2015-01892
`| USS. Patent No. 8,677,494
`
`Symantec Corporation and Blue Coat Systems LLC (collectively,
`
`“Petitioner”) hereby gives notice, pursuant to 35 U.S.C. § 142 and 37 CFR. §
`
`90.2(a), of its appeal to the United States Court of Appeals for the Federal Circuit
`from the Final Written Decision of the Patent Trial and Appeal Board (“the
`Board”), entered on March 15, 2017 (Paper 58), and from all orders, decisions,
`rulings, and opinions underlying the Final Written Decision.
`In accordance with 37 C-F.R. § 90.2(a)(3)Q)), Petitioner anticipates that the
`issues on appeal may include the following:
`
`Whether the Board erred in determining that claims 5, 10, 11,
`14 and 15 ofU.S. Patent No. 8,677,494 have not been shown to
`be unpatentable under 35 U.S.C.§ 103.
`
`Petitioner reserves the right
`
`to challenge any finding or determination
`
`supporting or related to the issues listed above and to challenge any other issues _
`
`decided adversely to Petitioner in any orders, decisions, rulings, or opinions
`
`underlying the Final Written Decision, including (without limitation) any such
`findings, determinations, or issues in the Board’s Institution Decision entered on
`
`_ March 18, 2016 (Paper 9).
`
`

`

`Case IPR 2015-01892
`U.S. Patent No. 8,677,494
`
`Copies of Petitioner’s Notice of Appeal are being filed simultaneously with
`
`the United Stated Patent and Trademark Office, the Patent Trial and Appeal Board,
`
`and the United States Court of Appeals for the Federal Circuit.
`
`Date: May 15, 2017
`
`Respectfully submitted,
`
`By:_/Joseph J. Richetti/
`Joseph J. Richetti (Reg. No. 47,024)
`BRYAN CAVE LLP
`1290 Avenue of the Americas
`New York, NY 10104
`Tel: (212) 541-1092
`Fax: (212) 541-4630
`joe.richetti@bryancave.com
`Attorneyfor Petitioner — Symantec Corporation
`
`By:_/Michael T. Rosato/
`Michael T. Rosato (Reg. No. 52,182)
`WILSON SONSINI GOODRICH & ROSATI
`701 Fifth Avenue, Suite 5100
`Seattle, WA 98104
`Tel: (206) 883-2529
`Fax: (206) 883-2699 —
`mrosato@wspr.com
`Attorneyfor Petitioner — Blue Coat Systems LLC
`
`

`

`Case IPR 2015-01892
`‘U.S. Patent No. 8,677,494
`
`CERTIFICATE OF SERVICE
`
`The undersigned hereby certifies
`
`that,
`
`in
`
`addition to being filed
`
`electronically through the Patent Trial and Appeal Board's Patent Review
`
`Processing System (PRPS), the original version of the foregoing PETITIONER’S
`
`NOTICE OF APPEAL was filed by Express Mail (Express Mail Label No.
`EL 383828039 US)on May15, 2017, with the United States Patent and Trademark
`Office, at the following address:
`|
`Office of the General Counsel
`United States Patent and Trademark Office
`.
`P.O. Box 1450
`Alexandria, VA 22313-1450
`
`CERTIFICATE OF SERVICE
`
`The undersigned hereby certifies
`
`that
`
`the foregoing PETITIONER’S
`
`NOTICE OF APPEAL waselectronically filed with the United States Court of
`
`Appeals for the Federal Circuit through CM/ECFand pay.gov on May15, 2017. -
`
`

`

`Case IPR 2015-01892
`U.S. Patent No. 8,677,494
`
`CERTIFICATE OF SERVICE
`
`The undersigned herebycertifies that the foregoing PETITIONER’S
`
`‘NOTICE OF APPEAL,wasserved electronically via e-mail on May 15, 2017, in
`
`its entirety on the following:
`
`James Hannah
`KRAMERLEVIN NAFTALIS &
`FRANKEL LLP
`990 Marsh Road
`Menlo Park, CA 94025
`jhannah@kramerlevin.com
`
`Michael Kim
`Finjan, Inc.
