Free Letter - District Court of Delaware - Delaware

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 1 of 14

B

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 2 of 14

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF DELAWARE SRI INTERNATIONAL, INC., a California Corporation, Plaintiff and Counterclaim-Defendant, v. INTERNET SECURITY SYSTEMS, INC., a Delaware corporation, INTERNET SECURITY SYSTEMS, INC., a Georgia corporation, and SYMANTEC CORPORATION, a Delaware corporation, Defendants and Counterclaim-Plaintiffs. C. A. No. 04-1199 (SLR)

JOINT CLAIM CONSTRUCTION STATEMENT Pursuant to the Court's Rule 16 Scheduling Order in this matter, the Parties hereby submit the following claim chart to present their respective, proposed constructions of disputed claim terms and their proposed constructions of agreed claim terms in the four patents-in-suit, namely, U.S. Patent Nos. 6,321,338 ("the '338 patent), 6,484,203 ("the '203 patent"), 6,708,212 ("the '212 patent"), and 6,711,615 ("the `615 patent").

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 3 of 14

SRI v. Internet Security Systems and Symantec Joint Claim Constructions Statement

Terms which one or more parties contend require construction: PATENT(S) all patents (multiple claims) CLAIM TERM network monitor monitor SRI CONSTRUCTION Process or component in a network that can analyze data; depending on the context in specific claims, the network monitor may analyze network traffic data, reports of suspicious network activity or both. Service monitors, domain monitors and enterprise monitors are examples of network monitors. SRI does not believe the term needs construction but, if construed, should be construed to mean locating two or more network monitors so as to allow them to receive data to be monitored and/or to send information. Process or component in a network that receives reports from at least one lower-level monitor. ISS CONSTRUCTION generic code that can be dynamically configured and reconfigured with reusable modules that define the monitor's inputs, analysis engines and their configurations, response policies and output distribution for its reports SYMANTEC CONSTRUCTION software that can be dynamically configured to collect, analyze and respond to suspicious network activity, and that includes one or more analysis engines and a resolver that implements a response policy

'615, '203 and '212 (multiple claims)

deploying a plurality of network monitors

installing and configuring two or more network monitors so that together they form an analysis hierarchy defined by the network monitors' inputs and output distribution a network monitor that receives reports as input from one or more network monitors that are at a lower layer in the analysis hierarchy

installing and configuring two or more network monitors

'615, '203 and '212 (multiple claims)

hierarchical monitor hierarchically higher network monitor

a network monitor that receives reports from one or more network monitors at a lower layer in a hierarchy

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 4 of 14

SRI v. Internet Security Systems and Symantec Joint Claim Constructions Statement PATENT(S) CLAIM TERM hierarchical event monitoring [and analysis] SRI CONSTRUCTION monitoring events through the use of a hierarchical monitor ISS CONSTRUCTION monitoring and analyzing events through the use of network monitors that are configured to form an analysis hierarchy of two or more layers a network monitor that provides local real-time analysis of network packets handled by a network entity SYMANTEC CONSTRUCTION Symantec does not believe the term needs construction.

' 203, `212 and `615 (multiple claims)

service monitor

' 203, `212 and `615 (multiple claims)

domain monitor

' 203, `212 and `615 (multiple claims)

enterprise monitor

SRI does not believe the term needs construction but, if construed, should be construed to mean a network monitor that analyzes data from individual components or services. SRI does not believe the term needs construction but, if construed, should be construed to mean a network monitor that analyzes data from a domain. SRI does not believe the term needs construction but, if construed, should be construed to mean a network monitor that analyzes data from an enterprise, i.e. a collection of domains.

a network monitor that provides local real-time analysis of network packets handled by a network entity

a network monitor that receives and analyzes intrusion reports disseminated by service monitors a network monitor that receives and analyzes intrusion reports disseminated by domain monitors

a network monitor that correlates intrusion reports disseminated by service monitors

a network monitor that correlates intrusion reports disseminated by domain monitors

