Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 1 of 41
SRI v. ISS and Symantec Exhibit 7 to the Proposed PreTrial Order SRI'S List of Exhibits L.R. 16.4(d)(6)
Final Ex. No.
BATES RANGE
DOCUMENT DESCRIPTION
Symantec's Objections Basis for Admission: Response to Symantec's Objections
ISS's objections
Basis for Admission: Response to ISS's Objections
Prev. PTX No.
PTX-
1
U.S. Patent No. 6,321,338 (Porras et al. )
1
PTX-
2
n/a
U.S. Patent No. 6,484,203 (Porras et al. )
2
PTX-
3
n/a
U.S. Patent No. 6,708,212 (Porras et al .)
3
PTX-
4
n/a
U.S. Patent No. 6,711,615 (Porras et al .)
4
PTX-
5
n/a
File History for U.S. Patent 6,321,338, Serial No. 09/188,793
106 Document complete.
Document inadequately identified.
Document adequately identified.
5
PTX-
6
n/a
File History for U.S. Patent 6,484,203, Serial No. 09/658,137 File History for U.S. Patent 6,708,212, Serial No. 10/429,607 File History for U.S. Patent 6,711,615, Serial No. 10/254,457
106 Document complete.
Document inadequately identified. Document inadequately identified. Document inadequately identified.
Document adequately identified. Document adequately identified. Document adequately identified.
6
PTX-
7
n/a
106 Document complete.
7
PTX-
8
n/a
106 Document complete.
8
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 2 of 41
PTX-
9
Contents of the website at http://www.faqs.org/rfcs/
NT
Produced during Not timely: produced after Produced during 699 the close of discovery. summary judgment summary judgment briefing; publicly available briefing; publicly available Produced during Not timely: produced after Produced during 700 summary judgment the close of discovery. summary judgment briefing; publicly available briefing; publicly available Produced during Not timely: produced after Produced during 703 summary judgment the close of discovery. summary judgment briefing; publicly available; briefing; publicly available identification adequate
PTX-
10
Contents of the website at http://www.rfceditor.org/overview.html
NT
PTX-
11
http://www.isoc.org/isoc.org/isoc/conferences/ndss/9 NT; DI 8cfp.shtml; http://www.isoc.org/isoc/conferences/ndss/98/cfp.sht ml
PTX-
12
ISS-02892 02904
"EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances" by Phillip Porras and Peter G. Neumann An e-mail dated April 15, 2005 DM, 106 Document complete; description accurate 802, 901(a), 402 401; 402; 801; 803; 807; 901; PTO para. 24
705
PTX-
13
SYM_P_02806340280644
706
PTXPTXPTXPTX-
14 15 16 17
SRI_287656 SRI_287659 SRI_E_0018138 SRIE_0052257 SRIE_0052258 SYM_P_0507977SYM_P_0507996
SRI Invention Disclosure Form for Emerald
105, 802
105, 802 Email regarding the acceptance of the Live Traffic paper for publication A string of emails between Gary Jackson and Phillip 105, 802 Porras Re Live Traffic Analysis 105, 802 HTML version of the publication by Phillip Porras and Alfonso Valdes, Live Traffic Analysis of TCP/IP Gateways. www.web.arcive.org/eb/19980124000949/www.csl.s ri.com/emerald/live-traffic.html
401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24
105, 802 105, 802 105, 802 105, 802
401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24
733 712 732 713
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 3 of 41
PTX-
18
http://web.archive.org/web/19970713122019/ww NT w.isoc.org/conferences/ndss98/
Produced during Not timely: produced after Produced during 702 the close of discovery. summary judgment summary judgment briefing; publicly available briefing; publicly available
PTX-
19
PTX-
20
SUN 0000501-SUN 0000506; SUN 0000600-SUN 0000608
Excerpts from SunScreen EFS, Configuration and Management Guide An abstract of the publication by Phillip Porras and NT Alfonso Valdes, Live Traffic Analysis of TCP/IP Gateways, located at web.archive.org/web/19980124003236/http:/www.cs l.sri.com/ememerald/traffic-short.html Letter to Macchia re SRI_Network Security Patents Folder entitled Symantec re Letter to Schallop re SRI_Network Security Patents Letter to Schallup from Abramson re Symantec's infringement of SRI_patents Letter to Michael Schallup from Abramson re network-based intrusion Fedex packing slip to Schallup from SRI Letter to Petty from Abramson re prior art to SRI_Patents 105, 802 105, 802 105, 802 105, 802 105, 802 DI
802
803; 807
710
901(a), 802; 402, 403. Not Produced during Produced during 711 timely: produced after the summary judgment summary judgment briefing; publicly available; briefing; publicly available close of discovery. 401; 402; 803; 807; 901 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para.24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 Identification adequate 105, 802, 402, 403 105, 802 105, 802 105, 802 105, 802 105, 802, 402, 403, 408, document inadequately identified 105, 802, 402, 403 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24; identification adequate 401; 402; 803; 807; PTO para. 24
PTXPTXPTXPTXPTXPTX-
21 22 23 24 25 26
SRI_17515 17516 SRI_18069 18071 SRI_18075 SRI_18076 -18078 SRI_18080 SRI_2184144 2184147 SRI_9430 9431
622 620 619 617 618 627
PTX-
27
Letter to Richard `Macchia re SRI_Network Security 105, 802 Patents
401; 402; 803; 807; PTO para. 24
621
PTXPTX-
28 29
Agabian: 449 SYM_P_00943640094390 SYM_P_01633030163305 SYM_P_02818340281836 SYM_P_02856480285684
White Paper: Enterprise Security, Symantec, Security Information Management Symantec Security Management System, Integrating 402, 403 Product Data, Requirements, Draft 1.3 Symantec Correlation Capabilities Rev 3 Email thread btwn Schwarz and Smith re Security Information Manager 4.0 installed and performing well Symantec, Draft, SIMA 4.0, Minardi, F24H, Walkthrough 106, 402, 403
401; 402 401; 402
402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24
389 380
PTXPTX-
30 31
378 390
PTX-
32
901(a)
901; PTO para. 24
392
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 4 of 41
PTXPTXPTXPTXPTXPTXPTXPTX-
33 34 35 36 37 38 39 40
SYM_P_02860990286152 SYM_P_02866630286704 SYM_P_02885510288587 SYM_P_03649580364997 SYM_P_03689780369898 SYM_P_03703430370644 SYM_P_03726170372666 SYM_P_03755350375571 PNC 001-PNC 039 PNC 040-PNC 071 PNC 72-102 Bagley: 200 Bagley: 201
