SRI International, Inc. v. Internet Security Systems, Inc.

511 F.3d 1186, 85 U.S.P.Q. 2d (BNA) 1489, 2008 U.S. App. LEXIS 267, 2008 WL 68679
CourtCourt of Appeals for the Federal Circuit
DecidedJanuary 8, 2008
Docket2007-1065
StatusPublished
Cited by40 cases

This text of 511 F.3d 1186 (SRI International, Inc. v. Internet Security Systems, Inc.) is published on Counsel Stack Legal Research, covering Court of Appeals for the Federal Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
SRI International, Inc. v. Internet Security Systems, Inc., 511 F.3d 1186, 85 U.S.P.Q. 2d (BNA) 1489, 2008 U.S. App. LEXIS 267, 2008 WL 68679 (Fed. Cir. 2008).

Opinions

Opinion for the court filed by Circuit Judge RADER. Opinion dissenting in part filed by Circuit Judge MOORE.

RADER, Circuit Judge.

On summary judgment, the United States District Court for the District of Delaware held U.S. Patent Nos. 6,484,203 (“the '203 patent”), 6,708,212 (“the '212 patent”), 6,321,338 (“the '338 patent”), and 6,711,615 (“the '615 patent”) invalid as anticipated by SRI International, Inc.’s (“SRI’s”) own prior art publication “Live Traffic Analysis of TCP/IP Gateways” (“Live Traffic”). SRI Int’l, Inc. v. Internet Sec. Sys., Inc., 456 F.Supp.2d 623 (D.Del.2006). The district court also granted summary judgment of invalidity of the '212 patent as anticipated by a paper entitled “EMERALD: Event Monitoring Enabling Responses To Anomalous Live Disturbances” (“EMERALD 1997”). Id. Because the district court correctly determined that the EMERALD 1997 paper anticipated the '212 patent, this court affirms that decision. However, due to genuine issues of material fact about the public accessibility of the Live Traffic paper, this court vacates and remands the district court’s other determination.

I

SRI owns the '203, the '212, the '338, and the '615 patents. The SRI patents relate to cyber security and intrusion detection. Specifically, the patents describe “[a] computer-automated method of hierarchical event monitoring and analysis within an enterprise network including deploying network monitors in the enterprise network, detecting, by the network monitors, suspicious network activity based on analysis of network traffic data.” '203 Patent Abstract. All four patents originated from a November 9, 1998 application by inventors Phillip Porras and Alfonso Valdes.

A. EMERALD 1997

SRI had done considerable research on network intrusion detection. In fact, SRI’s Event Monitoring Enabling Responses to Anomalous Live Disturbances (“EMERALD”) project attracted considerable attention in this art field. SRI first received funding for the EMERALD project in August 1996 and almost immediately began publicizing EMERALD at a workshop in November 1996. In June 1997, SRI posted an EMERALD 1997 paper on its SRI file transfer protocol1 (“FTP”) server. In October 1997, SRI presented EMERALD 1997 at the 20th National Information Systems Security Conference. The conference published the peer-reviewed article.

The EMERALD 1997 paper contains a detailed description of a tool for tracking malicious activity across large networks. Furthermore, the EMERALD 1997 paper discusses SRI’s early research in Intrusion Detection Expert System (“IDES”) technology. The paper then explains the development of the Next Generation IDES (“NIDES”). This technology uses a wide range of multivariate statistical measures [1189]*1189to profile user behavior and detect anomalies in network traffic. The EMERALD 1997 paper describes the use of NIDES to detect network anomalies. EMERALD 1997 also teaches signature analysis, among other analysis engines. The EMERALD 1997 paper and the '212 specification contain some overlapping material. For instance, both the '212 patent specification and the EMERALD 1997 article feature two nearly identical figures. Figures 1 and 2 in the EMERALD 1997 paper are nearly identical to Figures 2 and 3'from the '212 patent, shown below.

EMERALD 1997

[[Image here]]
[[Image here]]

The EMERALD 1997 paper and the '212 patent specification also share overlapping text. The paper and the specification contain similar descriptions of the NIDES algorithm for statistical detection. The paper also discusses changes to the algorithm to accommodate network traffic. SRI Int’l, Inc., 456 F.Supp.2d at 633. [1190]*1190Specifically, EMERALD 1997 and the '212 patent both state:

Profiles are provided to the computational engine as classes defined in the resource object 32. The mathematical functions for anomaly scoring, profile maintenance, and updating do not require knowledge of the data being analyzed beyond what is encoded in the profile class. Event collection interoperability supports translation of the event stream to the profile and measure classes. At that point, analysis for different types of monitored entities is mathematically similar. This approach imparts great flexibility to the analysis in that fading memory constants, update frequency, measure type, and so on are tailored to the network entity being monitored.

