Patent No. 7,448,084 Petition For Inter Partes Review Paper No. 1 IN THE UNITED STATES PATENT AND TRADEMARK OFFICE

Transcription

1 Paper No. 1 IN THE UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD SYMANTEC CORPORATION, - vs. - Petitioner THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF NEW YORK, Patent Owner Patent No. 7,448,084 Issued: Nov. 4, 2008 Inventors: Frank Apap, Andrew Honig, Hershkop Shlomo, Eleazar Eskin, and Salvatore J. Stolfo Title: SYSTEM AND METHODS FOR DETECTING INTRUSIONS IN A COMPUTER SYSTEM BY MONITORING OPERATING SYSTEM REGISTRY ACCESSES Inter Partes Review No. PETITION FOR INTER PARTES REVIEW OF U.S. PATENT NO. 7,448,084 UNDER 35 U.S.C AND 37 C.F.R , December 5, 2014 Mail Stop Patent Board Patent Trial and Appeal Board P.O. Box 1450 Alexandria, VA

2 TABLE OF CONTENTS Page I. INTRODUCTION... 1 II. MANDATORY NOTICES (37 C.F.R. 42.8(A)(1))... 1 A. Real Party-In-Interest (37 C.F.R. 42.8(b)(1))... 1 B. Notice of Related Matters (37 C.F.R. 42.8(b)(2))... 1 C. Designation of Lead and Backup Counsel (37 C.F.R. 42.8(b)(3))... 1 D. Service of Information (37 C.F.R. 42.8(b)(4))... 2 III. GROUNDS FOR STANDING (37 C.F.R (A))... 2 IV. IDENTIFICATION OF CHALLENGE (37 C.F.R (B))... 2 A. Effective Filing Date of the 084 patent... 2 B. There Is a Reasonable Likelihood That at Least One Claim of the 084 Patent Is Unpatentable under 35 U.S.C. 102, V. THE 084 PATENT... 6 A. Overview of the Disclosure of the 084 Patent... 6 B. The 084 Patent Prosecution History... 8 VI. CONSTRUCTION OF THE CHALLENGED CLAIMS (37 C.F.R (B)(3))...13 VII. THE CHALLENGED CLAIMS ARE UNPATENTABLE...15 A. Registry Monitoring and Anomaly Detection Were Well Known in the Art Prior to the 084 Patent...15 B. Ground 1: Bace in combination with Russinovich claims 14 and obvious Reasons to Combine Bace with Russinovich...21 i

3 Patent No. 7,487,544 TABLE OF CONTENTS (Continued) ii Page 2. Claim 14: A system for detecting intrusions in the operation of a computer system comprising: Claim 14: (a) an oper[a]ting system registry; Claim 14: (b) a registry auditing module configured to gather records regarding processes that access the operating system registry; Claim 14: (c) a model generator configured to generate a probabilistic model of normal computer system usage based on records of a plurality of processes that access the operating system registry and that are indicative of normal computer system usage and to determine the likelihood of observing a process that was not observed in the records of the plurality of processes that access the operating system registry and that are indicative of normal computer usage; and Claim 14: (d) a model comparator configured to receive the probabilistic model of normal computer system usage and to receive records regarding processes that access the operating system registry and to detect deviations from normal computer system usage to determine whether the access of the operating system registry is an anomaly Claim 16: The system according to claim 14, further comprising a database configured to receive records regarding processes that access the operating system registry from the registry auditing module Claim 17: The system according to claim 14, wherein the model generator is configured to receive the records regarding processes that access the operating system registry from the database....34

4 Patent No. 7,487,544 TABLE OF CONTENTS (Continued) Page 9. Claim 18: The system according to claim 14, wherein the records regarding processes that access the operating system registry comprise a feature of the access to the operating system registry Claim 19: The system according to claim 18, wherein the feature corresponds to a name of a process accessing the operating system registry Claim 20: The system according to claim 18, wherein the feature corresponds to a type of query being sent to the operating system registry Claim 21: The system according to claim 18, wherein the feature corresponds to an outcome of a query being sent to the operating system registry Claim 22: The system according to claim 18, wherein the feature corresponds to a name of a key being accessed in the operating system registry Claim 23: The system according to claim 18, wherein the feature corresponds to a value of the key being accessed Claim 24: The system according to claim 18, wherein the features corresponds to a combination of two features selected from the group of features consisting of a name of a process accessing the operating system registry, a type of query being sent to the operating system registry, an outcome of a query being sent to the operating system registry, a name of a key being accessed in the operating system registry, and a value of the key being accessed iii

5 Patent No. 7,487,544 TABLE OF CONTENTS (Continued) iv Page 16. Claim 25: The system according to claim 14, wherein the model generator is configured to determine a likelihood of observing a feature in the records regarding processes that access the operating system registry Claim 26: The system according to claim 25, wherein the model generator is configured to determine a conditional probability of observing a first feature in records regarding processes that access the operating system registry given an occurrence of a second feature is the record Claim 27: The system according to claim 25, wherein the model comparator determines a score based on the likelihood of observing a feature in a record regarding a process that accesses the operating system registry Claim 28: The system according to claim 25, wherein the model comparator is configured to determine an access to the operating system registry is anomalous based on whether the score exceeds a predetermined threshold C. Ground 2: Bace in Combination with Shavlik and Russinovich Renders Claims 14 and Obvious Reasons to Combine Bace with Russinovich and Shavlik Claim 14: A system for detecting intrusions in the operation of a computer system comprising: Claim 14: (a) an oper[a]ting system registry; Claim 14: (b) a registry auditing module configured to gather records regarding processes that access the operating system registry;...49