901(a) Global Technical Training, Symantec Security Information Manager Overview, Costco Symantec Response for JPMorgan Chase Security Information and Even Management RFI Symantec Security Information Manager 4.0; Product Functional Requirements Draft Symantec Security Management Strategy Transformation FAQ Symantec Incident Manager, SSMS Solution General 402, 403 RFI Symantec Security Information, Manager 4.0, Support Team Training, Student Guide Unit 5, Symantec Incident Manager Managing incidents with Symantec Security Information Manager 4.0, Support Team Minardi Training Course Statement of work between PNC and Symantec Symantec Sales Quote 106, 403 901(a) 901(a)
901; PTO para. 24
401; 402
106 Document complete 401; 402 901; PTO para. 24 901; PTO para. 24 901; PTO para. 24
402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403. Description mischaracterizes document. 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901; Description accurate
385 393 384 382 379 388 381 387
PTXPTXPTXPTXPTX-
41 42 43 44 45
468 469 470 184 185
White Paper provided by Symantec explaining real 901(a) time security monitoring Data Sheet: Security Technology Symantec Network Security 7100 Series Data Sheet: ISS Symantec Gateway Security 5600 Series
PTXPTXPTXPTXPTXPTXPTX-
46 47 48 49 50 51 52
SYM_P_00305440030552 SYM_P_00319010031933 SYM_P_00944470094457 SYM_P_00967180096749 SYM_P_00976940097711 SYM_P_0195825-47 SYM_P_02004300200442
How ManHunt Detects Threats How ManHunt Detects Threats
802, 901(a) 901(a)
801; 803; 807; 901; PTO para. 24 901; PTO para. 24
Global Marketing Communications Plan FINAL Symantec ManHunt 3.0 Symantec ManHunt Product Launch Kit, Enterprise 402, 403 Edition Symantec ManHunt Product Launch Guide, Enterprise Edition Symantec Proposal to XXXX for Intrusion Protection SNS 7100 Deployment/ Evaluation Strategies
401; 402
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24
175 161 180 176 177 168 166
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 5 of 41
PTX-
53
PTXPTXPTXPTXPTXPTXPTXPTXPTX-
54 55 56 57 58 59 60 61 62
PTXPTXPTXPTXPTXPTXPTXPTXPTXPTXPTXPTX-
63 64 65 66 67 68 69 70 71 72 73 74
SYM_P_0237443-458 White Paper: Enterprise Solutions Effective Intrusion Prevention: Protecting Networks Against the Threats of Today and Tomorrow SYM_P_03055325Technical FAQ; Symantec Network Security 7100 030532 Series Appliances FAQs Email thread from Bagley to Wheeler re SNS SYM_P01049320104936_ Correlation technote DRAFT1 Symantec Network Security User Guide SYM_P_00150290015162 ManHunt Data Processing- Jeremy Bennett SYM_P_00192040019214 Symantec SNS 4.0 Sensor Architecture SYM_P_00367390036749 Paper: Symantec ManHunt detection SYM_P_00368890036893 Recourse Technologies ManHunt; Reducing the Risk SYM_P_00371070037119 of Compromise Symantec Network Detection Components SYM_P_00373500037365 SYM_P_0037480Symanted Blackbird 4.0 (Ursa Major Detection 0037501 Engine) Product Functional Requirement" Revision 0.97 SYM_P_0037697Symantec "ManHunt's Layered Detection" Jeremy 0037727 Bennett Symantec Corporation ManHunt Intrusion Detection SYM_P_00485720048593 System Symantec ManHunt System Training Robert Geiger SYM_P_00487660048815 Symantec "Ballymeade/Captiva PFR" SYM_P_00494280049461 Symantec Usra Major (ManHunt 4.0) Product SYM_P_00495310049559 Functional Requirements Revision 1.3 Recourse Technologies ManHunt Training SYM_P_00497580049781 Introduction Module, Version 2.11 Symantec Corp ManHunt Intrusion Detection System SYM_P_00506830050707 Ursa Major (ManHunt 4.0) High Level Design SYM_P_01628710162882 Document by Mark Janazura "Manhunt Setup, Application and Maintenance" SYM_P_02911510291586 Symantec "NGS Quarterly Business Review SNS and SYM_P_03304180330443 SGS Product Lines" Symantec ManHunt 3.0 Technical Evaluation and SYM_P_05314540531503 NSS Group Report Aberdeen Group Financial White paper SYM_P_025584025598
402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901 401; 402; 803; 807; 901
183
163 164 43 35 30 32 20 24 28
901(a) 802, 402, 403
901; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 106 Document complete 106 Document complete
29 22 27 40 26 31 25 36 44 41 34 241
802, 402, 403, 901(a)
401; 402; 801; 803; 807; 901; PTO para. 24
802, 402, 901(a) 403 901(a), 802, 402, 403
401; 402; 803; 807; 901 401; 402; 803; 807; 901
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 6 of 41
PTXPTXPTXPTXPTX-
75 76 77 78 79
SYM_P_550390550465 ISS_0055186200551863 SRIE_0005021 SRIE_0082984 SYM_P_00463220046364 SYM_P_00490690049071 SYM_P_00506520050659 SYM_P_00516420051647
Symantec 2003 annual report Anomaly Detection Demo email Email thread Valdes to Porras re EMERALD Email Moral to Porras 105, 402, 403, 802 802, 901(a), 402, 403 802, 901(a), 402, 403 401; 402; 801; 803; 807; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24
402, 901(a), 802, 403, 105 402 402, 901(a), 802, 403 402, 901(a), 802, 403 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24
242 297 55 57 59
PTXPTXPTX-
80 81 82
Symantec Network Security 7100 Series, Project Galileo, Commit to Solution Presentation, EMEA 415-04 ManHunt Enterprise, Architecture & Requirements 802, 402, 403, 901(a) [Draft] White Paper: Why is Symantec's Approach to IPS best? Email thread, Kumar to Bennett, Smith, et al re ManHunt
401; 402; 801; 803; 807; 901; PTO para. 24
52 67 61
PTXPTXPTXPTXPTXPTX-
83 84 85 86 87 88
SYM_P_00918870091889 SYM_P_01312140131222 SYM_P_033549703355537 SYM_P_04087520408780 Geyer: 272 SYM_P_05425540542563 Griswold: 343 (ISS_02125736-742)
Suzuki email to [email protected] Third Party Event Reception for ManHunt, Mike Lyle, Bob Geiger Symantec ManHunt v2.11, Technical Evaluation, An NSS Group Report Symantec, Brighton, Acquisition of High Speed Intrusion Detection Notes from site visit to Symantec MSS site Email string from Andy Sell to Angela Halliwell and Tony McDonald re favor Source code for attack for compromised host rule
402, 403 802, 402, 403, 901(a) 802, 901(a), 403, 402 901(a)
401; 402 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901 901; PTO para. 24
402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 901(a), 802; 402, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 Description mischaracterizes document. Document inadequately identified. Description mischaracterizes document. Document inadequately identified.
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 Identification adequate. Description accurate.
63 66 70 76 249 248
PTX-
89
105, 402, 403, 802
401; 402; 801; 803; 807; PTO para. 24
317
PTX-
90
Griswold: 344 (ISS_02125743-860)
Compilation of source code documents
105, 402, 403, 802
401; 402; 801; 803; 807; PTO para. 24
Identification adequate. Description accurate.
