Palo Alto Networks, Inc. v. Finjan, Inc.

• Court: Court of Appeals for the Federal Circuit
• Decided: September 19, 2018
• Docket: 17-2059
• Status: Unpublished

Opinion

NOTE: This disposition is nonprecedential.

United States Court of Appeals for the Federal Circuit ______________________

PALO ALTO NETWORKS, INC., Appellant

v.

FINJAN, INC., Appellee ______________________

2017-2059 ______________________

Appeal from the United States Patent and Trademark Office, Patent Trial and Appeal Board in Nos. IPR2015- 02001, IPR2016-00157, IPR2016-00955, IPR2016-00956. ______________________

Decided: September 19, 2018 ______________________

ORION ARMON, Cooley LLP, Broomfield, CO, argued for appellant.

PAUL J. ANDRE, Kramer Levin Naftalis & Frankel LLP, Menlo Park, CA, argued for appellee. Also repre- sented by JAMES R. HANNAH. ______________________ 2 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

Before REYNA, SCHALL, and STOLL, Circuit Judges. STOLL, Circuit Judge. Appellant Palo Alto Networks, Inc. petitioned for two inter partes reviews of Appellee Finjan, Inc.’s U.S. Patent No. 8,225,408, alleging that certain claims were un- patentable as obvious. The Patent Trial and Appeal Board of the U.S. Patent and Trademark Office (“Board”) found that there was insufficient evidence that Palo Alto Networks’s proposed prior art combinations would have taught the “dynamically building” claim limitation. Palo Alto Networks, Inc., No. IPR2015-02001, 2017 WL 1052502, at *4–10 (P.T.A.B. Mar. 17, 2017) (“Board Decision”). Therefore, the Board found that Palo Alto Networks failed to carry its burden of demonstrating, by a preponderance of the evidence, that any of the challenged claims would have been obvious. Id. Palo Alto Networks appeals. We affirm. I Finjan’s ’408 patent relates to methods and systems for detecting malware in data streamed from a network onto a computer. The patent relates to network security, including scanning code to determine whether there are potential viruses in the code. The patent describes a scanner system that preferably uses generic architecture, is language-independent, and is customized for a specific language by using a set of language-specific rules. The ’408 patent explains that this adaptive rule-based scanner has three components (illustrated in Figure 2, below). Tokenizer 210 recognizes and identifies constructs (i.e., “tokens”) within a byte source code. For example, code between { } or [ ] would become a token. Parser 220 controls the process of scanning incoming content, prefer- ably by building a parse tree data structure that repre- sents the incoming content. Finally, analyzer 230 checks for malware by searching for specific patterns of content that indicate malware. PALO ALTO NETWORKS, INC. v. FINJAN, INC. 3

’408 patent, Fig. 2. Claims 1, 3–7, 9, 12–16, 18–23, 29, and 35 are at issue in this appeal, and independent claim 1 is illustrative: 1. A computer processor-based multi-lingual method for scanning incoming program code, comprising: receiving, by a computer, an incoming stream of program code; determining, by the computer, any specific one of a plurality of programming languages in which the incoming stream is written; instantiating, by the computer, a scanner for the specific programming language, in response to said determining, the scanner comprising parser rules and analyzer rules for the specific program- ming language, wherein the parser rules define certain patterns in terms of tokens, tokens being lexical constructs for the specific programming language, and wherein the analyzer rules identify 4 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

certain combinations of tokens and patterns as be- ing indicators of potential exploits, exploits being portions of program code that are malicious; identifying, by the computer, individual tokens within the incoming stream; dynamically building, by the computer while said receiving receives the incoming stream, a parse tree whose nodes represent tokens and patterns in accordance with the parser rules; dynamically detecting, by the computer while said dynamically building builds the parse tree, com- binations of nodes in the parse tree which are in- dicators of potential exploits, based on the analyzer rules; and indicating, by the computer, the presence of po- tential exploits within the incoming stream, based on said dynamically detecting. Id. claim 1 (emphasis added to highlight the disputed claim limitation). We focus on the claim limitation requir- ing “dynamically building” a parse tree, which is common to all the challenged claims. The Board construed “dy- namically building” to mean: “requires that a time period for dynamically building overlap with a time period during which the incoming stream is being received.” Board Decision, 2017 WL 1052502, at *3. This unopposed claim construction was proposed by Palo Alto Networks based on the plain claim language, which requires “dy- namically building, by the computer while said receiving receives the incoming stream.” ’408 patent, claim 1. II Palo Alto Networks asserted that claims 1, 3–5, 9, 12– 16, 18, 19, 22, 23, 29, and 35 of the ’408 patent would have been obvious over U.S. Patent No. 7,636,945 (“Chandnani”) and U.S. Patent No. 5,860,011 (“Kolawa”) PALO ALTO NETWORKS, INC. v. FINJAN, INC. 5