6 Patent No. 7,487,544 TABLE OF CONTENTS (Continued) v Page 5. Claim 14: (c) a model generator configured to generate a probabilistic model of normal computer system usage based on records of a plurality of processes that access the operating system registry and that are indicative of normal computer system usage and to determine the likelihood of observing a process that was not observed in the records of the plurality of processes that access the operating system registry and that are indicative of normal computer usage; and Claim 14: (d) a model comparator configured to receive the probabilistic model of normal computer system usage and to receive records regarding processes that access the operating system registry and to detect deviations from normal computer system usage to determine whether the access of the operating system registry is an anomaly Claim 16: The system according to claim 14, further comprising a database configured to receive records regarding processes that access the operating system registry from the registry auditing module Claim 17: The system according to claim 14, wherein the model generator is configured to receive the records regarding processes that access the operating system registry from the database Claim 18: The system according to claim 14, wherein the records regarding processes that access the operating system registry comprise a feature of the access to the operating system registry Claim 19: The system according to claim 18, wherein the feature corresponds to a name of a process accessing the operating system registry....53

7 Patent No. 7,487,544 TABLE OF CONTENTS (Continued) Page 11. Claim 20: The system according to claim 18, wherein the feature corresponds to a type of query being sent to the operating system registry Claim 21: The system according to claim 18, wherein the feature corresponds to an outcome of a query being sent to the operating system registry Claim 22: The system according to claim 18, wherein the feature corresponds to a name of a key being accessed in the operating system registry Claim 23: The system according to claim 18, wherein the feature corresponds to a value of the key being accessed Claim 24: The system according to claim 18, wherein the features corresponds to a combination of two features selected from the group of features consisting of a name of a process accessing the operating system registry, a type of query being sent to the operating system registry, an outcome of a query being sent to the operating system registry, a name of a key being accessed in the operating system registry, and a value of the key being accessed Claim 25: The system according to claim 14, wherein the model generator is configured to determine a likelihood of observing a feature in the records regarding processes that access the operating system registry vi

8 Patent No. 7,487,544 TABLE OF CONTENTS (Continued) Page 17. Claim 26: The system according to claim 25, wherein the model generator is configured to determine a conditional probability of observing a first feature in records regarding processes that access the operating system registry given an occurrence of a second feature is the record Claim 27: The system according to claim 25, wherein the model comparator determines a score based on the likelihood of observing a feature in a record regarding a process that accesses the operating system registry Claim 28: The system according to claim 25, wherein the model comparator is configured to determine an access to the operating system registry is anomalous based on whether the score exceeds a predetermined threshold VIII. CONCLUSION...60 vii

9 EXHIBIT LIST (37 C.F.R (e)) Exhibit Description 1001 U.S. Patent No. 7,448,084 to Apap et al File History of U.S. Patent No. 7,448, Declaration of Michael T. Goodrich, Ph.D Curriculum vitae of Michael T. Goodrich, Ph.D The Trustees of Columbia University in the City of New York v. Symantec Corp., Civil Action No. 3:13-cv-808, Oct. 7, 2014 Claim Construction Order (Dkt. No. 123) 1006 Jude Shavlik et al., Evaluating Software Sensors for Actively Profiling Windows 2000 Computer Users (RAID 2001) 1007 Rebecca G. Bace, INTRUSION DETECTION (MacMillian Technical Publishing, 2000) 1008 Mark Russinovich and David Solomon, INSIDE MICROSOFT WINDOWS 2000, 3 rd Ed. (Microsoft Press, 2000) 1009 Mark Russinovich and Bryce Cogswell, Examining the Windows 95 Registry, Windows Developer s Journal, Vol. 7, No. 10 (October 1996) 1010 M. Debbabi et al, Monitoring of Malicious Activity in Software Systems, 1st Symposium on Requirements Engineering for Information Security (SREIS, March 2001) 1011 Johnathon Korba, Windows NT Attacks for the Evaluation of Intrusion Detection Systems (M.I.T. 2000) 1012 Terran Lane and Carla E. Brodley, Temporal Sequence Learning and Data Reduction for Anomaly Detection, ACM Transactions on Information and System Security, Vol. 2, No. 3 (August 1999) 1013 RAID 2001 Program, Oct. 10, 2001, Located at: viii

