[00:00:00] Speaker 00: We're going to take a short break before our fourth case. [00:00:06] Speaker 04: All rise. [00:00:09] Speaker 02: The Honorable Court will take a short recess. [00:00:15] Speaker 02: All rise. [00:00:19] Speaker 02: The Honorable Court is now in session. [00:00:22] Speaker 00: Be seated, please. [00:00:24] Speaker 00: Our fourth case this morning is number 231636. [00:00:29] Speaker 00: Palo Alto Networks versus Centripetal Networks, Mr. Radish. [00:00:36] Speaker 00: Am I pronouncing that right? [00:00:37] Speaker 04: You are. [00:00:38] Speaker 04: Thank you. [00:00:38] Speaker 04: You are. [00:00:41] Speaker 04: Good morning, and may it please the court. [00:00:43] Speaker 04: My name is Andrew Ratch. [00:00:45] Speaker 04: I represent the appellant, Palo Alto Networks. [00:00:49] Speaker 04: The 903 patent at issue in this appeal is directed to a network packet correlation process to identify the source [00:00:58] Speaker 04: of a given network communication, and the patent claims that source is referred to as the first host. [00:01:05] Speaker 04: The claims further recite that in response to that packet correlation process, two steps are performed. [00:01:11] Speaker 04: First, there's a generation of an indication of that first host, so identification of that host, perhaps in a log. [00:01:19] Speaker 04: Second, there's a transmittal [00:01:21] Speaker 04: of that identification. [00:01:23] Speaker 01: Can you just dig into the issue? [00:01:27] Speaker 01: In your papers below, before the board, what was your position? [00:01:32] Speaker 01: I just want you to express to me exactly what the combination was. [00:01:38] Speaker 01: And I think it was modifying Paxton by using Sutton's notice procedure after Paxton's correlation. [00:01:45] Speaker 01: But could you talk about that and talk about whether the board recognized that that was the exact proposed combination that you were offering? [00:01:54] Speaker 04: Yes, Your Honor, that is correct. [00:01:56] Speaker 04: We relied on Paxton's correlation process [00:01:59] Speaker 04: as well as the fact that it logs the results of that correlation, including the source address, as meeting everything in the claims except for the final limitation of the transmittal. [00:02:12] Speaker 04: So it's a correlation process. [00:02:13] Speaker 04: You identify the source of the communication through that process. [00:02:18] Speaker 04: What Paxson says is this correlation process is useful for network security. [00:02:22] Speaker 04: It says that it quickly identifies nodes infected with mistress content [00:02:28] Speaker 04: And this is at paragraph 30 of Pax and Appendix 2520. [00:02:31] Speaker 04: It says, and we pointed this out in our briefing and our petition, it says that an enterprise can, quote, utilize this technique, referring to the packet correlation process, to attribute malicious activity sensed at the edge of a network back to its original source. [00:02:48] Speaker 04: What Paxton doesn't say expressly is that once you have traced back the source of malicious activity to a source, to tell somebody about it, to tell administrators, so some action can be taken. [00:02:59] Speaker 00: There would be no purpose in doing the correlation unless you notified somebody about it. [00:03:04] Speaker 04: That's exactly right. [00:03:05] Speaker 04: And Paxton says expressly, this process is for network security. [00:03:10] Speaker 04: So we rely upon Sutton for the very narrow teaching. [00:03:13] Speaker 00: So where did you discuss this in the petition? [00:03:17] Speaker 04: So in the petition, [00:03:20] Speaker 04: We start first with Appendix 79, going to Appendix 80. [00:03:26] Speaker 04: This is the overview that we present of Paxton, where starting at the bottom of Appendix 79, we state that matching packets and identifying the true source of packet transmissions is useful for network security. [00:03:43] Speaker 04: Providing a way to try. [00:03:44] Speaker 01: The most important thing is going to be, where exactly did you say how you would modify Paxton in view of Sutton? [00:03:51] Speaker 01: Yes. [00:03:51] Speaker 01: That specific sentence. [00:03:53] Speaker 01: What is the, are you modifying Paxton so that the notice of Sutton comes after the correlation of Paxton since the correlation that identifies the malicious activity? [00:04:06] Speaker 04: Yes. [00:04:06] Speaker 01: Where would that be? [00:04:07] Speaker 04: I'll point you to two places, Your Honor. [00:04:09] Speaker 04: First, in the motivation to combine section at appendix 86, [00:04:14] Speaker 04: It says, to the extent patent, and this is the top of the motivation combined section there, to the extent patent owner argues that Paxton does not explain in detail what actions are taken with respect to identifying malicious activity. [00:04:27] Speaker 04: Again, it says that you use the correlation to get back to the source. [00:04:30] Speaker 04: It doesn't say what to do next. [00:04:32] Speaker 04: A posita would have been motivated to modify Paxton's computing system to, after the correlating, notify administrators of devices involved with malicious activity as taught by Sutton. [00:04:43] Speaker 04: That comes after the parent [00:04:45] Speaker 04: So that's the motivation combined. [00:04:46] Speaker 04: We further explain what that combination looks like on appendix 87. [00:04:51] Speaker 01: Can you specifically say here that when the notification is occurring? [00:04:56] Speaker 01: It's after the correlating. [00:04:58] Speaker 04: After the correlating. [00:04:59] Speaker 04: And then on the next page, appendix 87, we state thus, when a packet is detected. [00:05:05] Speaker 