under 35 U.S.C. § 103. Palo Alto Networks also asserted that the same claims would have been obvious over Chandnani, Kolawa, and U.S. Patent No. 7,284,274 (“Walls”). Chandnani teaches a method of detecting malware in a data stream, including determining the programming language of the data stream and detecting viral code. Figure 2 from Chandnani (duplicated below) illustrates Chandnani’s script language virus detection apparatus, including detection engine 53, one of the focal points of Chandnani’s method:

Chandnani, Fig. 2, col. 8 ll. 5–7. Detection engine 53 tokenizes the incoming data stream by breaking it into smaller pieces known as tokens. As part of that process, it receives the language check data from the language description module 55, as indicated in step 31 of Figure 6: 6 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

Id. at Fig. 6, col. 7 ll. 61–63. The language check data is used to lexically analyze the data stream at step 33 to determine the appropriate script language. Id. at col. 7 ll. 63–65. At step 35, the language definition data for the script language determined in step 33 is retrieved from language description module 55. Id. at col. 7 ll. 65–67. Using the language definition data retrieved at step 35, the data stream is lexically analyzed for a second time to generate the stream of tokens at step 37. Id. at col. 7 l. 67–col. 8 l. 3 (“the data stream is again lexically ana- lyzed to generate a stream of tokens” (emphasis added)). PALO ALTO NETWORKS, INC. v. FINJAN, INC. 7

Chandnani provides the following summary of the to- kenizing procedure, explaining the function of its “lexical analyzer”: To tokenize the data stream, a script language used in the data stream is determined using the language check data. The data stream is analyzed using the language check data to select the lan- guage definition data to use for the detection pro- cess. Next, the selected language definition data and the data stream are supplied to the lexical analyzer. The data stream is lexically analyzed again, this time using the language definition da- ta, to generate a stream of tokens. As mentioned above, each generated token corresponds to a spe- cific language construct, and may be a correspond- ing unique number or character. Id. at col. 8 ll. 7–17 (emphases added). The Board determined that the dispositive issue was whether Palo Alto Networks demonstrated, by a prepon- derance of the evidence, that the prior art teaches or suggests “dynamically building” a parse tree “while” receiving an incoming stream of program code. Specifical- ly, the parties disputed whether Chandnani discloses that the time period for generating the token stream overlaps with the time period for receiving the incoming stream, as required by the Board’s construction of “dynamically building.” The Board found that Chandnani does not teach the “dynamically building” limitation of the ’408 patent because it does not demand or even imply that the data stream is being received while being tokenized. In sup- port of its conclusion, the Board cited testimony of Fin- jan’s expert, Dr. Nenad Medvidovic. Ultimately, the Board concluded that Palo Alto Networks had not demon- strated, by a preponderance of the evidence, that the combination of Chandnani and Kolawa would have taught 8 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

or suggested “dynamically building” a parse tree “while” receiving an incoming stream of program code. The Board likewise concluded that Palo Alto Networks had not demonstrated, by a preponderance of the evidence, that the combination of Chandnani, Kolawa, and Walls teach- es or suggests “dynamically building” a parse tree “while” receiving an incoming stream of program code. The Board found that Finjan had failed to carry its burden of show- ing that the instituted prior art disclosed the “dynamical- ly building” limitation. Accordingly, it did not consider evidence of secondary considerations of nonobviousness, including expert testimony from Finjan’s expert, Dr. Harry Bims, on that issue. Palo Alto Networks appeals. We have jurisdiction pursuant to 28 U.S.C. § 1295(a)(4)(A). III Obviousness under 35 U.S.C. § 103 is a mixed ques- tion of law and fact. 1 We review the Board’s ultimate obviousness determination de novo and its underlying fact-findings for substantial evidence. Harmonic Inc. v. Avid Tech., Inc., 815 F.3d 1356, 1363 (Fed. Cir. 2016). “Substantial evidence is something less than the weight of the evidence but more than a mere scintilla of evidence,” meaning that “[i]t is ‘such relevant evidence as a reasona- ble mind might accept as adequate to support a conclu-