10 Exhibit ix Description James D. Murray, Windows NT Event Logging (O Reilly & Associates, 1998) 1015 The Trustees of Columbia University in the City of New York v. Symantec Corp., Civil Action No. 3:13-cv-808, October 23, 2014 Memorandum Order Clarifying Claim Construction (Dkt. No. 146) 1016 Anup K. Ghosh, et al., Learning Program Behavior Profiles for Intrusion Detection, USENIX Proceedings of the Workshop on Intrusion Detection and Network Monitoring, Santa Clara, California, USA, (April 1999) 1017 Aaron Schwartzbard and Anup K. Ghosh, A Study in the Feasibility of Performing Host-based Anomaly Detection on Windows NT, Proceedings of the Second International Workshop on Recent Advances in Intrusion Detection, West Lafayette, Indiana, USA, (September 1999) 1018 U.S. Patent Application Publication No. 2003/ by Richard P. Tarquini, et al U.S. Patent No. 6,973,577 by Victor Kouznetsov 1020 Call For Papers RAID 2001, Oct , 2001, Located at: Dorothy E. Denning, An Intrusion Detection Model, IEEE Transactions on Software Engineering, Vol. 13, No. 2 (February 1987) U.S. Patent Application Publication No. 10/352,342, by Andrew Honig (excerpts) Microsoft Computer Dictionary, 4 th Ed. (Microsoft Press, 1999) (excerpts) Matthew V. Mahoney and Philip K. Chan, Detecting Novel Attacks by Identifying Anomalous Network Packet Headers, Technical Report CS , Florida Institute of Technology (2001)

11 I. INTRODUCTION In accordance with 35 U.S.C and 37 C.F.R & , inter partes review is respectfully requested for claims 14 and of United States Patent No. 7,448,084 to Apap et al., titled System and Methods for Detecting Intrusions in a Computer System by Monitoring Operating System Registry Accesses (the 084 patent ) owned by The Trustees of Columbia University in the city of New York ( Columbia ). (EXHIBIT 1001 ( Ex ).) This petition demonstrates that there is a reasonable likelihood that the petitioners will prevail on at least one of the claims challenged in the petition based on prior art references that the United States Patent and Trademark Office ( USPTO ) did not have before it during prosecution. Claims 14 and of the 084 patent (the challenged claims ) should therefore be canceled as unpatentable. II. MANDATORY NOTICES (37 C.F.R. 42.8(A)(1)) A. Real Party-In-Interest (37 C.F.R. 42.8(b)(1)) The real party-in-interest for this petition is Symantec Corporation ( Petitioner or Symantec ). B. Notice of Related Matters (37 C.F.R. 42.8(b)(2)) The 084 patent is presently the subject of the following patent infringement lawsuit brought by Columbia in the Eastern District of Virginia, Richmond Division: Civil Action No. 3:13-cv-808 against Symantec. C. Designation of Lead and Backup Counsel (37 C.F.R. 42.8(b)(3)) Petitioner provides the following designation of counsel: 1

12 David D. Schumann (Reg. No. 53,569) FENWICK & WEST LLP Postal and Hand Delivery Address 555 California Street 12th Floor San Francisco, CA Tel: (415) Fax: (415) Brian M. Hoffman (Reg. No. 39,713) FENWICK & WEST LLP Postal and Hand Delivery Address 555 California Street 12th Floor San Francisco, CA Tel: (415) Fax: (415) D. Service of Information (37 C.F.R. 42.8(b)(4)) Service of any documents via hand-delivery may be made at the postal mailing addresses of the respective lead and back-up counsel designated above with courtesy copies to the addresses and Petitioner consents to electronic service. III. GROUNDS FOR STANDING (37 C.F.R (A)) Petitioner certifies pursuant to Rule (a) that the 084 patent is available for inter partes review and that Petitioner is not barred or estopped from requesting an inter partes review challenging the validity of the above-referenced claims of the 084 patent on the grounds identified in the petition. IV. IDENTIFICATION OF CHALLENGE (37 C.F.R (B)) A. Effective Filing Date of the 084 patent The 084 patent issued from U.S. Application No. 10/352,343 filed on Jan. 27, The 343 Application claims the benefit of U.S. Provisional Application No. 60/351,857, filed Jan. 25, B. There Is a Reasonable Likelihood That at Least One Claim of the 084 Patent Is Unpatentable under 35 U.S.C. 102, 103. The challenged claims are directed to a system for detecting malicious intru- 2

13 sions in a computer system by monitoring operating system registry accesses and performing anomaly detection analysis on the observed activity. Claim 1 of the ʼ084 patent is illustrative: As explained in more detail in Section VII below, both registry monitoring and anomaly detection was well known in the art prior to For example, registry monitoring was the subject of the textbook by Mark Russinovich, Inside Windows 2000, published in 2000 ( Russinovich textbook ). See Ex at 55. An October 1996 article by the same author describes the registry and a program called Regmon that monitors all accesses to the registry. See Ex ( Russinovich paper ). Additionally, it was well known prior to 2002 that malicious software frequently accesses the operating system registry; various papers had proposed and described monitoring the system registry to detect malicious behavior prior to See Ex. 1006; Ex. 1010; Ex at , pp For instance, a 2000 paper titled Windows NT Attacks for the Evaluation of Intrusion Detection Systems described using the Windows operating system registry access information to create profiles of a number of known attacks. E.g., Ex at 35, 51 (attack modifies system registry),