2

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 5 of 14

SRI v. Internet Security Systems and Symantec Joint Claim Constructions Statement PATENT(S) ' 203, `212 and `615 (multiple claims) CLAIM TERM peer-to-peer relationships SRI CONSTRUCTION SRI does not believe the term needs construction but, if construed, should be construed to mean relationships between two or more entities at the same level in a hierarchy. SRI does not believe the phrase needs construction. ISS CONSTRUCTION relationships where entities at the same layer in a hierarchy receive reports from one another SYMANTEC CONSTRUCTION relationships comprising communication between two or more entities at the same layer in a hierarchy or not in a hierarchy analysis is based on one or more of the following categories

' 615 (multiple claims)

based on analysis of network traffic data selected from one or more of the following categories... based on analysis of network traffic data selected from the following categories... automatically receiving and integrating the reports of suspicious activity

analysis is based on one or more of the following categories

`203 (multiple claims) ' 615, ' 203 and ' 212 (multiple claims)

Without user intervention, receiving reports and combining those reports into another functional unit.

automatically receiving and combining the reports of detected suspicious network activity

automatically receiving and combining the reports of detected suspicious network activity

3

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 6 of 14

SRI v. Internet Security Systems and Symantec Joint Claim Constructions Statement PATENT(S) ' 615, `203 and `212 (multiple claims) CLAIM TERM wherein integrating comprises correlating intrusion reports reflecting underlying commonalities a network monitor that correlates activity in the multiple network monitors based on the received event records responding... SRI CONSTRUCTION Combining the reports based on underlying commonalities between them. ISS CONSTRUCTION determining relationships among the reports of detected suspicious network activity SYMANTEC CONSTRUCTION determining relationships among the reports of detected suspicious network activity

`338 claim 15

' 338 (multiple claims) ' 203, `212 and `615 (multiple claims)

Taking an action in response.

invoking countermeasures

taking an action in response to a suspected attack, including passive responses such as report dissemination to other monitors or administrators, and highly aggressive actions, such as severing a communication channel or the reconfiguration of logging facilities within network components

taking an action in response

4

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 7 of 14

SRI v. Internet Security Systems and Symantec Joint Claim Constructions Statement PATENT(S) ' 338 patent (multiple claims) CLAIM TERM building at least one long-term and at least one short-term statistical profile from at least one measure of the network packets SRI CONSTRUCTION Creating at least one statistical description representative of historical network activity, and creating at least one statistical description of recent network activity, where the descriptions are based on one or more measures of network packets. See above. ISS CONSTRUCTION See below. SYMANTEC CONSTRUCTION See below.

building at least one long-term ... statistical profile from at least one measure

automatically generating and updating a description of network activity based on an exponentially aged probability distribution of historically observed values of one or more measures automatically generating and updating a description of network activity based on an exponentially aged probability distribution of recently observed values of one or more measures

automatically generating and updating an exponentially aged probability distribution of historically observed activities from at least one measure automatically generating and updating an exponentially aged probability distribution of recently observed activities from at least one measure

building ... at least one short-term statistical profile from at least one measure

See above.

5

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 8 of 14

SRI v. Internet Security Systems and Symantec Joint Claim Constructions Statement PATENT(S) ' 338 claims 1, 11, 21, 24, 25 CLAIM TERM determining whether the difference between the short-term statistical profile and the long-term statistical profile indicates suspicious network activity SRI CONSTRUCTION SRI does not believe the term needs construction but, if construed, should be construed to mean using the result of the comparison to decide whether the monitored activity is suspicious. ISS CONSTRUCTION determining whether the difference between the short-term statistical profile and long-term statistical profile exceeds a threshold that is empirically determined to indicate suspicious activity based on the historically adaptive deviation between the two profiles, requiring no prior knowledge of suspicious activity a method that builds a statistical profile of historically observed network traffic activity and a statistical profile of recently observed activity and finds suspicious network activity when the difference between the two exceeds a threshold that is empirically determined to indicate suspicious activity based on the historically adaptive deviation between the two profiles, requiring no prior knowledge of suspicious activity SYMANTEC CONSTRUCTION determining whether the quantitative difference between the short-term statistical profile and the long-term statistical profile exceeds a difference which is historically-adaptive for the monitored network, thereby indicating suspicious network activity. This determination requires no prior knowledge of suspicious network activity. A method of detecting suspicious network activity which comprises building a long-term statistical profile and a short-term statistical profile. This method requires no prior knowledge of suspicious network activity. This method is not a signature matching detection method or threshold analysis.