04: And so just to back up, Sutton is talking about identifying communications with darknet addresses. [00:05:11] Speaker 04: The reason Sutton does that is that computers [00:05:13] Speaker 04: that communicate with darknet addresses may be infected with malware. [00:05:18] Speaker 04: That's why they're sending communications. [00:05:20] Speaker 04: We don't rely upon its principal operation, Sutton, the secondary reference, for determining when to issue the notification. [00:05:26] Speaker 04: Paxton is what we rely upon, the correlating of when, because you trace back to the original source. [00:05:32] Speaker 04: So we say on epics 87, thus when a packet is detected as communicated to or from a darknet address, i.e. [00:05:39] Speaker 04: there's malicious activity in your network, [00:05:41] Speaker 04: Paxton discloses the ability to identify the hosts transmitting or receiving the packets, preboundary, so inside of a network, and Sutton teaches making that identification known to administrators or implementing rules to identify or drop future packets to prevent future malicious communications. [00:06:01] Speaker 04: If you don't notify anybody about the source of a malicious communication in response to the very process that identifies the source, an administrator cannot do anything with that information. [00:06:11] Speaker 04: There is no network security benefit. [00:06:13] Speaker 04: We then turn to our claim chart, which is that Appendix 104 to 105. [00:06:21] Speaker 04: This is the response of two steps. [00:06:22] Speaker 04: And as I noted, there are two actions that are responsive to correlating. [00:06:26] Speaker 04: First is the generation of the indication. [00:06:29] Speaker 04: For that, we relied upon Paxton, because Paxton discloses generating a log of these correlation results that have the source information. [00:06:38] Speaker 04: So that's the generation of the indication. [00:06:41] Speaker 04: Then we explain at the bottom of appendix 105 that, as explained in section 9A4, which is the motivation to combine section, Paxton discloses correlating packets to identify malicious activity and leaves specific usage and remedial steps to the person with their coronary skill in the art. [00:06:59] Speaker 04: It doesn't say expressly go tell administrator. [00:07:01] Speaker 04: But a posito would have been motivated to transmit the identification of the first host, e.g. [00:07:07] Speaker 04: to an administrator as taught by Sudden responsive to the correlation disclosed by Paxton. [00:07:14] Speaker 04: So that was the ground that we presented. [00:07:16] Speaker 03: So to find that the responsive to correlating limitation was taught, [00:07:25] Speaker 03: in the prior art, you rely on a combination of Paxton and Sutton just for that. [00:07:31] Speaker 03: You have to combine them just to meet that full limitation, is that right? [00:07:35] Speaker 03: That's correct. [00:07:36] Speaker 04: And I think this is where the board erred in its decision because it only analyzed the references in isolation. [00:07:44] Speaker 04: And this is apparent at appendix, let me pull up the specific side, I believe it's appendix, it's really 26 going on to 27. [00:07:53] Speaker 04: If you really started appendix [00:07:54] Speaker 04: I've been going back to appendix 19. [00:07:57] Speaker 04: From appendix 19 to appendix 24, the final decision, what the board is doing is recounting the party's positions and what happened at institution. [00:08:06] Speaker 04: I think there was a little confusion at institution. [00:08:08] Speaker 04: There was a dissent at institution, which is somewhat uncommon. [00:08:11] Speaker 04: But I think that what the dissent got confused about was whether we were proposing modifying Sutton by Paxton. [00:08:17] Speaker 04: As I said, there was no reason to introduce a correlation process [00:08:20] Speaker 04: into Sutton, which operates on darkened head addresses, well that was never the combination. [00:08:24] Speaker 04: Our combination was modifying Paxton by Sutton. [00:08:27] Speaker 03: I think what has confused me, but hopefully you can clarify it, is I thought you were saying every limitation was disclosed and taught [00:08:40] Speaker 03: in Paxton other than the last one, the responsive to correlating, and that you were saying that Sutton discloses the responsive to correlating. [00:08:47] Speaker 03: But that is not your view. [00:08:48] Speaker 03: Your view is we need both Paxton and Sutton to have a prior teaching of the responsive to correlating. [00:08:55] Speaker 03: Is that right? [00:08:56] Speaker 04: It's a combination. [00:08:57] Speaker 04: You have to analyze the R in combination. [00:08:59] Speaker 04: We say the responsive to correlating could not be met by Sutton alone, because Sutton doesn't deal with correlation. [00:09:06] Speaker 04: What we rely upon Sutton for is the simple, narrow teaching that [00:09:10] Speaker 04: Once you have detected the source of malicious activity, you should tell an administrator. [00:09:15] Speaker 04: Paxton tells you how to identify the source. [00:09:19] Speaker 01: And when the identifying the source is over? [00:09:23] Speaker 04: Well, Paxton tells you, right, Paxton says, OK, the correlation process in certain networks, the source of the packet information may be lost due to network address translation. [00:09:34] Speaker 04: That's exactly what the 903 problem was, too. [00:09:36] Speaker 04: It's the same problem, same solution. [00:09:39] Speaker 04: It allows you to trace back to where the communication originated from. [00:09:42] Speaker 04: And then Paxton says, this is really helpful for network security, because you can trace back sensed