14 Thus, as of 2000, one of ordinary skill in the art knew various attacks modified the operating system registry, and could be detected by monitoring the registry accesses. Ex at Similarly, anomaly detection was a well-known technique for detecting intrusions at least as early as E.g. Ex More recently, the 2000 textbook entitled Intrusion Detection by Rebecca Bace ( Bace ) contains several chapters explaining anomaly detection and how to implement an anomaly detection system. Ex In fact, references published before 2002 suggest using records of registry accesses as an information source for anomaly detection systems. For example, the 1999 paper entitled Sequence Learning by Lane and Brodley dealing with anomaly detection suggests that the system it discloses could be improved by using Window registry activity. Ex at 34 ( Pay special attention to activity on critical files such as /etc/passwd or the Windows NT registry ). Another explicit disclosure of using anomaly detection with the Windows operating system registry appears in a 2001 paper by Jude and Mark Shavlik, and Michael Fahland entitled Evaluating Software Sensors for Actively Profiling Windows 2000 Computer Users attached to this petition as Exhibit 1006 ( Shavlik ). Shavlik explains that using anomaly detection results in lower false positives than other intrusion detection techniques, and describes monitoring Windows NT registry locations and corresponding accesses as an information source for anomaly detection. Ex at 1, 3. As demonstrated above, the use of information regarding registry accesses as an information source for anomaly detections was known in the art before the priority date of the 084 patent. 4

15 Section VII below provides a limitation-by-limitation analysis for each of the challenged claims. In that section, the petition demonstrates that (1) Bace in combination with the Russinovich textbook and (2) Bace and Russinovich in combination of Shavlik render all the challenged claims obvious. Ex. 1006, 1007, As described above, Bace details various anomaly detection schemes, including those running on computer with a Windows-based operating system. Meanwhile, the Russinovich textbook discloses further details about a well-known registry monitor called Regmon, which one of ordinary skill in the art would recognize would be useful for collecting data on registry accesses to detect malicious activity on Windows-based systems. Moreover, Shavlik expressly discloses the combination of anomaly detection and registry monitoring. The Bace textbook is prior art pursuant to 35 U.S.C. 102 (a) and (b) because the Bace textbook bears a copyright date of Ex at 5. The Russinovich textbook is prior art pursuant to 35 U.S.C. 102 (a) and (b) because it bears a copyright date of Shavlik is prior art pursuant to 35 U.S.C. 102 (a). Shavlik was submitted for consideration for an October 2001 conference Recent Advances in Intrusion Detection. Ex The deadline for submissions was March 30, 2001 and decisions by the panel were due on July Ex The Shavlik paper was presented to the conference on October 11, 2001, and made available on the RAID website. Ex Exhibit 1013 is the conference program website from November 21, 2001, including links to the Shavlik paper, obtained from archive.org. Id. Thus, the Shavlik paper was 5

16 available to the public at least as early as November 21, The reasons for combination of the Bace, Russinovich and Shavlik references are discussed below in Section VII. This analysis is supported by a declaration by Dr. Michael Goodrich, which includes claim charts with further detailed analysis. See Ex Based on this analysis, Petitioner requests cancellation of claims 14 and as unpatentable under 35 U.S.C V. THE 084 PATENT A. Overview of the Disclosure of the 084 Patent The 084 patent discloses a system and method for detecting intrusions in a computer system by identifying anomalies from normal computer system usage. Ex at 4: Figure 1 illustrates the basic architecture of a system 10 as recited in the asserted claims. Id. Computers running the Windows operating system have an operating system registry a hierarchical database that stores information about the computer, its users, and the programs that are installed. Id. at 5: Software programs running on those computers may access the operating system registry. Id. at 5:66-6:2. To determine whether those software programs are malicious, registry auditing module 12 will monitor accesses to the registry, such as program reads and writes to the registry. Ex at 13: First, however, a model of normal operation is trained by observing the operation of the computer in the absence of malicious programs. Id. at 6: This model will enable system 10 to identify normal computer usage, and, therefore, recognize anomalies to the normal computer usage as an intrusion or malicious behavior. Id. at 8:

17 The ʼ084 patent provides two exemplary methods for creating the model. Both methods are admitted in the ʼ084 patent as being prior art. Ex at 13:4-11 ( an anomaly detection algorithm known in the art, which was developed to detect anomalies in packet headers (see, e.g., M. Mahoney and P. Chan, Detecting Novel Attacks by Identifying Anomalous Network Packet Headers, Technical Report CS , Florida Institute of Technology, Melbourne, Fla., 2001). ). In fact, the ʼ084 expressly describes Mahoney as determining the likelihood of observing an event that was not observed during training and computing a score based on a probability as required by the claims: During testing, we fix the model (n, r, and the list of observed values). When an anomaly occurs, we assign a field score of t/p where p = r/n is the estimated probability of observing an anomaly.... ) Ex at 2; see also Ex at 12:42-13:11. Thus, the ʼ084 patent admits these features were not novel. Specifically, registry auditing module 12 logs all reads and writes to the registry. Ex at 13: The data obtained by registry auditing module 12 is transmitted, as shown by arrow 24, to data warehouse 18. There, data warehouse 18 stores all of the collected registry access from the training data. Id. at This data is then transmitted, as shown by arrow 28, to model generator 14. Model generator 14 then applies an algorithm to this collected data to create a model of normal computer usage. Id. at 13:66-14:3. Model generator 14 transmits this normal usage model, via arrow 29, to anomaly detector 16, where the normal usage model is loaded. Id. at Thereafter, anomaly detector 16 will read each record from the output data stream of registry auditing module 12 (via arrow 26). Id. Anomaly detector 16 will apply the 7