1 Congress amended § 103 when it enacted the Leahy–Smith America Invents Act (‘‘AIA’’). Pub. L. No. 112-29, § 3(c), 125 Stat. 284, 287 (2011). Because the application that led to the ’408 patent has never contained (1) a claim having an effective filing date on or after March 16, 2013, or (2) a reference under 35 U.S.C. §§ 120, 121, or 365(c) to any patent or application that ever contained such a claim, the pre-AIA § 103 applies. See id. § 3(n)(1), 125 Stat. at 293. PALO ALTO NETWORKS, INC. v. FINJAN, INC. 9

sion.’” In re NuVasive, Inc., 842 F.3d 1376, 1379–80 (Fed. Cir. 2016) (quoting In re Applied Materials, Inc., 692 F.3d 1289, 1294 (Fed. Cir. 2012)). As a preliminary matter, the parties do not dispute the Board’s definition of a person of ordinary skill in the art as having a bachelor’s degree or equivalent experience in computer science or related academic fields, and three to four years of additional experience in the field of com- puter security, or equivalent work experience. A On appeal, Palo Alto Networks challenges the Board’s reading of Chandnani. In particular, Palo Alto Networks asserts that the Board erred in finding that Chandnani does not teach “dynamically building” a parse tree while receiving an incoming stream of program code. We hold that the Board’s finding is supported by sub- stantial evidence because the reference itself, by using the word “again,” indicates that the data stream is lexically analyzed more than once and not simultaneously. Chandnani teaches using “language check data to lexical- ly analyze the data stream to determine the appropriate script language” and that “[u]sing the language definition data . . . the data stream is again lexically analyzed to generate a stream of tokens.” Chandnani, col. 7 l. 60– col. 8 l. 3 (emphasis added). The Board was also entitled to credit the testimony of Dr. Medvidovic, who opined that “simply because Chandnani’s tokenizer operates on a data stream does not demand or even imply that the data stream is being received while being tokenized.” Board Decision, 2017 WL 1052502, at *8 (quoting J.A. 3091–92, ¶ 74 (citing Chandnani, col. 9 ll. 12–16, col. 7 l. 60–col. 8 l. 17, Fig. 6)). Dr. Medvidovic further testified that “Chandnani would still temporarily store the entire data stream in memory at least between the first and second lexical analyses.” J.A. 3092 ¶ 74. His testimony supports the Board’s conclusion that a person of ordinary skill, 10 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

reviewing Chandnani, would not have understood it to teach “dynamically building” a parse tree. We appreciate Palo Alto Networks’s argument and its expert’s testimony that speed is critical to malware detec- tion and that “delaying analysis of a file obtained from a network until the entire file is received would have been viewed as creating unnecessary delay for the user and subjecting the receiving computer to risk of damage due to execution of stored malware files.” Appellant’s Br. at 40; see also id. at 8–11. The issue before us, however, is whether the Board’s reading of Chandnani is supported by “such relevant evidence as a reasonable mind might accept as adequate to support” the Board’s conclusion. NuVasive, 842 F.3d at 1379–80. Based on plain language quoted above from Chandnani’s specification, we conclude that it is supported by such substantial evidence. See id. Palo Alto Networks next challenges the Board’s treatment of Walls, a prior art reference Palo Alto relied on in the alternative for disclosure of the “dynamically building” limitation. Palo Alto argues that the Board erred by analogizing Walls to Chandnani and by not meaningfully reviewing Walls as a separate reference that discloses the dynamically building limitation. In its Final Written Decision, the Board noted that Palo Alto Networks’s “challenges based on the combination of Walls with Chandnani and Kolawa suffer from the same defi- ciencies as its challenges based on Chandnani and Kola- wa alone, in that [it] does not sufficiently establish that the prior art it relies on discloses the temporal interleav- ing required by our construction of ‘dynamically build- ing.’” Board Decision, 2017 WL 1052502, at *8. In so holding, the Board considered the disclosure of Walls and the expert testimony regarding Walls from both parties. It also performed its own review of Walls and ultimately concluded that Palo Alto Networks had not demonstrated, by a preponderance of the evidence, that the combination of Chandnani, Kolawa, and Walls teaches or suggests PALO ALTO NETWORKS, INC. v. FINJAN, INC. 11