malicious activity to its source. [00:09:49] Speaker 04: All that's left is go tell somebody about that. [00:09:52] Speaker 04: And all we rely upon Sutton is for transmitted notification once a source has been detected. [00:09:59] Speaker 03: We sometimes have cases where obviousness might be shown even if a limitation was not expressly taught or disclosed in the prior art because it would have somehow been obvious. [00:10:13] Speaker 03: Is this one of those cases or is that not your argument here? [00:10:17] Speaker 04: I submit we could have likely rested on a single reference obviousness. [00:10:20] Speaker 04: We did it. [00:10:21] Speaker 04: We didn't. [00:10:21] Speaker 04: We didn't. [00:10:23] Speaker 04: It is, I think, absolutely obvious to everybody in this building that once you identify [00:10:28] Speaker 03: a source of malicious activity you ought to notify somebody. [00:10:46] Speaker 03: disclose responsive to correlating, it still would have been obvious somehow to a person of skill in the arm. [00:10:53] Speaker 04: I do think KSR mandates that sort of inquiry. [00:10:56] Speaker 03: What did you put in the petition? [00:10:58] Speaker 04: A petition was only a combination of Paxton as modified by Sutton for just the transmittal step. [00:11:04] Speaker 01: So again, the response is... Is it a combination? [00:11:08] Speaker 01: Is it, it would have been obvious to one of ordinary skill in the art to modify Paxton? [00:11:14] Speaker 01: So Sutton's notice step would occur after correlating. [00:11:20] Speaker 01: Yes, it's a precise notice. [00:11:21] Speaker 01: In effect, you've built the meaning of the limitation by the prior arc into your combination. [00:11:30] Speaker 01: The combination is that the notice occurs after the correlating. [00:11:33] Speaker 01: That's what your petition said. [00:11:35] Speaker 04: Yes, the notification. [00:11:36] Speaker 04: Because without the correlating, you don't have the source of the malicious activity. [00:11:40] Speaker 04: There's just no way to get there. [00:11:42] Speaker 04: And so the only way you can identify the source is through the correlation. [00:11:46] Speaker 04: So that correlation gives you the information that you need, which is, where did this original communication emanate from? [00:11:52] Speaker 04: Because that is probably my infected computer may have some well-ware. [00:11:56] Speaker 04: So you do that correlation process to uncover. [00:11:58] Speaker 04: And to be clear, the Paxton says it's this technique that attributes malicious activity. [00:12:03] Speaker 04: It's the correlation technique. [00:12:05] Speaker 04: I think what's important is understanding what the argument on the other side is about why this is not met. [00:12:11] Speaker 04: Their entire argument, and this is also how they argue there's substantial evidence supporting the board's decision, is that Paxton correlates everything, does nothing with the correlation results until sometime later in the day, later in the week, later in the month, some malicious activity is detected and some network administrator dusts off this log of information and sees what happened sometime in the past. [00:12:34] Speaker 04: That's not reflected in Paxton at all, and the board did not adopt that interpretation of Paxton. [00:12:40] Speaker 04: It really didn't adopt or make findings about Paxton in that regard at all. [00:12:45] Speaker 04: All it did in appendix 20, this is end of appendix 24 to the top of appendix 25, is recite what patent owners' arguments were. [00:12:54] Speaker 04: Now, they try to impute that as a finding to the board, but they never say, we agree with patent owner. [00:12:59] Speaker 04: They never say, we find those arguments persuasive. [00:13:02] Speaker 04: They just say, here is what they argue. [00:13:04] Speaker 04: But it never went on to find big findings out packs in terms of how it operates. [00:13:08] Speaker 01: Specifically relying on the petitioner argues that if CEDA would have been motivated to transmit the indication of the first host as taught by Sutton responsive to the correlating. [00:13:17] Speaker 01: That's right. [00:13:18] Speaker 01: That's our argument. [00:13:20] Speaker 01: that the argument that must be evaluated is whether Paxton, as modified by Sutton, would have taught the recited transmitting responsive to the correlation, right? [00:13:29] Speaker 01: That's the argument. [00:13:30] Speaker 01: Is that last sentence, is that your argument, or is that the board recognizing the issue that it needs to resolve? [00:13:36] Speaker 04: That is the argument that we presented in our petition. [00:13:38] Speaker 04: That is the argument that we think needs to be resolved. [00:13:41] Speaker 01: Well, it says right here. [00:13:42] Speaker 01: It says, therefore, the argument that must be resolved is. [00:13:45] Speaker 01: Do you think that's the board saying it, or are they saying that's what you think it is? [00:13:48] Speaker 01: I guess you've answered that question, but I want to make sure I'm being very clear. [00:13:52] Speaker 04: Yes, I think that's an accurate. [00:13:54] Speaker 04: I think the board support statement, I think that's accurate. [00:13:57] Speaker 04: But when the board went to do its analysis at page 26, it didn't actually analyze. [00:14:01] Speaker 04: Sorry, appendix 27. [00:14:03] Speaker 04: It didn't actually analyze it in combination. [00:14:05] Speaker 04: It just simply said, in Paxton, there's correlation without any specific identification what to do next. [00:14:11] Speaker 04: Sort of ignoring the creativity of a Posita that KSR mandates we take account of. [00:14:17] Speaker 01: And the combination that you