18 normal usage model and algorithm against each record of registry activity received from registry auditing module 12. Ex at 14: A score generated by the anomaly detection algorithm is compared with a user configurable threshold to determine if the record should be considered anomalous. Id. A list of anomalous registry accesses are then stored and displayed as part of the detector. Id. B. The 084 Patent Prosecution History U.S. Patent Application No. 10/352,343, the application underlying the 084 patent, was filed on January 27, As filed, the 343 application had 39 claims, including independent claims 1, 14, and 25. Claim 1 is representative: The examiner issued a Non-Final Rejection on March 23, 2006, rejecting claims 1-39 on a number of grounds. First, the examiner rejected claims 1-13, 16, 18, 20, 22 and as indefinite pursuant to 35 U.S.C Other claims were rejected for lack of antecedent basis or for using the trademark/trade name WINDOWS. Second, the examiner rejected claims 1, 2, 9, 10, 14, 20-21, 25, 26-28, 36, and 37 under Pre- AIA 35 U.S.C. 102(e) as being anticipated by Chong et al., U.S Publication No. 2003/ The examiner explained that Chong, among other things teaches 8

19 that the step of generating a probabilistic model of normal computer usage comprises determining a likelihood of observing a feature in the records of processes that access the Windows registry (database). Ex at 194 (March 23, 2006 Office Action). The examiner also rejected claims 3-8, 15-19, 29, and under 35 U.S.C. 103(a) as unpatentable over Chong in view of Korba (Windows NT Attacks). Id. at He explained that Korba is directed to a method for evaluating intrusion detection systems in a Windows environment. Korba teaches that the step of gathering features from records of normal processes that access the Windows registry comprises gathering a feature corresponding to a name of a process (explore.exe) accessing the Windows registry. Id. at 197. The examiner added that Chong s method collects all information regarding the nature, type, and objective of a computer based event in a database. Korba collects information regarding accesses to the windows registry (database). Id.; also Ex at (March 23, 2006 Office Action). The examiner further rejected claims 11-13, 22-24, and under 35 U.S.C. 103(a) as unpatentable over Chong in view of Eskin et al. (Adaptive Model Generation for Intrusion Detection Systems). Regarding Eskin, the examiner explained that it is directed to a method for generating an adaptive model for use in an Intrusion Detection System. Eskin teaches that the step of analyzing a record of a process that accesses the Windows registry comprises, for each feature, performing a check to determine if a value of the feature has been previously observed for the feature. Ex at 207. The applicants filed an Amendment and Remarks on August 28, First, 9

20 each of the independent claims was amended to include the language detect deviations from normal computer system usage. Ex at 171. The applicants attempted to distinguish the Chong reference by explaining that it is a supervised learning technique that is only able to estimate the likelihood of events which are observed during training, not previously unobserved events. Ex at (August 28, 2006 Amendment and Remarks). This is because the dataset used to generate the models in Chong is gathered from a variety of sources and includes data representing both typical network behavior and attacks. See also id. at 181 ( Chong does not teach or suggest gathering features of normal processes that access the operating system registry. ). Accordingly, the applicants distinguished Chong on the grounds that Chong s training data included attacks and therefore did not constitute a model of normal computer system usage. With respect to obviousness, applicants argued that there was insufficient motivation to combine Chong and Korba, and that the examiner had not provided reasonable expectation of success of such combination. Id. at

21 The examiner issued a Final Rejection on November 14, 2006, rejecting all claims 1-39, and maintaining the prior grounds for rejection, except for withdrawing the rejections made pursuant to 35 U.S.C Applicant issued an Amendment and Response to the Final Rejection on March 12, Specifically, the applicant made an amendment to each of the independent claims, adding the limitation of determine/[determining] the likelihood of observing an event/[process] that was not observed... Ex at 122. These amendments were made in response to the Chong reference, which applicants described as disclosing the ability to predict an attack is [sic] if it conforms with attacks which were observed during model training. Chong describes using evidence from the bottom-up into the Bayesian network in order to propagate evidence and compute a posterior probability of an attack. Chong neither discloses nor suggests a technique for determining the likelihood of observing an event which was not observed during the gathering of features. Ex at 132 (March 12, 2007 Response). The examiner issued a Non-Final Rejection on July 24, 2007, rejecting claims but allowing claims 1-3 and With respect to anticipation, the examiner rejected claims 14, 20, and 21 on the basis of Chong. With respect to obviousness, the examiner rejected claims on the basis of Chong in view of Korba, and claims on the basis of Chong in view of Eskin. Applicants responded to the July 24, 2007 Office Action on December 19, 2007 by re-inserting certain originally considered dependent claims. Once again, the applicants attempted to distinguish Chong on the basis that its model included previ- 11