318
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 7 of 41
PTX-
91
ISS_0006028700060300
Fusion Update August 9th, 2002
105, 402, 403, 802
401; 402; 801; 803; 807; PTO Para. 24
312
PTX-
92
ISS_0052559600525600
Project Status Report
105, 402, 403, 802
401; 402; 801; 803; 807; PTO Para. 24
402
401; 402
310
PTX-
93
ISS_00535783-821
Security Fusion Module 2.0 Tech Support Chalk Talk 105, 402, 403, 802
401; 402; 801; 803; 807; PTO para. 24
313
PTXPTXPTX-
94 95 96
ISS_0054161000541631 ISS_0054183400541847 ISS_00687640068778
Development Stories RealSecure Fusion Sensor 2.0 Market Requirements Document RealSecure Fusion Sensor 2.0 Attack from a Compromised Host Definitions
105, 402, 403, 802 105, 402, 403, 802 105, 402, 403, 802
401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24
402 802, 402 402. Description mischaracterizes document.Illegible, at least part. 402; 802. Description mischaracterizes document. Cumulative, 802. Description mischaracterizes document. 106
401; 402 401; 402; 801; 803; 807; PTO para.24 401; 402; Description accurate; sufficiently legible
311 309 307
PTX-
97
ISS2_01445521001445522
Email string btwn Griswold, Ward, and Craig re quick questions about Fusion 2.0 for Ford meeting
105, 402, 403, 802
401; 402; 801; 803; 807; PTO para. 24
401; 402; 801; 803; 807; 315 PTO para. 24; description accurate 401; 402; 801; 803; 807 Description accurate 428 440
PTXPTX-
98 99
Hall: 500 Hall: 512
Proventia Enterprise Security Platform (ESP) RealSecure® Network Gigabit datasheet page from iss.net ISS SiteProtector 2.0 Comparison Guide for RealSecure Workgroup Manager (http://documents.iss.net/literature/SiteProtector/WG MTORSSPComparison.pdf) Symantec; The Complete ManHunt Symantec ManHunt Release History
802, 403, 402, 901(a), 105
401; 402; 801; 803; 807; 901; PTO para. 24
PTX-
100
Hall: 513
Document complete.
441
PTXPTX-
101 102
SYM_P_00495960049645 SYM_P_00505390050549
402, 403 901(a)
401; 402 901; PTO Para. 24
402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24
198 200
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 8 of 41
PTXPTXPTXPTX-
103 104 105 106
SYM_P_01629880163028 SYM_P_01630860163100 Innes: 434 Innes: 435
Symantec; ManHunt Tech Exchange Symantec; ManHunt Architecture Product Lifecycle Announcement Proventia Network Anomaly Detection System data sheet
402, 403 402, 403 105, 402, 403, 802 105, 402, 403, 802
401; 402 401; 402 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24
402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 Description mischaracterizes document. Description mischaracterizes document. 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 Description accurate
196 197 366 367
PTX-
107
Proventia Prudential Network Anomaly Detection ISS 2_0034987200349873; Innes: 436 System User Guide Version 3.5 SYM_P_0176251SYM_P_0176253 SYM_P_0047130047173 SYM_P_00601210060152 SYM_P_00603360060396 SYM_P_01175280117548 SYM_P_00215990021663 SYM_P_00662900066304 SYM_P_01108380110841 SYM_P_01476110147648 SYM_P_01577500157765 SYM_P_01906150190649 SYM_P_02109100210912 Q & A re Manhunt's intrusion detection technology Symantec; Ursa Major; Requirements Checkpoint Presentation Symantec; ManHunt 3.0/ Orion; Product Functional Requirements Symantec; Orion Symantec ManHunt 3.0, Requirement Checkpoint/ Commit to Solution Symantec; Symantec ManHunt 3.0 Ballymeade Project Commit to Solution Checkpoint Symantec Gateway Security 5400 Series, Version 1.0a Product Frequently Asked Questions Symantec Gateway Security 1600 Series, Mini-Me Project Everything you wanted to know about IDS/IPS but were afraid to ask Asbestos (Blackbird) Product Functional Requirements Reviewer's Guide Symantec Gateway Security Appliance 5400 Series IDS Guidance for Sugarbush
105, 402, 403, 802
Description accurate
368
PTXPTXPTXPTXPTXPTXPTXPTXPTXPTXPTXPTX-
108 109 110 111 112 113 114 115 116 117 118 119
901(a), 106, 402, 403, 802
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24
676 138 132 133 136 148 152 160 159 150 153 156
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 9 of 41
PTX-
120
SYM_P_03836130383763
Symantec Enterprise Firewall, Symantec Enterprise Firewall with BPN, Symantec Gateway Security Symantec Client VPN Functional Specification, Code Name: Ballymeade/Captive
802, 901(a), 402, 403, 105
401; 402; 801; 803; 807; 901; PTO para. 24
149
PTXPTXPTXPTX-
121 122 123 124
Sugarbush Product Functional Requirements SYM_P_044284700442954 SRI_163635 163674 Emerald Net IDS Appliance User's Guide Ver. 2.0 105, 802 and related EMERALD Network Appliance 105, 802 SRI_88192 88203 Presentation re Emerald Business Strategy Framework SYM_P_0032023Symantec, ManHunt Appliance 1.0, Galileo, High 0032031 Level Design Document (HLDD) SYM_P_00320540032058 SYM_P_00349640034981 SRIE_2225 ISS48496-48511 McEwin: 122 Symantec, ManHunt Appliance 1.0, Galileo, In-Line, Monitoring High Level Specifications Galileo, Performance Test Plan
401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; PTO para. 24 105, 802 401; 402; 803; 807; PTO para. 24 901(a),802, 402, 403, 105 401; 402; 801; 803; 807; 901; PTO para. 24 901(a),802, 402, 403, 105 401; 402; 801; 803; 807; 901; PTO para. 24 901(a),802, 402, 403, 105 401; 402; 801; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403, 105 105, 802
155 516 522 78
PTXPTX-
125 126
79 85
PTXPTXPTX-
127 128 129
Email from Winarsky to Mark et al re Nokia ISS Product Line Architecture: A Glossary Proventia A Series
105, 802 105, 402, 403, 802 105, 402, 403, 802
401; 402; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24
105, 802 402
401; 402; 803; 807; PTO para. 24 401; 402
610 123 125
PTXPTX-
130 131
McEwin: 123 GAP 00019-GAP 00048 GAP 00108-GAP 00179 SRI_44834 SRI_75871 75873 ISS_0212572002125735
Proventia G line products Data Sheet Symantec Master Services Agreement
105, 402, 403, 802
126 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 Description accurate 265
PTX-
132
Symantec Enterprise Security Solutions Proposal for GAP Inc. Email from Neumann to Lunt re Intrusion detection, 105, 802 survivability 105, 802 Email from Neumann re software Engineer Module from the Network Sensor RS_PAM_NetworkSensor/Dev/RealSecure/Sensordll/issPAMSensorLib/issPamSensor.h 105, 402, 403, 802 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24
269
PTXPTXPTX-
133 134 135
105, 802 105, 802 Description mischaracterizes document.