' 212 and ' 615 (multiple claims)

a statistical detection method

SRI does not believe the term needs construction but, if construed, should be construed to mean a method of detecting suspicious network activity by applying one or more statistical functions in the analysis of network traffic data.

6

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 9 of 14

SRI v. Internet Security Systems and Symantec Joint Claim Constructions Statement PATENT(S) ' 212 (multiple claims) CLAIM TERM a signature matching detection method SRI CONSTRUCTION SRI does not believe the term needs construction but, if construed, should be construed to mean a method of detecting suspicious network activity by comparing observed network traffic data to known patterns. More than one. ISS CONSTRUCTION a method of detecting suspicious network activity which comprises comparing observed network traffic data to known patterns or thresholds SYMANTEC CONSTRUCTION a method of detecting suspicious activity which comprises comparing observed network traffic data to known patterns or thresholds

' 203, `212 and `615 (multiple claims) [AGREED] ' 338 claims 20 and 25 [AGREED AS TO MEANING] `615 claim 74

a plurality

more than one

more than one

wherein the network entity comprises a virtual private network entity receiving packets at a virtual private network entity the enterprise network is a virtual private network (VPN)

SRI does not believe the term needs construction but, if construed, should be construed to mean a network that uses encryption to securely transmit network packets via a public network.

a network that uses encryption to securely transmit network packets via a public network

a network that uses encryption to securely transmit network packets via a public network

7

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 10 of 14

SRI v. Internet Security Systems and Symantec Joint Claim Constructions Statement PATENT(S) ' 615 (multiple claims) [AGREED AS TO MEANING] CLAIM TERM firewall SRI CONSTRUCTION SRI does not believe the term needs construction but, if construed, should be construed to mean an interface between two networks that enforces a security policy. SRI does not believe the term needs construction but, if construed, should be construed to mean a server that mediates communication between a client application, such as a Web browser, and a real server. It handles requests to the real server to see if it can fulfill the requests itself. If not, it forwards the request to the real server. ISS CONSTRUCTION an interface between two networks that enforces a security policy SYMANTEC CONSTRUCTION an interface between two networks that enforces a security policy

all patents

proxy server

a firewall component that enforces a security policy for a specific application or service

a firewall component that enforces a security policy for a specific application or service

8

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 11 of 14

Dated: March 17, 2006 FISH & RICHARDSON P.C. By: /s/John F. Horvath Timothy Devlin (#4241) John F. Horvath (#4557) 919 N. Market St., Ste. 1100 P.O. Box 1114 Wilmington, DE 19889-1114 Telephone: (302) 652-5070 Facsimile: (302) 652-0607 Howard G. Pollack (CA Bar No. 162897) Gina M. Steele (CA Bar No. 233379) Katherine D. Prescott (CA Bar No. 215496) Michael J. Curley (CA Bar No. 230343) 500 Arguello St., Ste. 500 Redwood City, CA 94063 Telephone: (650) 839-5070 Facsimile: (650) 839-5071 Attorneys for Plaintiff SRI INTERNATIONAL, INC.