22 ously seen data, and therefore Chong can predict an attack is [sic] if it conforms with attacks which were observed during model training.... Since Chong relies only on observed conditions to generate a model, Chong neither discloses nor suggests a technique for determining the likelihood of observing an event which was not observed during the gathering of features, as recited in claim 1. Ex at 75 (December 19, 2007 Response). The examiner issued a Final Office Action on March 18, The examiner again disagreed with applicants characterization of Chong, explaining that Based upon the teachings of Chong et al, the use of a model representing any type of condition and state is indicative of normal processes and the applicant s arguments are moot. March 18, 2008 at 47 (Final Office Action). The examiner reiterated his previous rejections: with respect to anticipation, claims 14, 20, and 21 on the basis of Chong; with respect to obviousness, the examiner rejected claims on the basis of Chong in view of Korba, and claims on the basis of Chong in view of Eskin. Claims 1-13 and were allowed. The applicants filed a Response to the March 18, 2008 Final Office Action on May 2, 2008, cancelling previously rejected claims The Patent Office issued a Notice of Allowance on May 22, 2008 on the basis of claims 1-13 and On September 23, 2008, the Patent Office issued a Supplemental Notice of Allowability with respect to claim 25. The examiner issued an amendment to the claim, adding the language an operating system registry as the first claim element. U.S. Patent No. 7,448,084 issued on November 4,

23 VI. CONSTRUCTION OF THE CHALLENGED CLAIMS (37 C.F.R (B)(3)) The terms in claims 14 and are to be given their broadest reasonable construction ( BRC ), as understood by one of ordinary skill in the art and consistent with the disclosure. See 37 C.F.R (b); see also In re Yamamoto, 740 F.2d 1569, 1571 (Fed. Cir. 1984); In re Am. Acad. of Sci. Tech. Ctr., 367 F.3d 1359, (Fed. Cir. 2004). The following constructions were adopted by the district court in The Trustees of Columbia University in the City of New York v. Symantec Corp., Civil Action No. 3:13-cv-808 for the 084 patent. Ex The district court s opinion is persuasive as to the construction of the following terms. The claim terms should be construed at least as broadly as the constructions the district court adopted for the reasons set forth in that case. Ex Petitioner submits these constructions may be used as the BRC of the corresponding claim terms for the purposes of this challenge. The district court construed the term operating system registry to mean a database of information about a computer s configuration, utilized by an operating system, organized hierarchically as a tree, with entries consisting of keys and values. Ex at 1. This is consistent with the use of this term in the specification of the 084 patent. For example, the 084 patent describes the operating system registry as follows: As is known in the art, the registry is a database of information about a computer's configuration... The registry is the main storage location for all configuration information for almost all programs... The registry also stores much of the important configuration information that are needed by programs in order to run. The registry is organized hierar- 13

24 chically as a tree. Each entry in the registry is called a key and has an associated value. Ex at 5: The ʼ084 patent expressly describes the Windows system registry as an example of an operating system registry. Ex at 4:55-60, 5: The district court construed probabilistic model of normal computer usage to mean model of typical attack-free computer system usage that employs probability. Probability is the likelihood that an event will occur or a condition will be present. Ex at 2. The district court also clarified its order with regard to this claim term stating, the model is generated with only attack-free data. Ex at 2. This definition comports with the specification s description of generating models for use in anomaly detection. For example, the specification repeatedly states that the models must be generated using only attack-free data or clean data: Some attacks involve launching programs that have not been launched before and/or changing keys that have not been changed since the operating system was first installed by the manufacturer. If a model of the normal registry behavior is trained over clean data, then these kinds of registry operations will not appear in the model, and can be detected when they occur. Ex at 6:26-40; also 15:4-16 (referring to a clean (attack-free) dataset ). Therefore, the district court s construction is the BRC. Ex at 100. The district court also construed the term normal computer system usage to mean typical, attack-free usage. As discussed above in connection with probabilistic model of normal computer usage, the district court s construction is supported by the intrinsic record and is therefore the BRC of this term. 14

25 The district court construed the term anomaly/anomalous to mean deviation/deviating from a model of typical, attack-free computer system usage. Ex at 2. The specification describes various embodiments of the invention, all of which define anomaly or anomalous as a deviation from a model of normal behavior. See, e.g., id. at 8:7-9 ( In order to detect anomalous registry accesses, model generator 14 of the system 10 generates a model of normal registry activity. ); id. at 5:16-18 ( The model is then used by the anomaly detector 16 to decide whether each new registry access should be considered anomalous. ) id. at 8:16-19 ( When detecting anomalies, the model of normal behavior is used to determine whether the values of the features of the new registry accesses are consistent with the normal data. If such values are not consistent, the algorithm labels the registry access as anomalous, and the processes that accessed the registry as malicious. ). Therefore, the district court s construction is the BRC of this claim term. Ex at 102. The claim terms should be construed at least as broadly as the constructions the district court adopted for the reasons set forth in that case. Ex. 1005, The claim terms not specifically construed herein are given their BRC, as understood by one of ordinary skill in the art and consistent with the disclosure. Ex at 103. VII. THE CHALLENGED CLAIMS ARE UNPATENTABLE A. Registry Monitoring and Anomaly Detection Were Well Known in the Art Prior to the 084 Patent As described above, the 084 patent uses registry monitoring techniques to achieve anomaly detection (a form of what is more broadly referred to as intrusion 15