`2000 University Ave., Ste. 600
`E. Palo Alto, CA 94303
`mkim@finjan.com
`
`Respectfully submitted,
`
`By:_/Joseph J. Richetti/
`~ Joseph J. Richetti (Reg. No. 47,024)
`BRYAN CAVE LLP
`1290 Avenue of the Americas
`New York, NY 10104
`Tel: (212) 541-1092
`Fax: (212) 541-4630
`joe.richetti@bryancave.com
`
`Attorneyfor Petitioner— Symantec
`Corporation
`
`Date: May 15, 2017
`
`Jeffrey H. Price
`KRAMER LEVIN NAFTALIS &
`FRANKEL LLP
`1177 Avenue of the Americas
`New York, NY 10036 -
`jprice@kramerlevin.com
`
`By:_/Michael T. Rosato/
`Michael T. Rosato (Reg. No. 52,182)
`WILSON SONSINI GOODRICH &
`ROSATI
`701 Fifth Avenue, Suite 5100
`Seattle, WA 98104°
`Tel: (206) 883-2529
`Fax:
`(206) 883-2699
`mrosato@wsgr.com
`
`Attorneyfor Petitioner— Blue Coat
`Systems LLC
`
`

`

`Trials@uspto.gov
`$71-272-7822
`
`Paper: 58
`Entered: March 15, 2017
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`SYMANTEC CORP. and
`BLUE COAT SYSTEMSLLC,
`Petitioner,
`
`V.
`
`FINJAN, INC.,
`Patent Owner.
`
`Case IPR2015-01892!
`Patent 8,677,494 B2
`
`Before ZHENYU YANG, CHARLESJ. BOUDREAU,and
`SHEILA F. McSHANE,Administrative Patent Judges.
`
`BOUDREAU,Administrative Patent Judge.
`
`FINAL WRITTEN DECISION
`35 U.S.C. § 318(a) and 37 CFR. § 42.73
`
`' Case IPR2016-00890 has been joined with the instant proceeding.
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`I. INTRODUCTION
`
`Symantec Corp. and Blue Coat Systems, Inc., now known as Blue
`Coat Systems LLC,’ (collectively, “Petitioner’) filed petitions requesting
`inter partes review of claims 1, 2, 5, 6, 10, 11, 14, and 15 of U.S. Patent
`No. 8,677,494 B2 (Ex. 1001, “the °494 patent”). Paper 1 (“Petition” or
`
`“Pet.’’); see also IPR2016-00890, Paper 2.
`
`Based on the information providedin the Petition, and in
`
`consideration of the Preliminary Response (Paper 7) of Patent Owner,
`Finjan,Inc., we instituted a trial pursuant to 35 U.S.C. § 314(a) with respect
`to claims 1, 2, 5, 6, 10, 11, 14, and 15 and subsequently joined Case
`
`IPR2016-00890 with the instant case. Paper 9 (“Decision onInstitution” or
`
`“Dec. on Inst.”); see also Paper 30 (copy of decision instituting inter partes
`review in Case IPR2016-00890 and granting motion for joinder; also filed as
`
`IPR2016-00890, Paper8).
`After institution, Patent Ownerfiled a Partial Request for Rehearing
`
`Pursuant to 37 C.F.R. §§ 42.71(c) and 42.71(d) (Paper 13), challenging our
`decision to institute trial, and weissued a Decision Denying Patent Owner’s
`Request for Rehearing (Paper 21, “Rehearing Decision”or “Reh’g Dec.”).
`Thereafter, Patent Ownerfiled a Response (Paper 27 (“PO Resp.”)), and
`Petitioner filed a Reply (Paper 31, “Pet. Reply”). Petitioner proffered
`
`Declarations of Sylvia Hall-Ellis, Ph.D. (Ex. 1006) and Jack W.
`Davidson, Ph.D. (Ex. 1018) with its Petition; and a Reply Declaration of
`Dr. Davidson (Ex. 1027), a Supplemental Declaration of Dr. Hall-Ellis
`(Ex. 1037), and Declarations of Richard Ford, D.Phil. (Ex. 1038) and Joseph
`
`> See Paper 54, 1.
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`Kiegel (Ex. 1041) with its Reply. Patent Ownerproffered Declarations of
`
`Nenad Medvidovic, Ph.D. (Ex. 2007) and S.H. Michael Kim (Ex. 2010) with
`
`its Response. Also, deposition transcripts were filed for Dr. Medvidovic
`
`(Ex. 1034), Dr. Hall-Ellis (Ex. 2011), and Dr. Davidson (Ex. 2012).