presented. [00:14:18] Speaker 01: And the combination presented. [00:14:19] Speaker 04: It says, well, Sun has this darknet process. [00:14:22] Speaker 04: Well, sorry, but there's this gap, and you don't reach the claims. [00:14:25] Speaker 00: You're relying on Paxton for [00:14:31] Speaker 00: a motivation to notify because it suggests that this is beneficial to network administrators, which is a reason that you would look to Sutton for the notification. [00:14:44] Speaker 04: Absolutely. [00:14:45] Speaker 04: Expressly says it's beneficial to network security. [00:14:47] Speaker 04: Our motivation to combine Expressly said this would benefit network security. [00:14:51] Speaker 04: That motivation is the express purpose of our primary reference, and that's why somebody would notify an administrator. [00:14:58] Speaker 04: They wouldn't just keep this information impounded somewhere. [00:15:00] Speaker 04: They would notify someone. [00:15:01] Speaker 03: Do you think the board reached the issue of motivation to combine, or did it stop before that? [00:15:06] Speaker 04: I don't see it anywhere addressing the motivation. [00:15:09] Speaker 04: I see it just saying, we have one art teachers A, this other art teachers B, and we're not going further. [00:15:15] Speaker 04: And I think that's error. [00:15:16] Speaker 04: I think it has to analyze it in combination. [00:15:19] Speaker 04: Had it done so, I think it would have recognized there has to be a motivation here. [00:15:22] Speaker 04: Our motivation, network security, is the express purpose of Paxton. [00:15:27] Speaker 04: And if I could just reserve my reading, 10 seconds for a vote. [00:15:30] Speaker 00: We'll give you two minutes. [00:15:31] Speaker 00: Thank you, Your Honor. [00:15:32] Speaker 00: OK, Mr. Lerman. [00:15:45] Speaker 02: Thank you, Your Honor. [00:15:46] Speaker 02: It may please the court. [00:15:47] Speaker 02: Dan Lerman for Centripetal Networks. [00:15:49] Speaker 02: The board applied the correct legal test for obviousness, and its findings were supported by substantial evidence. [00:15:54] Speaker 01: Where in the board's opinion does it say what it thinks the combined reference is? [00:16:01] Speaker 01: Like the combination as proposed by the petitioner where it is Paxton modified by Sutton so that Sutton's notification occurs after Paxton's correlation. [00:16:15] Speaker 02: OK, so first, Dressel, you're correct. [00:16:18] Speaker 02: And I think my friend conceded that the board articulated the correct question, which is whether Paxton, as modified by Sutton, would have taught the recited claims. [00:16:27] Speaker 02: So that's on page 24. [00:16:29] Speaker 02: I think the board's analysis is on page 26 to 27. [00:16:33] Speaker 02: And what the board said was, first, Paxton does not disclose any action responsive to correlating. [00:16:40] Speaker 02: And they don't argue that it discloses any action responsive to correlating. [00:16:44] Speaker 02: So that leaves a gap. [00:16:45] Speaker 02: Then on page 27, sorry I have the appendix, it says Sutton does not fill in that gap. [00:16:51] Speaker 02: And so what it says is this leaves us with a correlation with no subsequent actions. [00:16:56] Speaker 02: And we have a transmission with no correlation. [00:16:58] Speaker 02: And then importantly, it says, a person with skill in the art would not have appreciated making the transmission from one reference responsive to the correlation in the other reference. [00:17:08] Speaker 00: I don't understand what that means. [00:17:10] Speaker 00: I mean, this seems to be pretty simple. [00:17:14] Speaker 00: You find a correlation. [00:17:16] Speaker 00: And it would be beneficial in Paxman itself to notify the administrator. [00:17:23] Speaker 00: And then this other reference, Sutton teaches you notify the administrator. [00:17:32] Speaker 02: Why is there not a motivation to combine those? [00:17:36] Speaker 02: I was just addressing the question whether the court, in fact, whether the board, in fact, applied a combination analysis, and as a matter of law, it did. [00:17:43] Speaker 01: I think Your Honor is now getting... It sounds like you're saying there's no motivation to combine. [00:17:47] Speaker 02: I'm not... No, Your Honor, we're not disputing... The board did combine. [00:17:51] Speaker 02: That's my assertion. [00:17:52] Speaker 02: The board did combine Paxson and Sutton. [00:17:54] Speaker 02: What it says is even if you combine them, you don't get to the claimed invention. [00:17:58] Speaker 01: But this is a proposed combination. [00:18:01] Speaker 01: Doesn't the board have to look at that combination proposed? [00:18:04] Speaker 01: The proposed combination wasn't just, let's throw Sutton together with Paxton or throw Paxton with Sutton. [00:18:11] Speaker 01: It was a very specific combination. [00:18:13] Speaker 01: And it was whether one of ordinary Scalming Art would have been motivated to modify Paxton so that Sutton's transmittal of notice occurred after Paxton's correlation. [00:18:24] Speaker 01: That was the precise motivation, a proposed combination. [00:18:29] Speaker 01: It wasn't just, let's throw these together. [00:18:31] Speaker 01: That's not how it works for obviousness. [00:18:33] Speaker 02: Well, yes. [00:18:34] Speaker 02: Well, KSR makes clear that it's not sufficient, Your Honor, to just find elements of the invention in the prior art. [00:18:39] Speaker 02: You need to show that it wouldn't be combined in the way the invention does. [00:18:42] Speaker 02: And this gets to Judge Peck's question. [00:18:43] Speaker 01: But you said that the board found that it had been combined. [00:18:46] Speaker 01: The board said it