602 607 375
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 10 of 41
PTXPTXPTX-
136 137 138
ISS_17243-18096 ISS_201256902125728 SYM_P_0517609SYM_P_0517610 ARB00660-00692
RealSecure Signatures Reference Guide, Version 6.5 105, 402, 403, 802 105, 402, 403, 802 Source Code for the bridge module RS_PAM_NetworkSensors/dev/RealSecure/Sensor_d ll/issPamSensorLib/issPamSensor.cpp 402, 403 Email, Horvath to Little and Castles, 09/20/02
401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402
377 Description mischaracterizes document. 402, 901(a), 802, 403, 105 402, 802, 403 802 402, 802, 403; 901(a) 802, 901(a), 402, 403 Description accurate 401; 402; 801; 803; 807; 901; PTO para. 24 401;402; 801; 803; 807 801; 803; 807 401; 402; 801; 803; 807; 901 401; 402; 803; 807; 901 376 276
PTX-
139
Amendment No. 1 to License and Distribution Agreement btwn Arbor Networks, Inc. and ISS- GA Proventia Network Anomaly Detection System Quick Start Guide Version 3.5 Arbor Networks Press Release: News & Events from their website
105, 402, 403, 802, 901(a) 105, 402, 403, 802, 901(a) 105, 402, 403, 802, 901(a)
401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 803; 807; 901
657
PTXPTXPTX-
140 141 142
ARB00693-00740 Morville: 537 Morville: 538
662 658 659
PTXPTX-
143 144
105, 402, 403, 802, Arbor Networks' Peakflow solutions ensure the security and operational integrity of the world's most 901(a) critical networks; from website~Corporate Profile page 105, 402, 403, 802, Morville: 548 U.S. Patent Application Pub. No. 2005/0005017 901(a) 105, 802 SRI_105503 - 105524 Summary of Advanced Network Security and Information Warfare Research in CSL/SRI_by Porras SYM_P_05355485 EMERALD: Event Monitoring Enabling Responses 535497 to Anomalus Live Disturbances by Porras And Neumann DI
401; 402; 803; 807; 901; 902 401; 402; 803; 807; PTO para. 24 Identification adequate
402, 403, 802 105, 802 Document inadequately identified.
401; 402; 803; 807 401; 402; 803; 807; PTO para. 24 Identification adequate.
667 596
PTX-
145
540
PTXPTX-
146 147
Pruss: 231 ISS04439-0440
ISS Advanced SiteProtector RealSecure Server Sensor marketing brochure
105, 402, 403, 802 105, 402, 403, 802
401; 402; 801; 803; 807 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24
PTX-
148
ISS_05991-059989
RealSecure SiteProtector Security Fusion Module 2.0 105; 402; 403; 802; multiple documents Frequently Asked Questions
PTXPTX-
149 150
ISS16455-16466 ISS2_00105902-04
RealSecure Server Sensor FAQ The Protocol Analysis Module
105, 402, 403, 802 105, 402, 403, 802
401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24
Description mischaracterizes document. 402,cumulative. Description mischaracterizes document. Document inadequately identified. 106
Description accurate 401; 402; description accurate; identification adequate
213 115
372
118 Document complete 117
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 11 of 41
PTXPTXPTX-
151 152 153
ISS2_00653565+C178 Meet with Dell email HEALTHSOUTH 028 Security Network design diagram SYM_P_05489940549907 Network Surveillance by Porras et al
105, 402, 403, 802 105, 402, 403, 802, 901(a) 105, 802
401; 402; 801; 803; 807; PTO para. 24 401; 402; 803; 807; 901 401; 402; 803; 807; PTO para. 24
402, 802 802, 901(a), 402, 403 105, 802
401; 402; 801; 803; 807; PTO para. 24 401; 402; 803; 807; 901 401; 402; 803; 807; PTO para. 24
109 443 656
PTX-
154
M00001-00050
Managed Security Services Agreement
901(a)
901
802, 901(a), 402, 403, 105
401; 402; 801; 803; 807; 901
462
PTX-
155
M00070-00083
Symantec Invoice
901(a)
901
802, 901(a), 402, 403, 105
401; 402; 801; 803; 807; 901
463
PTXPTX-
156 157
M00225-00260 ISS05920-21
Symantec MSS Implementation: Implementation Method of Procedure SiteProtector Security Fusion Module from web datasheet
901(a) 105, 402, 403, 802
901 401; 402; 801; 803; 807; PTO para. 24
802, 901(a), 402, 403, 105 Description mischaracterizes document.
401; 402; 801; 803; 807; 901 Description accurate.