`
`Patent Owner movesto exclude certain of Petitioner’s Exhibits,
`
`including each of the Declarations proffered with the Reply. Paper 41.
`
`Petitioner filed an Opposition (Paper 48) to the motion, and Patent Owner
`
`filed a reply (Paper 51).
`
`Patent Owneralso filed an identification of arguments alleged to
`
`exceed the proper scope of Petitioner’s Reply (Paper 39), to which Petitioner
`
`filed a response (Paper 46). Patent Ownerfurther filed a Motion for
`
`Observations on Testimony of Dr. Davidson (Paper 42), and Petitioner filed
`
`a response thereto (Paper 47).
`
`An oral hearing was held on December16, 2016; a transcript of the
`
`hearing is includedin the record (Paper 56, “Tr.”’).
`
`Wehavejurisdiction under 35 U.S.C. § 6. This Final Written
`
`Decision is issued pursuant to 35 U.S.C. § 318(a) and 37 C.F.R. § 42.73.
`
`For the reasonsthat follow, we determine that Petitioner has shown by a
`
`preponderanceofthe evidencethat claims 1, 2, and 6 of the ’494 patent are
`
`unpatentable.
`
`Wealso deny-in-part and dismiss-in-part Patent Owner’s Motion to
`
`Exclude.
`
`Il. BACKGROUND
`
`A. Related Proceedings
`
`The parties identify six district court actions involving the ’494 patent:
`
`Finjan, Inc. v. Sophos, Inc., No. 3:14-cv-01197 (N.D. Cal. 2014) (“the
`
`3
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`Sophoslitigation”), Finjan v. Websense, Inc., No. 14-cv-01353 (N.D. Cal.
`
`2014), Finjan, Inc. v. Symantec Corp., No. 3:14-cv-02998 (N.D. Cal. 2014),
`
`Finjan, Inc. v. Palo Alto Networks, Inc., No. 3:14-cv-04908 (N.D. Cal.
`
`2014), Finjan, Inc. v. Blue Coat Systems, Inc., No. 5:15-cv-03295 (N.D. Cal.
`
`2015), and Finjan, Inc. v. Cisco Systems Inc., No. 17-cv-00072 (N.D. Cal.
`
`2017). Pet. 1; Paper 6, 1; PO Resp. 57; Paper 54, 1.
`
`The °494 patent is also the subject of an inter partes review in Palo
`
`Alto Networks, Inc. v. Finjan, Inc., Case IPR2016-00159, to which Blue
`
`Coat Systems, Inc. v. Finjan, Inc., Case IPR2016-01174, has been joined;
`
`and wasthe subject of denied petitions for inter partes review in Sophos Inc.
`
`v. Finjan, Inc., Case IPR2015-01022, Symantec Corp. v. Finjan, Inc., Case
`
`IPR2015-01897, and Blue Coat Systems, Inc. v. Finjan, Inc., Case
`
`IPR2016-01443.
`
`B. The ’494 Patent
`
`The °494 patent, entitled “Malicious Mobile Code Runtime
`
`Monitoring System and Methods,” issued March 18, 2014, from U.S. Patent
`
`Application No. 13/290,708 (“the ’708 application’’), filed November7,
`
`2011. Ex. 1001, [21], [22], [45], [54]. On its face, the °494 patent purports
`to claim priority from nineearlier applications: (1) U.S. Provisional
`Application No. 60/030,639 (“the 639 provisional”), filed November8,
`
`1996; (2) U.S. Patent Application No. 08/790,097, filed January 29, 1997,
`
`and issued as U.S. Patent No. 6,167,520 (“the 520 patent”); (3) U.S. Patent
`
`Application No. 08/964,388 (‘the ?388 application”), filed November6,
`
`1997, and issued as U.S. Patent No. 6,092,194 (Ex. 1013, “the ’194 patent”);
`
`(4) U.S. Patent Application No. 09/539,667, filed March 30, 2000, and
`
`issued as U.S. Patent No. 6,804,780 (Ex. 2028, “the ’780 patent’);
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`(5) U.S. Patent Application No. 09/551,302, filed April 18, 2000;
`
`(6) U.S. Provisional Patent Application No. 60/205,591, filed May 17, 2000;
`
`(7) U.S. Patent Application No. 09/861,229, filed May 17, 2001;
`
`(8) U.S. Patent Application No. 11/370,114 (“the ’114 application”), filed
`
`March 7, 2006; and (9) U.S. Patent Application No. 12/471,942, filed
`
`May26, 2009. Ex. 1001, [63]. In our Decision on Institution in Case
`
`IPR2016-00159, we determined on the record then before us in that case that
`
`the ’494 patent is not entitled to an earlier priority date than the November6,
`
`1997, filing date of the ’388 application, due to the failure of the
`
`intermediate ’114 application to includepriority claimseither to the
`
`’639 provisional or to the °097 application. See IPR2016-00159, slip op. at
`
`10-13 (PTAB May 13, 2016) (Paper 8). That determination does notaffect
`
`any of our conclusionsin this case.