combined. [00:18:47] Speaker 01: That they would combine the prior art. [00:18:48] Speaker 02: Yes, Your Honor, but this is what's missing. [00:18:50] Speaker 02: The claim is a transmission responsive to correlating. [00:18:54] Speaker 02: Even if you add a notification onto Paxton [00:18:57] Speaker 02: It is not responsive to the correlating. [00:18:59] Speaker 02: And this gets to the substantial evidence claim that we were just talking about. [00:19:02] Speaker 02: The prior art system, and this is amply supported by the record, in Paxton, correlates every reference and then sits on that blog. [00:19:10] Speaker 02: And then a week, a month, a year later, the text. [00:19:15] Speaker 00: The board didn't say that, and I'm not sure whether that's true or not. [00:19:19] Speaker 02: The board did say that, and it's undisputed for purposes of this appeal. [00:19:23] Speaker 02: On page 26 of the appendix, the board said that our expert statement supports our argument, and that statement is that Paxton does not disclose doing anything with the matching information until malicious activity is sensed. [00:19:35] Speaker 00: Pan agrees. [00:19:36] Speaker 00: Where are you on 26? [00:19:40] Speaker 02: Six, 25 to 26, the carryover paragraph. [00:19:42] Speaker 02: This assertion is supported by Pat Noorder's declarant, who opines that Pat Nixon does not disclose or suggest doing anything with the packet information unless or until malicious activity is sensed. [00:19:53] Speaker 02: It therefore does not disclose anything responsive to or in reaction to generating this match log. [00:19:59] Speaker 00: Yeah, but that doesn't sound inconsistent with the notion [00:20:02] Speaker 00: correlation happens after the malicious activity is sent. [00:20:05] Speaker 00: It is, again, Your Honor. [00:20:06] Speaker 02: It's not whether it happens after. [00:20:08] Speaker 02: It's whether it's in response to. [00:20:09] Speaker 02: And they agree at page 42 of their brief. [00:20:11] Speaker 00: But that's contrary to what you were saying a moment ago. [00:20:14] Speaker 00: So you agree that what Paxton discloses is detecting malicious activity, then doing the correlating? [00:20:20] Speaker 02: I don't think Paxton speaks to this at all. [00:20:21] Speaker 02: And this is important to understand the argument. [00:20:23] Speaker 02: The board found that they did not argue that Paxton made any [00:20:27] Speaker 02: actions responsive to correlating. [00:20:30] Speaker 02: None of this is in there, and that's what the board found. [00:20:32] Speaker 00: You're really confusing me. [00:20:36] Speaker 00: We're dealing with a simple question, and we'll deal with the significance of the answer to that question in a moment. [00:20:43] Speaker 00: The board appears to view Paxson as disclosing, detecting malicious activity, and then doing correlating to identify the source, right? [00:20:54] Speaker 02: The board said that Paxson has a correlation with no subsequent actions. [00:21:04] Speaker 00: That's not addressing my question. [00:21:06] Speaker 00: I'm sorry, then what is your question? [00:21:07] Speaker 00: My question is the board appears to agree that what Paxson discloses is detecting malicious activity and then doing a correlating step to figure out the source of it, right? [00:21:19] Speaker 02: No, what the board found was only it has the core leading. [00:21:22] Speaker 02: I think there is evidence in the record to support the notion that Paxton, if it discloses anything at all, [00:21:28] Speaker 02: with respect to the order of operations, it would be after sensing malicious activity. [00:21:32] Speaker 02: And that's why it's not responsive, because you're already waiting. [00:21:35] Speaker 00: So let's assume for purposes of our discussion that what Paxton discloses is malicious activity, then you do a correlating step. [00:21:44] Speaker 01: Isn't it that instead Paxton suggests identifying the true source of the pack through correlating? [00:21:50] Speaker 01: And it's identifying the true source of the packet that helps you identify whether something's infected with malicious content. [00:21:58] Speaker 02: No, Your Honor. [00:21:58] Speaker 02: It assumes there's an infection with malicious content. [00:22:02] Speaker 02: In response to that malicious content, it says, we've got to figure out the nature and scope of this and where it came from. [00:22:07] Speaker 02: So we're going to go back and consult our log, the matching log that we did a year ago, and help identify the source. [00:22:13] Speaker 02: Our view is that that is profoundly different than the packet. [00:22:16] Speaker 00: Let's assume that that is. [00:22:18] Speaker 00: But why isn't that disclosing [00:22:21] Speaker 00: a step, that is the identification of malicious, of the source of the malicious activity, is doing a notification in response to that ascertainment. [00:22:36] Speaker 02: Because it's response to the malicious activity. [00:22:38] Speaker 02: I mean this is, they're not making a claim, they're not disputing claim constructions. [00:22:41] Speaker 00: It's a response to the correlation in the sense that it's the correlationist discovered the source [00:22:47] Speaker 00: So in response to having identified the source through the correlating step, you do a notification. [00:22:53] Speaker 02: Well, no, because that wouldn't mean anything unless they already found the malicious activity. [00:22:56] Speaker 02: They're either responding to every single correlation without any reason, or they're only responding after they sense malicious activity. [00:23:04] Speaker 02: If I could just explain our patent, our patent, the correlation itself [00:23:08] Speaker 02: provides an indication that there's a communication from a malicious host. [00:23:12] Speaker 00: He's not dealing with my question. [00:23:13] Speaker 00: My question is, they discover malicious activity, they use a correlating step to determine the source of that, and then the idea is, okay, in response to making that determination, we'll notify the systems administrator as shown in Sutton. [00:23:36] Speaker 02: That is their argument, Your Honor. [00:23:38] Speaker 02: What's wrong with it? [00:23:39] Speaker 02: Well, A, what they argued below and what the board found was Sutton doesn't disclose making any actions after the correlating. [00:23:47] Speaker 02: So we're already assuming that we're changing the prior order to read on your invention. [00:23:50] Speaker 00: Of course it doesn't kill any actions after the correlating. [00:23:52] Speaker 00: That's why you're looking to Sutton. [00:23:53] Speaker 02: OK, so now we have the notification. [00:23:54] Speaker 02: What's wrong is they concede in their brief and below that merely taking an action after another action is not responsive to the key [00:24:02] Speaker 02: invention here is the responsive to correlating claim. [00:24:04] Speaker 00: In their chart, when they're matching up these... You're saying you're notifying the systems administrator because you've used the correlating step to identify the source. [00:24:12] Speaker 02: But you've used it after you've been infected with malicious activity. [00:24:15] Speaker 02: The whole point of our patent is proactive and not reactive. [00:24:18] Speaker 02: The whole point of our patent is at the threshold. [00:24:21] Speaker 02: You can recognize that a communication is coming from a malicious actor and you respond before it comes in. [00:24:26] Speaker 02: If you look at their reply brief, [00:24:27] Speaker 02: They agree with their statement that impacts and the matching info is stored and, quote, no further action is taken in response to the matching. [00:24:34] Speaker 02: They agree at page three of the reply with their statement that in our patent, it detects malicious activity from a malicious host before it could harm the network. [00:24:41] Speaker 02: That is a profoundly different system. [00:24:43] Speaker 01: I still don't know where. [00:24:44] Speaker 01: I understand. [00:24:46] Speaker 01: I hear what you're saying. [00:24:47] Speaker 01: Thank you. [00:24:47] Speaker 01: My question is, where do I see, I think it's possible the board didn't find, found, was trying to say there's no motivation to combine. [00:24:56] Speaker 01: as proposed by the petitioner. [00:24:57] Speaker 01: But you have a different position on that. [00:24:59] Speaker 01: You think that the board combined the art. [00:25:01] Speaker 01: But I have a question for you, which is, where do you see that they say the reason why they would have combined, or where is it that the board says it would have been obvious to combine these two references? [00:25:15] Speaker 02: Where it said it wouldn't have been obvious. [00:25:17] Speaker 02: That it was not. [00:25:19] Speaker 01: That it would be. [00:25:20] Speaker 01: They said they were combined. [00:25:22] Speaker 02: Just to clarify, [00:25:24] Speaker 02: I believe the board did combine the references. [00:25:27] Speaker 02: But what I found lacking is a motivation to combine in this particular way, which is to alter the prior arts so that it's responsive to the correlating. [00:25:35] Speaker 02: Where it's found is, I think you need to read it as a whole. [00:25:37] Speaker 02: What it said is, Paxson does not disclose anything. [00:25:42] Speaker 02: It says there's a gap. [00:25:43] Speaker 02: And then it says, what we're left with is a correlation in one and a transmission in other. [00:25:47] Speaker 02: but without any bridge showing that one of the skill in the art would have appreciated that the transmission would be responsive to the correlation. [00:25:55] Speaker 02: So it's saying, we have point A, and we have point B, but what we're missing is C, the responsive. [00:26:00] Speaker 02: A person's skill in the art wouldn't have combined it in a way to make the transmission responsive to the correlation. [00:26:05] Speaker 01: That's an odd language to use. [00:26:08] Speaker 01: Instead of just saying, we think a person's ordinary skill in the art would have been motivated to make this particular combination because [00:26:15] Speaker 02: I think the language says there's a gap. [00:26:20] Speaker 03: I'm really confused on how you're reading the board. [00:26:24] Speaker 03: Are you saying that the board found a lack of motivation to combine, or are you not saying that? [00:26:29] Speaker 02: I'm not saying there's a lack of motivation to look at Paxton as modified by Sutton. [00:26:34] Speaker 02: I'm saying the board found that even if you did that, you would not have combined the references in this way. [00:26:39] Speaker 03: The board found that they failed to prove obviousness, correct? [00:26:43] Speaker 03: Correct. [00:26:43] Speaker 03: On what basis did the board [00:26:45] Speaker 03: To conclude, what did they say they failed to do? [00:26:48] Speaker 02: They failed to show that a person's skill in the art would have combined reference A with reference B to make a transmission responsive in the court. [00:26:56] Speaker 03: So they failed to find a motivation to combine. [00:26:59] Speaker 03: In that way. [00:27:01] Speaker 03: The only place we can see that the board found a lack of motivation to combine is this one sentence about the bridge that you keep harping on. [00:27:08] Speaker 03: Is that right? [00:27:09] Speaker 02: Well, not just the bridge. [00:27:10] Speaker 