467 92
PTXPTXPTXPTXPTXPTX-
158 159 160 161 162 163
ISS2_01396595-615 ISS68417-68431 ISS68461-68476 ISS68487-68505 ISS68535-68551 ISS68738-69746
RealSecure SiteProtector Security Fusion Module presentation; Holly Turner Third-Party Module 2003 Project Plans
105, 402, 403, 802 105, 402, 403, 802
105, 402, 403, 802 RealSecure SiteProtector Security Fusion Module Presentation- Hollly Turner 105, 402, 403, 802 RealSecure SiteProtector Security Fusion Module presentation; Holly Turner ISS: "Fusion Less is More" Holly Turner and Carolyn 105, 402, 403, 802 Reuss 105, 402, 403, 802 Security Fusion Module Upcoming Releases and Competitive Info Presentation- Holly Turner Symantec IDS & IPS capability in SNS 7100 Series vs. SGS 5400 Series Symantec Gateway Security 5400 Technical Briefing Tasha Van Es 402, 403 Introduction to Symantec Incident Manager
401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24
93 402, 802 401; 402; 801; 803; 807; PTO para.24 103 100 94 401; 402; 801; 803; 807; 96 PTO para. 24 802, 402, 403. Description 401; 402; 801; 803; 807; 99 mischaracterizes PTO para. 24; Description accurate document. 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 47 229 230 802, 402, 403
PTXPTXPTX-
164 165 166
SYM_P_00479890047991 SYM_P_00200600020142 Van Es: 248
401; 402
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 12 of 41
PTXPTX-
167 168
Van Es: 254 SRI_014443SRI_014453
Symantec Security Information Manager 9500 Series 402, 403 "Computer Security research and Development at SRI_International" article 105, 802
401; 402 401; 402; 803; 807; PTO para. 24
402, 901(a), 802, 403, 105 105, 802
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; PTO para. 24
233 648
PTX-
169
SRI_051898- 51903
"Knowledge-Based Intrusion Detection" article
105, 802
401; 402; 803; 807; PTO para. 24
105, 802
401; 402; 803; 807; PTO para. 24
646
PTX-
170
SRI_142069SRI_142154
"Detecting Unusual Program Behavior Using the Statistical Component of the Next-generation Intrusion Detection expert System (NIDES)" "IDES: An Intelligent System for Detecting Intruders" article
105, 802
401; 402; 803; 807; PTO para. 24
105, 802
401; 402; 803; 807; PTO para. 24
650
PTX-
171
TL 0010-0021
105, 802
401; 402; 803; 807
105, 802
401; 402; 803; 807
647
PTX-
172
SRI_047974-47984
SRI_IDES Statistical Anomaly Detector by Javitz, Valdes and Tamaru
105, 802
401; 402; 803; 807; PTO para. 24
105, 802
401; 402; 803; 807; PTO para. 24
541
PTX-
173
SRI_13361-13404
Darpa Order D985-Award/Contract
105, 802
401; 402; 803; 807; PTO para. 24
105, 802
401; 402; 803; 807; PTO para. 24
545
PTXPTX-
174 175
SRI_48679-48694 SRIE_18565
Emerald- Statistical-Analyzer TCP Monitor Documentation Valdes email to Porras re Stats work
105, 802 105, 802
401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24
105, 802 105, 802
401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24
569 554
PTX-
176
SRIE_274329-274414 MIT Lincoln Laboratory Offline Component of the 1999 DARPA Intrusion Detection Evaluation
105, 802
401; 402; 803; 807
581
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 13 of 41
PTX-
177
SRIE_399156-399159 Lunt email to Valdes and others re Tentative Agenda 105, 802 for DARPA-Intrusion Detection Conference
401; 402; 803; 807; PTO para. 24
105, 802
401; 402; 803; 807; PTO para. 24
566
PTXPTX-
178 179
SRIE_449229-449232 Neumann email to Porras Valdes, Gilham, Frivold, Japan re Notes on New NIDES; SRI_Proprietary SRIE_53628 Valdes email to Porras and Neumann re Frank Jou meeting SYM_P_554967 Article titled, History re SRI
105, 802 105, 802
401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24
105, 802 105, 802
401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24; description accurate; sufficiently legible 401; 402; 801; 803; 807; 901; PTO para. 24; Description accurate; sufficiently legible 401; 402; 801; 803; 807; PTO para. 24
546 561
PTX-
180
105, 802
105, 802
568
PTX-
181
SYM_P_68937-68942 Statistical Methods for Computer Usage Anomaly Detection Using NIDES SYM_P_79206-79370 SRI_International- Final Technical Report SYM_P_01598180159845 Bennett: 41 ISS_01744269 American Express- Resource Technologies 802, 402, 403 401; 402; 801; 803; 807; PTO para. 24
105, 802
571
PTXPTX-
182 183
105, 802 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 802, 901(a), 402, 403. Illegible, at least in part. Description mischaracterizes document. 802, 901(a), 402, 403. Illegible, at least in part. Description mischaracterizes document. 802, 402, 403
575 251
PTXPTX-
184 185
List of resellers and end users of Symantec (Appendix I to Interrogatory Responses) ISS Financial data
42 922
Partially illeg. 106, 402, 403, 802, 901(a)
401; 402; 801; 803; 807; PTO para. 24; document complete; sufficiently legible 401; 402; 801; 803; 807; PTO para. 24; document complete 401; 402; 801; 803; 807; 901; PTO para. 24
PTX-
186
ISS_01832561
ISS Financial data
Partially illeg. 106, 402, 403, 802, 901(a)
923
PTX-
187
ISS_11292-299
Proventia Security Product Family brochure
901(a), 802, 402, 403
812
PTX-
188
ISS_20657-ISS_20662 ISS WGM to SP comparison guide- Figures and Appendix
105, 402, 403, 802
401; 402; 801; 803; 807; PTO para. 24
802, 402, 403
401; 402; 801; 803; 807; PTO para. 24
847
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 14 of 41
PTX-
189
ISS_21064-66
Proventia Intrusion Prevention Appliance brochure
901(a), 802, 402, 403
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24; description accurate
802, 402, 403
401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24; identification adequate; document complete 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24
811
PTX-
190
ISS_353052- 353405
ISS RealSecure 5.5 Student Guide
802, 901(a), 402, 403
802, 402, 403
816
PTX-
191
ISS_4387-4393
Proventia Enterprise Security Platform (ESP) brochure
DM, 106, 901(a), 802, 402, 403
802, 402, 403, 106. Document inadequately identified.
813
PTXPTX-
192 193
ISS_541632-541642 ISS_592180- 592291
ISS Market Requirements Document Security Fusion 802, 402, 403 Module 2.0 802, 901(a), 402, 403 License and Distrubution Agreement dated August 12, 2005 between Arbor Networks and ISS 105, 802 The EMERALD Project Current Downloads as of (9/4/97) from http://web.arcive.org/web/19980124000015/www.csl .sri.com/emerald/downloads.html
401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; PTO para. 24
802, 402, 403 802, 402, 403
808 814
PTX-
194
ISS02126097
825
PTXPTXPTX-
195 196 197
ISS04149-04157 ISS06011-06017 ISS23541-557
Heberlein, Dias, Levitt, Mukherjee, Wood, and Wolber, A Network Security Monitor "RealSecure Guard FAQ" Mukherjee, Heberlein, and Levitt, Network Intrusion Detection
890 402; 403; 802; 105 401; 402; 801; 803; 807; PTO para. 24 802, 402 401; 402; 801; 803; 807; PTO para. 24 1225 1236
PTX-
198
N/A
802, 403, 402, 901(a) Symantec Buys Spam Killer, gets Street Cred http://www.baselinemag.com/article.2/0,1540,19818 94,00.asp
401; 402; 803; 807; 901; 902
802,403, 402, 901(a), 105.Document inadequately identified.
401; 402; 803; 807; 901; 902; identification adequate
779
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 15 of 41
PTX-
199
SRI_000001-000052
"RealSecure Network Sensor and Gigabit Network Sensor Frequently Asked Questions"
Illegible, 105, 106, 402, Sufficiently legible; 401; 403, 802, 901(a) 402; complete; 801; 803; 807; 901; PTO para.24
802, 901(a), 402, 106.Illegible, at least in part.