`
`The ’494 patent describes protection systems and methods “capable of
`
`protecting a personal computer (‘PC’)or otherpersistently or even
`
`intermittently network accessible devices or processes from harmful,
`
`undesirable, suspicious or other ‘malicious’ operations that might otherwise
`
`be effectuated by remotely operable code.” Ex. 1001, 2:51-56. “Remotely
`
`operable codethat is protectable against can include,” for example,
`
`“downloadable application programs, Trojan horses and program code
`
`groupings, as well as software ‘components’, such as Java™ applets,
`
`ActiveX™controls, JavaScript™/Visual Basic scripts, add-ins, etc., among
`
`others.” Jd. at 2:59-64.
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`C. Illustrative Challenged Claims
`
`Ofthe challenged claims, claims 1 and 10 are independent. Those
`
`claimsare illustrative and are reproduced below:
`
`1. A computer-based method, comprising the stepsof:
`receiving an incoming Downloadable;
`deriving security profile data for the Downloadable,
`includingalist of suspicious computer operations that may be
`attempted by the Downloadable; and
`storing the Downloadable security profile data in a database.
`
`10. A system for managing Downloadables, comprising:
`a receiver for receiving an incoming Downloadable;
`a Downloadable scanner coupled with said receiver, for
`deriving security profile data for the Downloadable, including a
`list of suspicious computer operations that may be attempted by
`the Downloadable; and
`
`a database manager coupled with said Downloadable
`scanner, for storing the Downloadable security profile data in a
`database.
`
`Ex. 1001, 21:19-25, 22:7-16. Each of challenged claims 2, 5, and 6
`
`depends directly from claim 1; and each of challenged claims 11, 14, and 15
`
`dependsdirectly from claim 10. Jd. at 21:26—28, 21:33-37, 22:17-20,
`
`22:26-30.
`
`D. Instituted Ground of Unpatentability
`
`The Petition asserted five grounds of unpatentability. Pet. 5. We
`
`institutedtrial in this case only on the asserted groundthat claims1, 2, 5, 6,
`
`10, 11, 14, and 15 of the ’494 patent are unpatentable under 35 U.S.C. § 103
`
`over Morton Swimmeret al., Dynamic Detection and Classification of
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`Computer Viruses Using General Behaviour Patterns, Virus Bull. Conf. 75
`
`(Sept. 1995) (Ex. 1005, “Swimmer’’). Dec. on Inst. 34.
`
`I. ANALYSIS
`
`A. Claim Construction
`
`The ’494 patent expired no later than January 29, 2017. See Paper 55,
`
`1 (Patent Ownerrepresenting that January 29, 2017, was the expiration date
`
`of the ’494 patent and that Petitioner does not dispute that date). In an inter
`
`partes review, we construe claims of an expired patent according to the
`
`standard applied by the district courts. See In re Rambus Inc., 694 F.3d 42,
`
`46 (Fed. Cir. 2012). Specifically, because the expired claims of a patentare
`
`not subject to amendment, we apply the principles set forth in Phillipsv.
`
`AWH Corp., 415 F.3d 1303, 1312-17 (Fed. Cir. 2005) (en banc). Under that
`
`standard, the words of a claim are generally given their ordinary and
`
`customary meaning, which is the meaning the term would haveto a person
`
`of ordinary skill at the time of the invention, in the contextof the entire
`
`patent including the specification. See Phillips, 415 F.3d at 1312-13. Only
`
`those terms in controversy need to be construed, and only to the extent
`
`necessary to resolve the controversy. See Vivid Techs., Inc. v. Am. Sci. &
`
`Eng’g, Inc., 200 F.3d 795, 803 (Fed. Cir. 1999).