02: I mean, it also says, to establish by preponderance of the evidence that claim one would have been obvious over the teachings of Paxton, Sutton, and Igerty. [00:27:17] Speaker 01: That doesn't say anything about motivation. [00:27:20] Speaker 02: Well, right. [00:27:20] Speaker 02: But it's about the combination. [00:27:21] Speaker 01: I was just responding. [00:27:22] Speaker 01: This is an APA review for our APA. [00:27:24] Speaker 01: We need to be seeing real understanding. [00:27:27] Speaker 02: Again, we're not disputing that the board looked to Sutton, Paxton in light of Sutton. [00:27:31] Speaker 02: We're saying it found that that didn't reach the claimed invention. [00:27:38] Speaker 03: So it didn't reach. [00:27:40] Speaker 03: We're just going to have to make this simpler for me to have any hope for me here. [00:27:45] Speaker 03: You've said there was a lack, there was a finding of a lack of motivation combined. [00:27:50] Speaker 03: Are you standing by that? [00:27:51] Speaker 02: No, what I'm saying is there was a lack of evidence that a person's skill in the art would have taken the notification and made it responsive to the communication because that's not in the combination. [00:28:02] Speaker 03: Let me start over then. [00:28:04] Speaker 03: Did the board find that neither Paxton nor Sutton disclosed the responsive to correlating limitation? [00:28:15] Speaker 03: So yes, the board found that that limitation was not taught in either Paxton or Sutton. [00:28:23] Speaker 03: That's your view, right? [00:28:24] Speaker 03: Yes. [00:28:24] Speaker 03: Did the board also consider whether the combination of Paxton and Sutton [00:28:30] Speaker 03: together disclose the response of the correlating limitation, as is outlined at pages A104 and 105 of the petition. [00:28:41] Speaker 02: Yes. [00:28:42] Speaker 03: Where did the board consider that? [00:28:43] Speaker 02: In this same page, and you have to read it as a whole, the board said the question is whether Paxton has modified by Sutton. [00:28:49] Speaker 02: It says, here's what Paxton shows. [00:28:52] Speaker 02: It leaves a gap. [00:28:53] Speaker 02: Now looking to see whether Sutton fills that gap. [00:28:55] Speaker 02: It doesn't. [00:28:56] Speaker 02: And a person of skill in the art wouldn't fill that gap either. [00:28:59] Speaker 02: That is a combination analysis. [00:29:01] Speaker 02: And this is maybe we're getting hollered up with the motivation to combine. [00:29:03] Speaker 02: But the board clearly said that neither reference has responsive to correlating. [00:29:07] Speaker 02: And then it said, even when you look at the two of them together, you still don't have a transmission that's responsive to correlating. [00:29:13] Speaker 02: Because that's the key claim language that you can't cut up like baloney. [00:29:16] Speaker 00: You only find the source by correlating. [00:29:18] Speaker 00: And then in response to that discovery, you notify an administrator. [00:29:24] Speaker 00: That's the argument. [00:29:26] Speaker 00: Where does the board deal with that? [00:29:28] Speaker 02: Well, the board deals with that on page 26, where it says they didn't articulate any argument that it would be, quote, facetious to perform the correlating without a notification. [00:29:39] Speaker 02: So that argument was waived. [00:29:42] Speaker 02: The argument that you're on are opened with, which is what's the purpose of this correlating if you don't do a notification. [00:29:47] Speaker 02: They didn't make that argument. [00:29:49] Speaker 02: They don't dispute that they didn't make that argument. [00:29:50] Speaker 00: They relied on paragraph 30 of Haxton. [00:29:54] Speaker 00: which is on page 2565, I think. [00:30:01] Speaker 00: Maybe I got the wrong page number. [00:30:03] Speaker 00: It's 2520, Your Honor. [00:30:10] Speaker 00: Paxton begins at 2556, right? [00:30:15] Speaker 00: They rely on paragraph 30 [00:30:18] Speaker 00: of Paxton as saying, by the correlating step, we can identify the source. [00:30:26] Speaker 00: And then it's useful to the systems administrator. [00:30:34] Speaker 02: That's right. [00:30:34] Speaker 02: And the board found, first of all, that they did not argue that Paxton itself. [00:30:40] Speaker 02: They said Patton left everything to a person of skill in the art, and it didn't disclose anything. [00:30:43] Speaker 02: But even to the extent we're looking at paragraph 30, if you look, it says networks that have significant investments into the backbone can attribute malicious activity sensed on the network back to its original source. [00:30:56] Speaker 02: This whole paragraph 30, to the extent that a person of skill in the art is going to look at it, it's all geared. [00:31:01] Speaker 02: It assumes malicious activity is already on the network. [00:31:04] Speaker 02: That's what our expert said. [00:31:05] Speaker 02: It said it's not going to look at the correlate. [00:31:07] Speaker 02: Our expert said, and this is in the record, a person of skill in the art reading paragraph 30 [00:31:12] Speaker 02: would not understand that to suggest taking any action after the matching log, unless or until malicious activity is detected. [00:31:19] Speaker 02: If there's no malicious activity detected when you're routinely sweeping the network, and this takes a lot of time, a lot of energy, a lot of resources, then you need to go back to a log that could be millions of bits long and compare it to it, and this is all after the fact. [00:31:32] Speaker 02: Our patent is proactive. [00:31:34] Speaker 02: It doesn't require detecting malicious activity on the network. [00:31:37] Speaker 02: It uses the correlation itself to identify a