401; 402; 801; 803; 807; 901; PTO para. 24; sufficiently legible
879
PTX-
200
SRI_00001-9
RealSecure Network Sensor and Gigabit Network Sensor FAQs
105, 402, 403, 802, 901(a)
401; 402; 801; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403
401; 402; 801; 803; 807; 901; PTO para. 24
850
PTX-
201
SRI_000020-33
ISS Enhanced Dynamic Threat Protection via Automated Correlation and Analysis
105,402, 403, 802, 901(a)
401; 402; 801; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403
401; 402; 801; 803; 807; 901; PTO para. 24
851
PTX-
202
SRI_000034-35
RealSecure 10/100 brochure
105, 402, 403, 802, 901(a)
401; 402; 801; 803; 807; 901; PTO para. 24
802, 901(a), 106. Illegible, 801; 803; 807; 901; PTO at least in part. para. 24; sufficiently legible; document complete 802, 901(a), 106. Illegible, 801; 803; 807; 901; PTO at least in part. para. 24; sufficiently legible; document complete 802, 901(a), 106.Illegible, 401; 402; 801; 803; 807; at least in part, 402, 403. 901; PTO para. 24; sufficiently legible; document complete 802, 901(a), 106, 403, 401; 402; 801; 803; 807; 402 901; PTO para. 24; document complete 105, 802. Document 401; 402; 803; 807; PTO inadequately identified. para. 24; identification adequate 802, 901(a), 402, 403 401; 402; 803; 807; 901; PTO para. 24 802, 901(a), 402, 403 401; 402; 803; 807; 901; PTO para. 24 106, 403, 802. 401; 402; 803; 807; PTO Description para. 24; description mischaracterizes accurate; document document. complete
852
PTX-
203
SRI_000035-36-37
RealSecure Network Gigabit brochure
105, 402, 403, 802, 901(a) 105, 402, 403, 802, 901(a)
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24
853
PTX-
204
SRI_000047-48
SiteProtector Third Party Module brochure
854
PTX-
205
SRI_000049-520
Site Protector Third Party Module Frequently Asked 105, 402, 403, 802, 901(a) Questions EMERALD Site-wide Correlation Engine
855
PTX-
206
SRI_05165688051693 SRI_110331-110357
105, 402, 403, 802, DM 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24; description accurate; document complete
1270
PTXPTXPTX-
207 208 209
Threat Analytics- A Cybershield Initiative version 2-0-802, 403, 402, 901(a) 12-04, 0, 4 Abstract of Live Traffic Analysis of TCP/IP Gateways 105, 802 SRI_112470 by Porras and Valdes DM, 802, 105, 106 SRI_277983 -277997 EMERALD eXpert/estat Draft 0.1
1305 819 742
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 16 of 41
PTX-
210
SRI_287660SRI_287662
USPTO Notice of Allowance and Fees Due re Application 10/429,611
106, 402, 403, 802,901(a)
401; 402; 803; 807; 901; document complete
402, 802, 901(a), 403, 106
401; 402; 803; 807; 901; document complete
829
PTX-
211
SRI_287663
USPTO Notice of Allowability re Application 10/429,611 USPTO Information Disclosure Statement by Applicant for Application 10/429,611
106, 402, 403, 802,901(a) 106, 402, 403, 802,901(a)
401; 402; 803; 807; 901; document complete 401; 402; 803; 807; 901; PTO para. 24; document complete 401; 402; 803; 807; 901; document complete
402, 802, 901(a), 403, 106 402, 802, 901(a), 403, 106
401; 402; 803; 807; 901; document complete 401; 402; 803; 807; 901; PTO para. 24; document complete 401; 402; 803; 807; 901; document complete
830
PTX-
212
SRI_287664SRI_287681
831
PTX-
213
SRI_287682SRI_287683
Issue Classification for Application 10/429,611
106, 402, 403, 802,901(a)
402, 802, 901(a), 403, 106
832
PTXPTX-
214 215
SRI_287684SRI_287690 SRI_287691SRI_287692
Confirmation No. 3015 and Amendments to the Claims re 10/429,611 Fold out poster/cd- SRI_Timeline of Innovations
106, 402, 403, 802,901(a) 106, 402, 403, 802, 901(a), partially illeg.
401; 402; 803; 807; 901; document complete 401; 402; 803; 807; 901; PTO para. 24; sufficiently legible; document complete 401; 402; 803; 807; 901(a); PTO para. 24
402, 802, 901(a), 403, 106 402, 802, 901(a), 403, 106. Illegible, at least in part. 802, 901(a), 402, 403
401; 402; 803; 807; 901; 833 document complete 401; 402; 803; 807; 901; 834 PTO para. 24; sufficiently legible; document complete 401; 402; 803; 807; 901; PTO para. 24 835
PTX-
216
SRI_287693SRI_287697
SRI_International 60 years 1946-2006 - Timeline 802, 403, 402, 901(a) of Innovations
PTXPTXPTXPTX-
217 218 219 220
SRI_287698SRI_287701 SRI_287706SRI_287709 SRI_287710SRI_287713 SRI_287714
SRI_International's Timeline of InnovationsInventing the Future for More Than 55 Years SRI_International's Timeline of InnovationsInventing the Future for the Past 55 Years SRI_International's Timeline of InnovationsInventing the Future for the Past 50 Years SRI- What They Are Saying About Us
802, 403, 402, 901(a) 802, 403, 402, 901(a) 802, 403, 402, 901(a) 802, 403, 402, 901(a)
401; 402; 803; 807; 901(a); PTO para. 24 401; 402; 803; 807; 901(a); PTO para. 24 401; 402; 803; 807; 901(a); PTO para. 24 401; 402; 803; 807; 901(a); PTO para. 24 401; 402; 803; 807; 901(a); PTO para. 24 401; 402; 803; 807; 901; PTO para. 24; legible
802, 901(a), 402, 403 802, 901(a), 402, 403 802, 901(a), 402, 403 802, 901(a), 402, 403
401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24
836 837 838 839
PTX-
221
SRI_287715SRI_287716 SRI_287717SRI_287746
SRI_International - Breakthrough Ideas- Real-World 802, 403, 901(a) Solutions World-Changing Innovations partially illeg, 802, 901(a), 402, 403, 106
802, 901(a), 402, 106, 403. Illegible, at least in part. 802, 901(a), 402, 403, 106. Illegible, at least in part.