SRI Int'l, Inc., 456 F.Supp.2d at 633 fn. 22; '212 Patent col.7 II. 13-24.

During prosecution of the '212 patent, SRI disclosed the EMERALD 1997 paper in its Information Disclosure Statement, listing the paper in the patent’s Other Publications section. The trial court found that “[SRI] does not argue that the EMERALD 1997 paper fails to disclose each of the limitations of the asserted claims of the '212 patent.” Id. at 632. Instead, SRI contends that the EMERALD 1997 paper is not an enabling disclosure with respect to the '212 patent. On this basis, SRI challenges the district court’s grant of summary judgment.

B. The Live Traffic Paper

The inventors drafted the Live Traffic paper based on the EMERALD project. Mr. Porras and Mr. Valdes authored the paper in 1997. SRI displayed the paper on its web site on November 10, 1997. The four patents in this case incorporate the paper by reference. Furthermore, SRI listed the Live Traffic paper in its information disclosure to the government agency that funded some of SRI’s cyber security research.

SRI filed its patent application on November 9, 1998, one day before the critical date of November 10. The Live Traffic paper, as published in the December 12, 1997 proceedings of the 1998 Symposium on Network and Distributed Systems Security (“SNDSS”), was cited in the Information Disclosure Statement of the patents-in-suit.

The Internet Society (“ISOC”) posted the 1998 SNDSS call for papers on its web site. The call for papers stated that all submissions were to be made via electronic mail by August 1, 1997 with a backup submission sent by postal mail. The call for papers announcement did not include any information on confidentiality of paper submissions. On August 1, 1997, Mr. Por-ras sent an email to Dr. Bishop, the Program Chair for SNDSS, in response to the SNDSS call for papers. Mr. Porras attached the Live Traffic paper to his email. Mr. Porras stated that SRI would make a copy of the Live Traffic paper available on the SRI FTP server as a backup. He included the specific FTP address, ftp://ftp.csl.sri.com/pub/emerald/ndss98.ps, in the email.

The following listings show an index of the SRI FTP server:

[1191]*1191[[Image here]]

[[Image here]]

The record reflects seven instances in which Mr. Porras previously directed people to the EMERALD subdirectory to find other papers related to the EMERALD project. In four instances, Mr. Porras provided the full path and filename of the paper. In every instance, Mr. Porras directed the people to a specific paper, which included the term “emerald” in the filen-ame. SRI brought an action against defendants Internet Security Systems, Inc.2 (“ISS”) and Symantec Corporation (“Sym-antec”) for infringement of the '203, the [1192]*1192'212, the '338, and the '615 patents.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Villalobos v. United States
Federal Claims, 2025
M & K Holdings, Inc. v. Samsung Electronics Co., Ltd.
985 F.3d 1376 (Federal Circuit, 2021)
Guangdong Alison Hi-Tech Co. v. Itc
936 F.3d 1353 (Federal Circuit, 2019)
Samsung Electronics Co., Ltd. v. Infobridge Pte. Ltd.
929 F.3d 1363 (Federal Circuit, 2019)
Erfindergemeinschaft UroPep GbR v. Lilly
276 F. Supp. 3d 629 (E.D. Texas, 2017)
Erfindergemeinschaft UroPep GbR v. Eli Lilly & Co.
240 F. Supp. 3d 605 (E.D. Texas, 2017)
ART + COM Innovationpool GmbH v. Google Inc.
155 F. Supp. 3d 489 (D. Delaware, 2016)
SRI International, Inc. v. Cisco Systems, Inc.
179 F. Supp. 3d 339 (D. Delaware, 2016)
Intellectual Ventures I, LLC v. Canon Inc.
143 F. Supp. 3d 143 (D. Delaware, 2015)
Suffolk Technologies, LLC v. Aol Inc.
752 F.3d 1358 (Federal Circuit, 2014)

Cite This Page — Counsel Stack

Bluebook (online)
511 F.3d 1186, 85 U.S.P.Q. 2d (BNA) 1489, 2008 U.S. App. LEXIS 267, 2008 WL 68679, Counsel Stack Legal Research, https://law.counselstack.com/opinion/sri-international-inc-v-internet-security-systems-inc-cafc-2008.