`
`For purposes of this Decision, we address three claim terms and
`
`phrases, each of whichis recited in both independent claims 1 and 10:
`
`(1) “list of suspicious computer operations”; (2) “database”; and (3) “storing
`
`the Downloadable security profile data in a database.”
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`I. “list ofsuspicious computer operations”
`
`Neither party identified “list of suspicious computer operations” as
`
`requiring construction priorto institution, and we did not provide an express
`
`construction of that phrase in the Decision on Institution. In the Decision on
`Institution, we were persuaded, however, by Petitioner’s contentions that the
`DOSfunctions correspondingto the “function numbers” included in
`
`Swimmer’s audit trail include the same types of operationsreferred to by
`
`applicationsrelated to the ’494 patent as examples of “suspicious
`
`operations,” including the four specific types of operations that are recited as
`
`“suspicious computer operations” in challenged dependent claims 6 and 15.
`
`Dec.on Inst. 22 (citing Pet. 17-18, 21—22).
`
`In the Patent Owner Response, Patent Ownercontends“[a] ‘list of
`
`suspicious computer operations’ is properly construedas ‘a list of computer
`
`operations deemed suspicious’” (PO Resp. 10). According to Patent Owner,
`
`“Tt]he ’494 Patent requires this construction, specifically that the operations
`
`are deemedto be suspicious.” Jd. “For example,” Patent Owner contends,
`
`“the ’194 Patent, which is incorporated by reference into the °494 Patent,
`
`explains how generating the ‘list of suspicious computer operations’ first
`
`requires that a determination be made as to whether the operations to be
`
`listed are suspicious.” Jd. (citing Ex. 1013, 9:20-42,Fig. 7; Ex. 2007 4] 47—
`
`48, 65). Patent Ownerfurther contendsthat Petitioner’s argument that DOS
`
`function numbersidentified by Swimmer correspondto the same types of
`
`operations identified in one related application(i.e., the °639 provisional,
`
`Ex. 1002),is both factually incorrect, in that the cited portion of the ’639
`provisional“relates to ‘fundamental computer operations,’ not “suspicious
`
`computer operations[’]” (/d. at 10-11 (citing Ex. 1002, 18:9-13)), and
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`contrary to the law,in “relying on knowledge gleaned from the ’494 Patent
`
`itself—namely the insight to deem some subsetof ‘calls made to an
`
`operating system,a file system, a network system, and to memory’ as
`
`suspicious in deriving a list of the suspicious computer operations that may
`
`be attempted by a Downloadable”(id. at 11).
`
`Regarding the first point, Patent Owner points out that certain
`
`disclosure in the ’194 patent“actually relates to ‘suspicious computer
`
`operations,” providing “An Example List of Operations Deemed
`
`Potentially Hostile.” Jd. (citing Ex. 1013, 5:50-54; quoting Ex. 1013, 5:58—
`
`6:4 (emphasis added by Patent Owner)). Patent Owner contends this
`
`“‘mean[s] that there is no a priori understanding of what constitutes a
`
`‘suspicious computer operation,’” but “[r]ather, some subsetofall possible
`
`computer operations must first be deemed suspicious in order to derivealist
`
`of suspicious computer operations for a Downloadable.” Jd. (citing Ex.
`
`1013, 5:58-6:4, 9:20-42, Fig. 7). Regarding the second point, Patent Owner
`
`argues, “in assessing obviousness Petitioner may consider ‘only knowledge
`
`which was within the level of ordinary skill in the art at the time the claimed
`
`invention was made,’ but may not consider the claimed inventionitself.” Id.
`
`at 11-12 (quoting Jn re McLaughlin, 443 F.2d 1392, 1395 (CCPA 1971)).
`
`Finally, Patent Owner contends “the Board appears to have misunderstood
`
`how dependentclaims 6 and 15 limit claims 1 and 10, respectively,” as
`
`“claims 6 and 15 do not equate all ‘calls made to an operating system,a file
`
`system, a network system, and to memory’ with suspicious computer
`
`operations... .” Jd. at 12 (citing Dec. on Inst. 22). Rather, Patent Owner
`
`contends,“a person of ordinary skill in the art would understand these
`
`claims to require that certain ‘calls made to an operating system,a file
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`system, a network system, and to memory’ be among those computer
`operations that have been deemed‘suspicious.”” Jd. (citing Ex. 2007 J 69,
`
`97).