401; 402; 803; 807; 901; 840 PTO para. 24; sufficiently legible 401; 402; 803; 807; 901; 841 PTO para. 24; sufficiently legible
PTX-
222
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 17 of 41
PTX-
223
SRI_287747SRI_287749 SRI_287750SRI_287765
San Jose Mercury News "For the Love of Research" 802, 901(a), 402, 403, 106 Discover What We're Discovering 802, 901(a), 402, 403
401; 402; 803; 807; 901; 902; document complete 401; 402; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403, 106 802, 901(a), 402, 403
401; 402; 803; 807; 901; 902; document complete 401; 402; 803; 807; 901; PTO para. 24
842
PTX-
224
843
PTX-
225
SRI_287766SRI_287769
Donna Linne letter to Nilsa Monina of DCMS-San Francisco dated October 29, 1998
802, 901(a), 402, 403
401; 402; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403. Not 401; 402; 803; 807; 901; timely: produced after the PTO para. 24; produced close of discovery. timely 802, 901(a), 402, 403 401; 402; 803; 807; 901; 902
844
PTX-
226
SRI_37174-37175
802, 402, 403, 901(a) Article titled "DARPA's EMERALD Proves Worth in Cyperdefens" from U.S. Department of Defense from http://www.defenselink.mil/news/aug2000/n0814200 0_20008144.html
401; 402; 803; 807; 901; 902
1293
PTX-
227
SRI_37176-37179
SRI_Timeline of SRI_International Innovations: 2000s SRI_Timeline of SRI_International Innovations 1980s
802, 402, 403, 901(a)
401; 402; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403
401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24
1294
PTX-
228
SRI_37192-37195
DM, 802, 403, 402, 901(a)
401; 402; 803; 807; 901; 802, 901(a), 402, 403 PTO para. 24; description accurate 401; 402; 803; 807; 901; PTO para. 24 802, 901(a), 402, 403
1295
PTX-
229
SRI_37196-37202
SRI_Timeline of SRI_International Innovations 1990s
802, 403, 402, 901(a)
401; 402; 803; 807; 901; PTO para. 24
1296
PTX-
230
SRI_72894-72897
Article titled "EMERALD's Component-Based Approach to Network Security Distrubuted RealTime Security Monitoring by Claude J. Bauer
901(a), 802, 403, 402
401; 402; 803; 807; 901; 902
802, 901(a), 402, 403
401; 402; 803; 807; 901; 902
1299
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 18 of 41
PTX-
231
SRI_E_0017849
Email exchange between Jerzy Rub and Porras re Live Traffic Analysis paper
802, 402, 403, 901(a)
401; 402; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403
401; 402; 803; 807; 901; PTO para. 24
714
PTX-
232
SRI_E_0017912
Email exchange between Shyhtsun Felix Wo and Porras re Live Traffic Analysis paper, 11/1997
802, 402, 403, 901(a)
401; 402; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403
401; 402; 803; 807; 901; PTO para. 24
715
PTX-
233
SRI_E_00179290017930
Email exchange between Aziz Mounji and Porras re Live Traffic Analysis paper, 11/1997
802, 402, 403, 901(a)
401; 402; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403
401; 402; 803; 807; 901; PTO para. 24
716
PTX-
234
SRI_E_00180340018038
802, 402, 403, 901(a) Email/authors kit from Steve Welke to Porras and others whose papers were accepted for publication in NDSS '98
401; 402; 803; 807; 901
802, 901(a), 402, 403
401; 402; 803; 807; 901
717
PTX-
235
SRI_E_0018138
Email exchange between Valdes and Porras re the acceptance of Live Traffic Analysis paper, presentation
105, 802
401; 402; 803; 807; PTO para. 24
105, 802
401; 402; 803; 807; PTO para. 24
718
PTX-
236
SRI_E_0018143
10/21/97 email to Emerald Team requesting a copy of 802, 402, 403, 901(a) Live Traffic Analysis article for [email protected]
401; 402; 803; 807; 901
901(a), 802, 402, 403
401; 402; 803; 807; 901
723
PTX-
237
SRI_E_0018147
PTX-
238
SRI_E_0018233
PTX-
239
SRI_E_0018234
10/1/97 email from Matt Schonlau of AT&T to Emerald Team asking to be sent a copy of Live Traffic paper when available 11/11/97 email from Sal Stolfo to Porras thanking him for sending a copy of the Live Traffic Analysis paper 9/10/87 email from Stolfo to Porras re Live Traffic Analysis paper
802, 402, 403, 901(a) 802, 402, 403, 901(a) 802, 402, 403, 901(a)
401; 402; 803; 807; 901 401; 402; 803; 807; 901 401; 402; 803; 807; 901
901(a), 802, 402, 403 901(a), 802, 402, 403 901(a), 802, 402, 403
401; 402; 803; 807; 901 401; 402; 803; 807; 901 401; 402; 803; 807; 901
724
720
721
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 19 of 41
PTX-
240
SRI_E_0018239
Email from Valdes to Porras forwarding an email re the Live Traffic Analysis
105, 802
401; 402; 803; 807; PTO para. 24
105, 802
401; 402; 803; 807; PTO para. 24
722
PTX-
241
SRI_E_0018242
9/5/07 email from George Lentz to Emerald Team requesting 2 papers, including Live Traffic Analysis paper
105, 802
401; 402; 803; 807
105, 802
401; 402; 803; 807; PTO para. 24
725
PTX-
242
SRI_E_0018248
9/4/07 email from Lentz to Emerald Team requesting 901(a),802, 403, 402 papers
401; 402; 803; 807; 901
901(a), 802, 402, 403
401; 402; 803; 807; 901
726
PTX-
243
SRI_E_0018254
9/3/07 email from Jennifer Dealy to Emerald Team requesting Live Traffic Analysis paper
802, 402, 403, 901(a)
401; 402; 803; 807; 901
901(a), 802, 402, 403
401; 402; 803; 807; 901
727
PTX-
244
SRI_E_00399112
8/29/97 email from Gary Jackson to Emerald Team requesting Live Traffic Analysis paper
802, 402, 403, 901(a)
401; 402; 803; 807; 901
901(a), 802, 402, 403
401; 402; 803; 807; 901
728
PTX-
245
SRI_E_00522320052233
12/7/97 email from Porras to [email protected] and [email protected] re requests for Live Traffic paper
802, 402, 403, 901(a)
401; 402; 803; 807; 901; PTO para. 24
901(a), 802, 402, 403
401; 402; 803; 807; 901; PTO para. 24
729
PTX-
246
SRIE_0004894
Email from Valdes to Porras, Bercow and Skinner w/ 802, 403, 402, 901(a) disappointment over Atomic Tangerine/commercialization btw Valdes, Porras and Doug Moran
401; 402; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403
401; 402; 803; 807; 901; PTO para. 24
1286
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 20 of 41
PTX-
247
SRIE_00438130043814
Email from Porras to Moran re Lunch and discussing 403, 802, 402, 901(a) EMERALD and Recourse
401; 402; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403
401; 402; 803; 807; 901; PTO para. 24
1251
PTX-
248
SRIE_0052257SRIE_0052258
Gary Jackson email to Phil Porras re Live Traffic Analysis
105, 802
401; 402; 803; 807
105, 802
401; 402; 803; 807
732
PTXPTX-
249 250
SRIE_0077330 SRIE_0077373
Email from Bercow to Valdes re Valdes' input about 802, 403, 402, 901(a) Recourse (SRIE_0077330) Email from Bercow to Moran re Phil and Moran's lunch, EMERALD and Recourse 802, 403, 402, 901(a)