“dynamically building” a parse tree “while” receiving an incoming stream of program code. Accordingly, we con- clude that, contrary to Palo Alto Network’s assertion, the Board did not fail to meaningfully consider the teachings of Walls. B Finally, Palo Alto Networks asserts that the Board erred by not considering particular cross-examination testimony from Finjan’s expert witnesses when analyzing whether the prior art taught “dynamically building.” Before trial, Finjan had moved to exclude this particular cross-examination testimony of its experts, Dr. Medvidov- ic and Dr. Bims. The Board denied Finjan’s motion. Instead, the Board explained that it would consider Finjan’s arguments “as going to the weight that should be given to the cross-examination testimony,” not its admis- sibility. Board Decision, 2017 WL 1052502, at *10. In its Final Written Decision, the Board stated that it had “considered and weighed the testimony provided by Dr. Medvidovic,” but that it had “not relied on the testi- mony of Dr. Bims in reaching [its] decision.” Id. Palo Alto Networks argues that the Board failed to meaning- fully consider the testimony from both witnesses. First, Palo Alto Networks protests that Dr. Medvidovic’s cross-examination testimony was not substantively discussed in the Board’s decision. Palo Alto Networks cites Google Inc. v. Intellectual Ventures II LLC, 701 F. App’x 946 (Fed. Cir. 2017), where this court held in a nonprecedential opinion that it could not review the Board’s findings because it could not discern, from the Board’s opinion, the scope of “all evidence and arguments” considered by the Board. Google, 701 F. App’x at 954. Here, however, it was clear why Dr. Medvidovic’s testi- mony would not have been convincing. More elaboration was not required. The Board acknowledged Dr. Medvidovic’s cross-examination testimony and ex- 12 PALO ALTO NETWORKS, INC. v. FINJAN, INC.

plained its reasoning for why Chandnani does not disclose the required claim limitation, even having considered Palo Alto Networks’s counterarguments: [T]o the extent that Chandnani discloses different embodiments directed to the underlying identifi- cation of the file to be scanned—whether stored on a hard or floppy disk, or received via a network— Chandnani still requires multiple passes through the file, first to determine the appropriate script language and then to lexically analyze the data stream to generate the stream of tokens. Board Decision, 2017 WL 1052502, at *8 (Mar. 17, 2017) (citing Chandnani Fig. 6; J.A. 3090–92). Indeed, as we held in PGS Geophysical AS v. Iancu, even while “we may not supply a reasoned basis for the agency’s action that the agency itself has not given, we will uphold a decision of less than ideal clarity if the agency’s path may reason- ably be discerned.” 891 F.3d 1354, 1365 (Fed. Cir. 2018) (citing Bowman Transp., Inc. v. Arkansas–Best Freight Sys., Inc., 419 U.S. 281, 286 (1974); NuVasive, 842 F.3d at 1383). As in PGS, we think that the Board did not fail to address the question at hand. We therefore affirm. Second, Palo Alto Networks argues that the Board gave no rationale for not relying on Dr. Bims’s cross- examination testimony. The Board, having found that Finjan had failed to carry its burden of showing that the instituted prior art disclosed the “dynamically building” limitation, did not reach the issue of secondary considera- tions of nonobviousness. Therefore, it was not necessary for the Board to consider Dr. Bims’s testimony, which was limited to the issue of secondary considerations of nonob- viousness. Accordingly, we find no error in the Board’s decision not to consider Dr. Bims’s testimony, and we conclude that the Board sufficiently explained its ra- tionale for declining to do so. PALO ALTO NETWORKS, INC. v. FINJAN, INC. 13

IV We have considered the parties’ remaining argu- ments, including Palo Alto Networks’s arguments regard- ing “temporal interleaving,” and find them unpersuasive. We affirm the Board’s decision. AFFIRMED COSTS Costs to Appellee.