`
`Petitioner replies that the phrase “list of suspicious computer
`operations” should be givenits plain and ordinary meaning consistent with
`the specification of the ’494 patent, which,Petitioner asserts, is “a list
`including one or more types of computer operations that could be used by
`the Downloadable in a potentially hostile or undesirable manner(e.g.,
`operating system, file system, or memory operations).” Pet. Reply 5 (citing
`Ex. 1013, 3:17—21, 5:58-6:4). Petitioner contends that the °194 patent,
`incorporated by reference in the *494 patent, “explains that examples of
`‘suspicious’ operationsincludefile system operations(e.g., reading and
`writing files), OS [operating system] operations, and registry, network, and
`memory operations”(id. (citing Ex. 1013, 5:57—6:4)), and “[i]n turn,the
`system determines whether an operation in a Downloadable is ‘suspicious’
`simply by determining ‘whether[it] is one of the operationsidentified in the
`list described above’(i.e., at [Ex. 1013,] 5:57—-6:4)”(id. (quoting Ex. 1013,
`9:20-42)). Petitioner also relies on the testimony of Dr. Davidson as
`explaining that a person of ordinary skill in the art would have appreciated
`that these were the types of computer operations used byviruses to do harm.
`Id. at 5-6 (citing Ex. 1018 {J 75-81, 97-100). According to Petitioner,
`Patent Owner’s construction, which “merely rearranges the claim language
`
`and inserts the word ‘deemed,”” is both unhelpful and unreasonably narrow
`
`becauseit reads an additional “deeming”step into the claims. Jd. at 6.
`
`Petitioner contends Patent Owner’s position that such a step is required is
`“directly contradicted by the ’194 patent,” which,Petitioner contends,
`
`10
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`“makes clear that an operation is ‘suspicious’ merely becauseit is a type of
`
`operation that could be used in a potentially hostile manner(e.g., file system
`
`operations)” by “stat[ing] that [Downloadable security profile (“DSP”)] data
`
`may include‘a list of all operations in the Downloadable code which could
`
`ever be deemedpotentially hostile.’” Jd. at 7 (quoting Ex. 1013, 5:51-59
`
`(emphasis added byPetitioner)). In other words, Petitioner contends, “at the
`
`time an operation is includedin thelist, there has been no determination yet
`
`of whetherthat particular operation is actually being used in a potentially
`
`hostile or ‘suspicious’ manner.” Jd. (citing Ex. 1018 ff 91-96).
`
`Weagree with Petitioner that Patent Owner’s proposed construction is
`
`unhelpful to an understanding of the scope of the challenged claims insofar
`
`as it “merely rearranges the claim language andinserts the word ‘deemed’”
`
`(Pet. Reply 6). More helpful is the portion of the ’194 patent cited by
`
`Petitioner that explains that DSP data may include “a list of al/ operations in
`
`the Downloadable code which could ever be deemedpotentially hostile.”
`
`Ex. 1013, 5:51-53 (emphasis added)). The inclusion of the phraseology “all
`
`operations ... which could ever be deemedpotentially hostile” in that
`
`passage renders it more objective, and “potentially hostile” captures our
`
`understanding of the meaning of“suspicious”in the context of the claims in
`
`light of the intrinsic and extrinsic evidence of record. Indeed, column 9,
`
`lines 20-42, of the ’194 patent, cited by Patent Ownerin support ofits
`
`assertion that “generating the ‘list of suspicious computer operations’ first
`
`requires that a determination be made as to whetherthe operations to be
`
`listed are suspicious” (see PO Resp. 10), directly links the term “suspicious”
`
`with “the list described above with reference to FIG. 3”—.e., the “list of all
`
`11
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`operations in the Downloadable code which could ever be deemed
`
`potentially hostile.”
`
`Because we determine that column 5, line 50, to column 6,line 4, of
`
`the °194 patent, incorporated by reference into the *494 patent (see Ex. 1001,
`
`1:35-38), provides the most probative evidence on the record before usas to
`
`the meaningof“list of suspicious computer operations”as recited in the
`
`challenged claims, we concludethat phrase is properly construed as a “list of
`
`all operations that could ever be deemed potentially hostile,” non-limiting
`
`examples of which includesfile operations; network operations; registry
`
`operations; operating systems operations; resource usage threshold
`
`operations, memory operations, CPU operations, and graphics operations.