communication from a malicious host. [00:31:41] Speaker 02: And because of that, the transmission is responsive to that core leading. [00:31:45] Speaker 02: It's not responsive to malicious activity. [00:31:47] Speaker 02: In their patent, by their own hypothesis here, it's responding to an infection on your network. [00:31:53] Speaker 02: That is too late, and that's the core invention here. [00:31:55] Speaker 03: Can I just add two narrow questions, just to make sure I understand your reading of the board. [00:32:01] Speaker 03: You've told me you think the board found a failure to show motivation to combine. [00:32:05] Speaker 03: I think your answers earlier also indicate you think the board found that even if you did combine Paxon and Sutton, you would not get the responsive to the correlating limitation. [00:32:16] Speaker 02: A hundred percent. [00:32:16] Speaker 02: That's the core limitation, responsive to correlating. [00:32:19] Speaker 03: That even the combination of Paxon and Sutton do not teach or render obvious [00:32:26] Speaker 03: the responsive to correlating. [00:32:27] Speaker 03: That's correct. [00:32:30] Speaker 03: You see that in the board's position. [00:32:31] Speaker 02: I see that in the board's position, but importantly, I see that in the bridge. [00:32:34] Speaker 03: That's why I needed on that. [00:32:35] Speaker 03: Second narrow question. [00:32:36] Speaker 03: So bridge, you keep skipping over the word bridge in the sentence that you say is key here. [00:32:42] Speaker 03: What does the board mean to you when it's saying there's not a bridge? [00:32:47] Speaker 02: OK, I thought I read that line. [00:32:49] Speaker 02: The bridge, Your Honor, is just the gap between the prior and the claimed invention. [00:32:53] Speaker 02: That's all it's saying is that [00:32:54] Speaker 02: The question is whether, when you combine, whether it's going to reach it. [00:32:57] Speaker 02: It doesn't, because it doesn't have this key aspect of the claim, which is responsive to the correlating. [00:33:03] Speaker 03: It's just another way of saying there's a gap. [00:33:04] Speaker 02: It's just another way of saying there's a gap. [00:33:05] Speaker 02: It doesn't reach the invention. [00:33:07] Speaker 02: And a person's skill in the art wouldn't have modified it to reach the invention. [00:33:10] Speaker 02: That's all the bridge is. [00:33:11] Speaker 02: It's a bridge between the prior art and the claimed invention. [00:33:14] Speaker 02: And that's what's lacking. [00:33:15] Speaker 02: And that means that the combination itself, to your honor's original point, doesn't reach the claimed invention, even if you combine it the way that they say they [00:33:23] Speaker 00: Thank you, Mr. Lerner. [00:33:26] Speaker 00: Mr. Resch. [00:33:33] Speaker 04: Thank you, honors. [00:33:34] Speaker 04: Just to start with your last question, Judge Stark, about the bridge language. [00:33:38] Speaker 04: I think that centripetal's argument about how that's understood reinforces the notion that these references were not analyzed in combination. [00:33:47] Speaker 04: What the board says is we have a correlation from Paxton with no specific [00:33:52] Speaker 04: steps and separately we have this teaching from Sutton that's unrelated to or any correlation and from those separate teachings there's no bridge to the claims. [00:34:01] Speaker 04: That's not an analysis of the art in the combination proposed. [00:34:06] Speaker 04: Second, I just don't understand how when you combine the art you don't reach the claims. [00:34:10] Speaker 04: You have a packet correlation process. [00:34:12] Speaker 04: The technique is especially stated by Paxton at paragraph 30, appendix 2520. [00:34:18] Speaker 04: The technique, the matching technique is [00:34:22] Speaker 04: attributes malicious activity sensed at the edge of a network back to its original source. [00:34:27] Speaker 04: You get to the source, what do you do? [00:34:28] Speaker 04: You tell somebody. [00:34:29] Speaker 04: It's about as simple as an obviousness case can get. [00:34:32] Speaker 04: Once you combine a no notification process with the correlation that gets you the information that needs to go to an administrator, then that notification has to be responsive to correlation. [00:34:43] Speaker 04: The correlation is the only thing that provides the source information. [00:34:48] Speaker 04: Without the correlation information, you have no source [00:34:51] Speaker 04: Last point about this order of steps argument, they say that you would correlate and look at that a year later. [00:34:56] Speaker 04: That doesn't make any sense in the context of this invention. [00:34:59] Speaker 04: It's of Paxton, which is about quickly identifying nodes infected with malicious content. [00:35:05] Speaker 04: That's right from Paxton 30. [00:35:06] Speaker 04: It allows the network administrator to better identify the scope of a malicious incident so it can take some remedial action. [00:35:13] Speaker 04: Doing that a year later doesn't make any sense. [00:35:15] Speaker 04: But in any event, the board did not make any findings that Paxton correlates everything first [00:35:21] Speaker 04: does nothing for a year and consults it only later. [00:35:24] Speaker 04: That's just an argument they've raised in support of the board's findings, but it was not a finding made by the board. [00:35:30] Speaker 04: And for that reason, we think that this decision needs to be reversed and remanded. [00:35:35] Speaker 00: OK. [00:35:35] Speaker 00: Thank you. [00:35:35] Speaker 00: Thank both counsel. [00:35:36] Speaker 00: The case is submitted. [00:35:37] Speaker 00: That concludes our session for this month.