26 detection). But the combination of these two core concepts anomaly detection and registry monitoring was already recognized as prior art before the priority date for the 084 patent. Any additional elements recited by the challenged claims merely describe obvious examples of registry monitoring combined with anomaly detection. Prior art described anomaly detection techniques, as well as intrusion detection more broadly, as early on as the late 1990 s. For instance, one early reference authored by Anup Ghosh et al. ( Ghosh I ) describing such schemes provides that, at its most general level, [i]ntrusion detection tools seek to detect attacks against computer systems by monitoring the behavior of users, networks, or computer systems. Ex at 2. Intrusion detection breaks down into two typical approaches: misuse detection and anomaly detection. Misuse detection techniques model attacks on a system as specific patterns, then systematically scan the system for occurrences of these patterns. Ex at 3. Meanwhile, anomaly detection attempt[s] to detect intrusions by noting significant departures from normal behavior. Ex at 3. Unlike misuse detection, which performs signature-based detection techniques, anomaly detection is able to detect novel attacks against systems, i.e., attacks that have not been seen before by our intrusion detection system. Ex at 3. Ghosh I identifies and compares the performance of three different algorithms for anomaly detection. The first of these is equality matching, which involves comparing an event sequence against sequences stored in a database of normal program behavior to determine whether it is malicious. See Ex at 5-7. This technique is predicated on the ability to capture the normal behavior of a program in a database. 16

27 Ex at 6. Second, Ghosh I examines applying adaptive machine learning to generate profiles of normal behavior and comparing new event sequences against this dynamic profile of past behavior to detect anomalies. See Ex at Finally, Ghosh I studies the use of recurrent networks capable of maintaining state information between event sequences to predict future normal behavior, and thereby determining when an event sequence deviates from a predicted event. See Ex at Thus, Ghosh I identifies the three ways to detect anomalous behavior: (1) comparison against a database of all possible normal behavior, assuming that generating such a database is possible; (2) comparison against a profile based on past normal behavior; and (3) comparison against future, predicted normal events. Bace, in her text book entitled Intrusion Detection, describes the matter of anomaly detection at greater length. Bace writes that: Anomaly detection involves a process of establishing profiles of normal user behaviors, comparing actual user behavior to those profiles and flagging deviations from the normal. Ex at 121. The analysis proceeds in four phases: (1) inputting a new event record; (2) preprocessing the event into a suitable form; (3) comparing the event record to the knowledge base (i.e. profile); and (4) generating a response. Ex at Depending on the analysis approach, constructing an analyzer might involve collecting event information generated by a system functioning in an operational environment, or collecting event information in a laboratory environment. Ex at 106. For an anomaly detection scheme to function effectively, event information is collected from the live system itself or from a system designated as similar in order to 17

28 build baseline profiles indicating normal user behavior. Ex at 106. Because anomaly detection relies on comparisons against some benchmark about what constitutes normal user behavior, it depends on an assumption that users exhibit predictable, consistent patterns of system usage. Ex at 121. Accordingly, for an analysis engine to function properly, regardless of analysis approach, it must be tailored to the environment in which it is to operate. Ex at 105. Early implementations of anomaly detection schemes focused on Unixflavored platforms. Ex at 1. As Windows NT [became] the dominant desktop platform, id., however, anomaly detection research attempted to leverag[e] the base object auditing facilities of the Windows NT platform, id. at 4. As detailed in a second paper by Ghosh ( Ghosh II ), critical differences exist between Unix-based and Windows-based platforms. Given these differences between the operating systems, [b]lindly applying Unix intrusion detection techniques may not be appropriate for the Windows NT platform. Ex at 9. Unix-based systems operate under an imperative paradigm. Ex at 5. That means that, under Unix and similar operating systems, [p]rograms make requests of the operating system using system calls, and the operating system either performs the requested action and returns some indicator of success, or the operating system cannot perform the requested action, and returns an error code. Ex at 5. As Ghosh II explains, Windows NT is object oriented. Under object oriented operating systems, input and/or output operations are performed by the operating system giving an object corresponding to a specific resource to a program, and the process operates on that object. Ex at 6. Thus, 18

29 [w]hereas monitoring system calls makes sense on Unix, it might not be optimal on Windows NT. Ex at 9. Recognizing the importance of tailoring anomaly detection to the Windows environment, Bace suggests using multiple Windows resources as information sources. In particular, Bace discusses drawing information from event logs in Windows NT to generate profiles of normal user behavior. Ex at Bace provides that the Windows NT event-logging mechanisms collect three types of system events: operating system events, security events, and application events, each of which are logged by the system. Ex at 74. Although all events are of interest to those attempting to reconstruct system activities, the security log events are the primary focus of intrusion detection systems. Ex at 75. The security log consists of events that are defined as security-relevant.... includ[ing] valid and invalid logins and logoffs, and events related to system resource use, especially those having to do with the creation, deletion, and alteration of system files and other objects. Ex at For any effective anomaly detection scheme running under a Windows operating system, these security logs and related audit logs would necessarily include a record of accesses to the Windows registry. Ex at 32-33, 88-89, 116. Prior art has long recognized that monitoring the registry may serve useful functions, including in the detection of malicious activity. For instance, one study demonstrates how several commonly known malicious attacks on Windows NT systems modify the registry. See Ex at (describing three remote-to-user attacks, including Netbus R-s-U, Netcat R-s-U, and PPMacro R-s-U, that modify keys 19

