Free Letter - District Court of Delaware - Delaware

Case 1:04-cv-01199-SLR

)LVK

5LFKDUGVRQ SF

Document 503

Filed 04/30/2008

Page 1 of 2
6XLWH 1 0DUNHW 6WUHHW SR %R[ :LOPLQJWRQ 'HODZDUH 7HOHSKRQH )DFVLPLOH :HE 6LWH ZZZIUFRP

! % $ %! ¤9¤ 8"¤ ¤§¤5¢© ¨310 )( 7 6 ¥¡4 2

FB"9CTRS @ C @

¢#Ip8gfi#qVpA F U AI DI

¤ ¤#"¤ '& % $!! ¢© ¤¦§¦¤¢ ¨ ¨¡£ ¥£¡

BY ELECTRONIC FILING April 30, 2008 The Honorable Sue L. Robinson United States District Court 844 King Street Wilmington, DE 19801 Re:

a
§A3DB"BAB@ @ @ C D Q A Q RBHFGBP DI A E 8BHFGB@

SRI International Inc. v. Internet Security Systems, Inc., et al. USDC-D. Del. - C. A. No. 04-1199 (SLR)

Dear Judge Robinson: As indicated at the hearing yesterday, the timing of Internet Security Systems' (ISS's) April 29 letter and the absence of any effort to meet and confer prior to its submission to the Court, precluded SRI from responding in writing prior to the hearing. To complete the record, therefore, SRI provides this brief response. ISS argues that the JiNao reference anticipates all the limitations of every asserted claim of the `338 patent and suggests that the parties dispute just one claim element with respect to JiNao. However, the record ­ including the expert report submitted by Dr. Kesidis ­ evidences multiple limitations that are not disclosed by JiNao, including limitations set forth in claims 1-8, 10, and 13-15. With regard to the limitation addressed by ISS's letter ­ whether JiNao receives and operates upon "network packets" ­ the text of JiNao as well as Dr. Kesidis' expert report evidence that the JiNao system is based upon the analysis of audit logs (specifically, reports generated by routers), not the direct analysis of "network packets" set forth in the inventions of the `338 patent. In this respect, JiNao is like the prior art IDES and NIDES systems developed by SRI ­ systems on which JiNao was based (see, e.g., D.I. 301, Ex. J (JiNao) at 18), systems which also performed statistical analysis of audit logs, and systems which were considered by the PTO when it granted the `338 patent. The distinction between analyzing network packet data instead of assessing audit logs for hosts (e.g., computers and routers), far from being a "conclusory argument" tossed out by counsel during litigation, is a fundamental difference in how the systems operate. Indeed, the distinction between analyzing audit logs versus "network packets" is expressly recognized and discussed in multiple other references, including the EMERALD 1997 paper and Mr. Heberlein's own 1991 article. See, e.g., D.I. 301, Ex. E (EMERALD 1997), at 354, 355, 356 and 359; and D.I. 301, Ex. F (Intrusive Activity 1991), at 363. Thus, it is ISS that has only argument equating "audit logs" with "network packets".

U X @ @ C TBWVB"¢U3S §9T¢iGQg8I9#"F ` U C C @ h D f CI fGYuvRQBgY8tHFTrV S D A e DI s @ b X Q ` TR¢aV§YD U Q e U S D @ R§#I3dBcF

Case 1:04-cv-01199-SLR

)LVK

5 L F K D U G V R Q SF

Document 503

Filed 04/30/2008

Page 2 of 2

The Honorable Sue L. Robinson April 30, 2008 Page 2

Because the prior art prevents ISS from bridging the gap between audit logs and " network packets," ISS uses selected excerpts from Dr. Kesidis' deposition and argues that he " conceded" that JiNao analyzes network packets. A review of Dr. Kesidis' entire testimony ­ including his expert report and sworn statements regarding these issues ­ evidences his forthright discussion that, while JiNao in some general sense " reacts" to data packets, it in no way actually receives and analyzes network packets as required by the claims of the `338 patent. See generally D.I. 339, at 25-29; and D.I. 348, at ¶ 28. Routers, of course, do receive data packets. The routers then may or may not reflect in some manner a portion of that data, along with other data, in the form of an audit log. In this sense, an audit log can represent the impact of some data packets received by the router. As noted above, however, the use of such audit logs is a fundamentally different approach than the direct receipt and analysis of the extremely voluminous raw data network packets. Thus, at a minimum, the differences in the audit log and the network packet approaches ­ as recognized by inter alia the prior art, Dr. Kesidis, and Mr. Heberlein ­ establish a genuine issue of material fact with regard to whether JiNao' s use of audit logs would have been understood by one of ordinary skill in the art as of November 1998 to have disclosed all the limitations of the asserted claims of the `338 patent, including the elements requiring the use of " network packets." Respectfully, /s/ Thomas L. Halkowski Thomas L. Halkowski TLH/dob cc: Richard L. Horwitz, Esq. Richard K. Herrmann Esq.