Dated: March 17, 2006 POTTER, ANDERSON & CORROON LLP By: /s/ David E. Moore Richard L. Horwitz (#2246) David E. Moore (#3983) Hercules Plaza 1313 North Market Street, 6th Floor P.O. Box 951 Wilmington, DE 19899 Telephone: (302) 984-6000 Facsimile: (302) 658-1192 Holmes J. Hawkins, III Natasha Horne Moffitt KING & SPALDING LLP 191 Peachtree Street N.E. Atlanta, GA 30303-1763 Telephone: (404) 572-4600 Facsimile: (404) 572-5145 Theresa Moehlman Jeffrey Blake 1185 Avenue of the Americas New York, NY 10036-4003 Telephone: (212) 556-2100 Facsimile: (212) 556-2222 Attorneys for Defendant INTERNET SECURITY SYSTEMS, INC. a Delaware corporation and INTERNET SECURITY SYSTEMS, INC. a Georgia corporation

9

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 12 of 14

Dated: March 17, 2006 MORRIS, JAMES, HITCHENS & WILLIAMS LLP By: /s/ Richard K. Herrmann Richard K. Herrmann (#405) Mary B. Matterer (#2696) 222 Delaware Avenue, 10th Floor P. O. Box 2306 Wilmington, DE 19899-2306 Telephone: (302) 888-6800 Facsimile: (302) 571-1750 Lloyd R. Day, Jr. (pro hac vice) Robert M. Galvin (pro hac vice) Paul S. Grewal (pro hac vice) Renee DuBord Brown (pro hac vice) DAY CASEBEER MADRID & BATCHELDER, LLP 20300 Stevens Creek Blvd., Suite 400 Cupertino, CA 95014 Telephone: (408) 873-0110 Facsimile: (408) 873-0220 Attorneys for Defendant SYMANTEC CORPORATION

10

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 13 of 14

CERTIFICATE OF SERVICE I hereby certify that on March 17, 2006, I electronically filed with the Clerk of Court the attached JOINT CLAIM CONSTRUCTION STATEMENT using CM/ECF which will send electronic notification of such filing(s) to the following Delaware counsel. In addition, the filing will also be sent via hand delivery: Richard L. Horwitz David E. Moore Potter Anderson & Corroon LLP Hercules Plaza 1313 North Market Street, 6th Floor P.O. Box 951 Wilmington, DE 19899 Telephone: 302-984-6000 Facsimile: 302-658-1192 Email: [email protected] Email: [email protected] Richard K. Herrmann Morris James Hitchens & Williams LLP 222 Delaware Avenue, 10th Floor P.O. Box 2306 Wilmington, DE 19899-2306 Telephone: 302-888-6800 Facsimile: 302-571-1750 Email: [email protected] Attorneys for Defendant/Counterclaim Plaintiffs Internet Security Systems, Inc., a Delaware corporation, and Internet Security Systems, Inc., a Georgia corporation

Attorneys for Defendant/Counterclaim Plaintiff Symantec Corporation

I also certify that on March 17, 2006, I mailed by United States Postal Service and by electronic mail, the above document(s) to the following non-registered participants: Holmes J. Hawkins, III Natasha H. Moffitt King & Spalding LLP 191 Peachtree Street N.E. Atlanta, GA 30303-1763 Telephone: 404-572-4600 Facsimile: 404-572-5145 Email: [email protected] Email: [email protected] Attorneys for Defendant/Counterclaim Plaintiffs Internet Security Systems, Inc., a Delaware corporation, and Internet Security Systems, Inc., a Georgia corporation

Case 1:04-cv-01199-SLR

Document 548-3

Filed 09/15/2008

Page 14 of 14

Theresa A. Moehlman Jeffrey Blake Bhavana Joneja King & Spalding LLP 1185 Avenue of the Americas New York, NY 10036 Telephone: 212-556-2100 Facsimile: 212-556-2222 Email: [email protected] Email: [email protected] Email: [email protected] Paul S. Grewal Robert M. Galvin, Esq. Lloyd R. Day, Jr. Day Casebeer Madrid & Batchelder, LLP 20300 Stevens Creek Boulevard, Suite 400 Cupertino, California 95014 Telephone: 408-873-0110 Facsimile: 408-873-0220 Email: [email protected]

Attorneys for Defendant/Counterclaim Plaintiffs Internet Security Systems, Inc., a Delaware Corporation, and Internet Security Systems, Inc., a Georgia Corporation

Attorneys for Defendant/Counterclaim Plaintiff Symantec Corporation

/s/

John F. Horvath John F. Horvath

50334964.doc