30 in the registry and can be detected by analyzing accesses to the registry); see also id. at (describing a user-to-root attack called the Yaga U-b-S, which edits the victim s Registry so that the next time a service crash occurs on the victim machine, the attacker is added to the Domain Admins group ). Moreover, prior art roundly recognizes the utility of registry monitoring in intrusion detection. See Ex at 32 ( The capabilities of the host-based IPS [intrusion prevention system] comprise application monitoring of: file system events; registry access.... ); Ex at 5:25-35, Fig. 5 (discussing a detection scheme that monitors system configuration area accesses, such as Registry files ). Common registry monitors available before the priority date of the 084 patent included Regmon, which is expressly described in the 084 patent as prior art and substantially identical to the registry monitor described therein. Ex at 13: A textbook by Mark Russinovich, Inside Windows 2000, published in 2000, illustrates the output of the Regmon registry monitor. See Ex at 55. As Russinovich explains, [f]or each registry access, Regmon shows you the process that performed the access and the time, type, and result of the access. Id. One of ordinary skill in the art creating an anomaly detection scheme in a Windows-based environment would understand the value of such registry monitoring and would combine it with the teachings of Bace. Ex at Proposing a detection scheme better suited for Windows-based operating systems, Jude Shavlik, et al., Evaluating Software Sensors for Actively Profiling Windows 2000 Computer Users ( Shavlik ) expresses the combination of registry monitoring and 20

31 anomaly detection claimed by the 084 patent. Shavlik presents a prototype anomalydetection system that creates statistical profiles of the normal usage for a given computer running Windows Ex at 1. Shavlik notes that prior work [in the field] has focused on Unix systems, whereas over 90% of the world s computers run some variant of Microsoft Windows. Ex at 5. The Shavlik system collects information for these statistical profiles from multiple Windows-based sources: Performance Monitor (Perfmon) data; Event Log monitoring; and User and computer state information, such as typing rates, network traffic levels, programs running, and specific system API s invoked. Ex at 3. Shavlik s Event Log monitoring examines key NT Registry locations, key system files, login abnormalities, and suspect account changes, as well as invalid accesses to key files and to registry entries. Ex at 3. Therefore, Shavlik demonstrates the clear motivation to combine using data obtained from monitoring the Windows operating system registry with the anomaly detection disclosed in Bace. B. Ground 1: Bace in combination with Russinovich claims 14 and obvious. 1. Reasons to Combine Bace with Russinovich As described above, the Bace and Russinovich references are prior art pursuant to 35 U.S.C. 102 (a) and (b). One of ordinary skill in the art would naturally combine these references for the following reasons. Bace expressly discloses using various features of the Windows operating system in anomaly detection. Ex at 74-78; Ex at The Russinovich textbook entitled Inside Windows 2000 is entirely devoted to describing various 21

32 features of the Windows operating system. One of ordinary skill in the art needing more information regarding Bace s disclosure of various Windows features would naturally have looked to the Russinovich textbook to find additional teachings and details. One such feature is the Windows event logs, which include data regarding registry accesses. The Russinovich book discusses Regmon, a prior art tool that monitors and displays registry accesses by all applications as they occur. Ex at 55. One skilled in the art reading Bace s disclosure of an anomaly detection scheme on a computer running the Windows operating system would naturally look to the Russinovich book for further teachings regarding monitoring the Windows registry. Ex at Claim 14: A system for detecting intrusions in the operation of a computer system comprising: Although the Petitioner does not believe the preamble is limiting for this claim, Bace expressly discloses [a] system for detecting intrusions in the operation of a computer system. The Bace textbook, entitled Intrusion Detection, describes various techniques for detecting intrusions in the operation of a computer system. For example, Bace describes intrusion detection as monitoring events occurring in a computer system or network, analyzing them for signs of security problems. Ex at 25. Bace is also directed toward multiple computer systems, including computer systems running Windows NT. See id. at 74. As shown by these citations, Bace describes a system for detecting intrusions in a computer system as required by the preamble. Ex at pp

33 3. Claim 14: (a) an oper[a]ting system registry; Claim 14 is a system claim, and although it repeats much of the language from method claim 1, which is the subject of another requested inter partes review, an obviousness analysis requires an identification of the structures recited by the claim. The BRC of operating system registry is a database of information about a computer s configuration, utilized by an operating system, organized hierarchically as a tree, with entries consisting of keys and values. The Windows system registry is an operating system registry pursuant to the BRC of that term. Ex at 97-98; see Ex at 47 (description of Windows registry). Bace suggests using records of Windows registry events as an information source for building the historical profile of normal usage. For example, Bace describes Windows NT event logs as a source of information for building profiles. Ex at 74. These event logs would contain records of normal processes that access the operating system registry. Ex at Although Bace does not expressly disclose records of registry activity as an information source, one of ordinary skill in the art would understand that these references to the various Windows logs would include such registry information. Ex at 117. Further, the Russinovich textbook discusses Regmon, a prior art tool that monitors and displays registry accesses by all applications as they occur. Russinovich illustrates the output of the Regmon registry monitor: 23