`
`Ex. 1013, 5:50—-6:4.
`
`Notwithstanding our conclusion regarding the proper construction of
`
`“list of suspicious computer operations,” however, as we discuss in greater
`
`detail, infra Section IJI.B.4.a.ili, our ultimate conclusionsin this proceeding
`
`do not tum on our adoption ofthis construction, Patent Owner’s proposed
`
`construction, or Petitioner’s proposed construction.
`
`2. “database”
`
`In the Decision on Institution, in view of competing constructions
`
`advancedin the Petition and the Preliminary Response, we construed the
`
`term “database”as “a collection of interrelated data organized according to a
`
`database schemato serve one or more applications.” Dec. on Inst. 7-11. As
`
`we explained, we agreed with Patent Ownerthat that construction, which
`
`waspreviously articulated by the district court in the Sophos litigation and
`
`applied by the Board in prior proceedings, represented the broadest
`reasonable interpretation in light of the claim language andthe specification
`
`12
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`of the °494 patent. Id. at 10; see Ex. 2002, 7 (Finjan, Inc. v. Sophos, Inc.,
`
`No. 14-cv-01197 (N.D. Cal. 2014), Claim Construction Orderat 7);
`
`Ex. 2003, 8-10 (Sophos, Inc. v. Finjan, Inc., Case IPR2015-00907, slip op.
`
`at 8-10 (Paper 8) (concerning related U.S. Patent No. 7,613,926)); Ex. 2004,
`
`9-10 (Sophos, Inc. v. Finjan, Inc., Case IPR2015-01022, slip op. at 9-10
`
`(Paper 7) (concerning the ’494 patent)).
`
`Neither Petitioner nor Patent Ownerchallenges that construction, per
`
`se, post-institution. Patent Owner contends, however, that “/t/he practical
`
`import ofthis construction excludeslog files from being databases.” PO
`
`Resp. 7 (emphasis added). In support of its contention, Patent Ownerasserts
`
`that the district court explained in the claim construction order in the Sophos
`
`litigation that “the term ‘database’ is not broad enough toincludea log file.”
`
`Id. (quoting Ex. 2002, 7). According to Patent Owner,the district court
`
`“based its reasoning ofthe intrinsic record which demonstrates that
`
`databases andlog files are separate and distinct entities.” Id. “For
`
`example,” Patent Owneralleges, “the specification designates the database
`
`that stores DSP with box ‘Security Database 240’ while an eventlog is
`
`designated with box ‘Event Log 245,’”and “[t]he ’494 Patent further
`
`describes how databasesandlogfiles function differently by describing how
`logging results in an event log is an actionthat is distinct from storing in a
`security database.” Jd. at 7-8 (reproducing Ex. 1013, Fig. 2; citing Ex.
`
`1013, 7:2-6); see also id. at 8 (reproducing andreferring to Ex. 1013, Fig.3,
`
`as allegedly illustrating that “[t]his logging functionality is distinct from
`storing in a database, which allows DSPto be efficiently retrieved from the
`
`database, as shownbythe bidirectional arrow between the DSP data 310
`
`stored within Security Database 240 and Code Scanner 325 as compared to
`
`13
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`the arrow from logical engine 333 to record-keeping engine 335 to event log
`245”), 9 (“The data storage device 230 stores a security database 240, which
`includes security information for determining whether a received
`
`Downloadable is to be deemedsuspicious.” (quoting Ex. 1013, 3:47—S0)).
`
`Patent Owner concludes,“[b]ecause the District Court’s holding is based on
`
`sound reasoning,it should generally be followed in these proceedings.” Jd.
`
`at 9.
`
`Petitioner “maintain{s] this is not the broadest reasonable
`interpretation of ‘database,’ but adopt[s] the Board’s construction solely for
`purposesofthis IPR.” Pet. Reply 2 n.2. Petitioner additionally takes issue
`with Patent Owner’s assertion, amongothers, that the database cannot be a
`
`log file. Jd. at 2-5.
`Wenote that despite Patent Owner’s assertions regarding what“the
`
`specification designates” and what“the °494 Patent further describes”(see
`PO Resp. 7-8), the citations and figures reproduced by Patent Ownerin
`support of thoseassertions are not from the °494patent, but instead are from
`the ancestral ?194 patent. Although the ’494 patent incorporates by
`
`reference the ’194 patent, amongother patents and applications (see supra
`Section II.B), the 494 patent includes different versions of the cited figures
`
`and different descriptions thereof. Further, despite Patent Owner’s
`bookendingofthosefigures, citations, and quotations from the *194 patent
`with arguments regarding the district court’s claim construction order in the
`Sophoslitigation, we find that that order did not refer to the °194 patent. See
`
`Ex. 2002.
`
`Noncthcless, we agree thatthe district court found that the parties’
`disagreementin the Sophos litigation “‘center[ed] on whether ‘database’
`
`14
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`includes ‘simplefiles such as a log file,” where, “[a]ccording to Finjan, a
`log file is unstructured collection of data on a computer,” and explainedthat
`“database” should be construed, in part, “because the parties dispute the
`
`categorization of ‘log file’ as a ‘database.’”” Jd. at 4. The court found, based
`on references to a “database” in the ’494 patentitself, that “a databaseis
`
`used as an information source that serves protection engines when they
`
`inspect Downloadables.” Jd. at 5-6. The court also foundthat the related
`°780 patent“reflects the same understanding of database in its reference to a
`‘security database,”” and separately “refers to an ‘event log,’ stating thatit
`‘includes determination results for each Downloadable examined and
`
`runtime indications of the internal network security system.” Id. at 6
`
`(quoting Ex. 2028, 3:62-64). The court concluded:
`The patent’s language and context supports Finjan’s
`definition of a database. The specifications illustrate that a
`“database” serves applications, a characteristic that
`is not
`included in Sophos’s definition. The fact that a databaseassists
`applications also undermines Sophos’s argumentthata logfile is
`a database, because a log file is more properly understood as a
`passive record,instead of a storage device that interacts with an
`application. The ’780patentalso differentiates betweenlogfiles
`and “databases” by referring to them separately.
`In addition, Finjan’s expert, Nenad Medvidovic,states that
`a person ofordinary skill in the art would understand “database”
`to mean “a collection of interrelated data organized according to
`a database schema to serve one or more applications.”
`[Dr.] Medvidovic further
`states
`that
`“[a] person would
`understand a simple log file is not a database becauseit is not
`structured like a database ... A database, on the other hand,is a
`structured software component
`that allows user and other
`software components to store and retrieve data in an efficient
`manner.” ... [Dr.] Medvidovic’s definition appears reasonable
`when comparedto the languageof the patent and the definitions
`from computing dictionaries such as the IBM Dictionary of
`
`15
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`Computing and the IEEE Standard Dictionary of Electrical and
`Electronics Terms.
`
`I am persuaded by Finjan’s assertion that “(t]he claim
`language ofthe asserted patents all relate to the storage of data
`within the database in the context of the security profile or the
`downloadable security profile. The system actively uses these
`security profiles to detect malware and manage the system, not
`just for archival storage.” Therefore, I find that a log file does
`not qualify as a database in the context of this patent. Because
`Finjan’s definition appears to reflect both the context of the
`patent as well as a well-accepted definition of the term, I adopt
`Finjan’s construction of “database.”
`
`Id. at 6—7 (internal citations omitted).
`Although our construction of the term “database” in the Decision on
`Institution was rendered underthe “broadest reasonable interpretation”
`standard applicable to unexpired patents (see 37 C.F.R. § 42.100(b)), we
`conclude,in view ofthe parties’ arguments andcited evidence, and having
`consideredthedistrict court’s explanation set forth in the claim construction
`order in the Sophoslitigation, that there is no reason to modify our
`construction of “database” set forth in the Decision on Institution, which
`mirrors the district court’s express construction. Accordingly, we again
`construe “database”as “a collection ofinterrelated data organized according
`to a database schemato serve one or moreapplications.” To the extent that
`construction would excludealogfile consisting of an “unstructured
`collection of data on a computer,” weagree for the reasonsarticulated by the
`district court that such a simple, unstructuredlog file would not be a
`database. See Ex. 2002, 4-7. However, we do not agree with Patent
`Owner’s suggestion that this construction necessarily excludesall logfiles
`from being databases. See infra Section UI.B.4.a.iv. In particular, we credit
`
`16
`
`

`

`IPR2015-01892
`Patent 8,677,494 B2
`
`Dr. Davidson’s deposition testimony that the word “log” refers to the ki