401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24
802, 901(a), 402, 403 402, 802, 901(a), 403
401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24
909 1252
PTX-
251
SRIE_186231
Porras email to Skinner and Valdes dated June 21, 1998 re estat delivery
901(a), 802, 402, 403
401; 402; 803; 807; 901; PTO para. 24
901(a), 802, 402, 403
401; 402; 803; 807; 901; PTO para. 24
748
PTX-
252
SRIE_38302
Porras email to Skinner, Fong and Porras dated December 30,1998 re EMERALD near-term deliverables status
901(a), 802, 403, 402
401; 402; 803; 807; 901; PTO para. 24
901(a), 802, 402, 403
401; 402; 803; 807; 901; PTO para. 24
751
PTX-
253
SYM_P_0019055SYM_P_0019074
Symantec Guide to Correlation Techniques by Darrell 403, 402 M. Keinzle, PhD., dated November 6, 2003
401; 402
802, 901(a), 402, 105
401; 402; 801; 803; 807; 901; PTO para. 24
776
PTX-
254
SYM_P_0020640SYM_P_0020675
Symantec Security 5400 Series PowerPoint Presentation
802, 901(a), 402, 105
401; 402; 801; 803; 807; 901; PTO para. 24
736
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 21 of 41
PTX-
255
SYM_P_0031160SYM_P_0031299
Event Correlation Overview Darrell Kienzle Symantec Research Labs
Range incl. mult. docs 401; 402 Assuming SRI intended to designate SYM_P_0031160-199. 402, 403
802, 901(a), 402, 105
401; 402; 801; 803; 807; 901; PTO para. 24
762
PTX-
256
SYM_P_0036968SYM_P_0036976
403, 402 ManHunt's Event Dictionary Requirements for a Normalized Event Dictionary by Mike Smith, Jeremy Bennett
401; 402
802, 901(a), 402, 403, 105
401; 402; 801; 803; 807; 901; PTO para. 24
775
PTX-
257
SYM_P_0052675SY M_P_0052717 SYM_P_0053881SY M_P_0054272 SYM_P_0092443SYM_P_0092447 SYM_P_0097932SYM_P_0094941 SYM_P_0104928SYM_P_0104931 SYM_P_01049340104936 SYM_P_01124200112444 SYM_P_0137493SY M_P_0137545 SYM_P_0158602SY M_P_0158648 SYM_P_0163052SY M_P_0163055 SYM_P_0187490189001
Burton Group In-Depth Research Report: Security Enterprise w/Network Behavior Anomaly Symantec TM network Security Administration Guide
802, 402, 403, 901(a)
401; 402; 803; 807; 901
802, 901(a), 402, 403 802, 901(a), 402, 105
401; 402; 803; 807; 901 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24
862
PTXPTX-
258 259
764 783
PTX-
260
PTX-
261
402, 403 Symantec Global Enterprise Marketing Communications Brief v 3.0 Symantec NEW IDS Story Commbrief Symantec Iforce IDs Appliance, Powered By Sun and Symantec V2 Business Infrastructure Readiness Project Pandora Dated 7/29/03 Patrick Wheeler email to Sandeep Kumar dated August `4, 2004 re SS correlated technote- Draft 1 TechNote: Symantec Network Security's Real-Time Event Correlation Feature Symantec ManHunt Strategy and Roadmap v. 1.11 Blackbird Event Metadata 2.2 Specification Manhunt 2.1 Q2 2002 AF: Event Receiver Specification by Michael Smith, modified February 24, 2004 Symantec Universal Event Collector Configuration Guide
401; 402
802, 901(a), 402, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 105 802, 901(a), 402
872
760
PTXPTXPTXPTXPTXPTX-
262 263 264 265 266 267
1265 1261 789 790 792 1267
402, 403 402, 403 402, 403
401; 402 401; 402 401; 402
802, 901(a), 402 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 22 of 41
PTX-
268
SYM_P_0209016SYM_P_0209094 SYM_P_0209981SY M_P_0210011 SYM_P_0236964SYM_P_0236967 SYM_P_0284104SY M_P_0284130 SYM_P_0286483SY M_P_0286498 SYM_P_0300071SY M_P_0300099 SYM_P_0336255SYM_P_0336259
PTXPTXPTXPTXPTXPTX-
269 270 271 272 273 274
Symantec K2 (Symantec Network Security 7100 Series Product functional requirements dated March 18, 2005 IPS Selection Criteria and SNS - Patrick Wheeler, Product Manager, dated July 26, 2005 Tolly Test Summary Draft Outline Product: Symantec Security Information Manager 4.0 Sim 4.0 fy06 Business Plan Version 5 Symantec Worldwide Sales & Marketing Conference Symantec Network Security Analyst quarterly dated August 2005
402, 403
401; 402
802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24
737
797 798 800 801 802 804
802, 403
401; 402; 801; 803; 807; PTO para. 24
802, 402, 403
401; 402; 801; 803; 807; PTO para. 24
PTXPTX-
275 276
SYM_P_0384490SY M_P_0384493 SYM_P_0407795SYM_P_0407800
Manhunt Deployment Guide Manhunt Event Stream Provider Specification by Brian Hernacki, Bob Geiger created 4/26/00
802, 402, 403 802, 403, 402
401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24
802, 901(a), 402, 403, 105 802, 901(a), 402, 105
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24
805 753
PTX-
277
SYM_P_0553071
Interrogatory 17 Supplemental Data
Document inadequately identified. Description mischaracterizes document. 401; 402; 801; 803; 807; PTO para. 24 802, 901(a), 402, 403, 105 802, 901(a), 402, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 105
Identification adequate; description accurate
924
PTXPTXPTXPTXPTX-
278 279 280 282 283
SYM_P_385550SYM_P_385660 SYM_P_415808SYM_P_415839 SYM_P_53323SYM_P_53396 SYM-P-0049575SYM_P_0049583 SYM-P-0057094SYM-P-0057237
Recourse ManHunt v. 1.1 Deployment Guide- 802, 403, 402 Beta Proprietary and Confidential Manhunt 3.0 "Orion" Engineering Design Document created December 27, 2001 Symantec SGS 2.0 Gateway Network Detection Component (gNDC) Workshop Symantec Halon component Functional Requirements 402, 403 Symantec TM Manhunt 3.0 User Guide
401; 402
401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24
778 754 738 763 765
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 23 of 41
PTX-
284
ISS RealSecure SiteProtector Comparison Guide for 402, 403, 802 ICEcap Manager Version 1.5 dated January 2002 (http://documents.iss.net/literature/SiteProtector/KEC aptorRSSPComparison.pdf)
401; 402; 801; 803; 807
402, 802. Document inadequately identified.
401; 402; 801; 803; 807; Identification adequate
806
PTXPTXPTX-
285 286 287
US Patent Application Publication re US 2002/0019945 A1 US Patent Application Publication re US 2002/0078381A1 Proventia Security Product Family Datasheet NP, DM http://documents.iss.net/literature/proventia/prov entia_platform-brochure.pdf
Publicly available; identified in Dr. Kesidis' expert report; description accurate
106. Not timely: never produced or disclosed. 106. Not timely: never produced or disclosed. 901(a), 802, 402, 403. Document inadequately identified. Not timely: never produced or disclosed.
Document complete; publicly available Document complete; publicly available 401; 402; 801; 803; 807; identification adequate; publicly available; identified in Dr. Kesidis' expert report
809 810 818
PTX-
288
NT Live Traffic Analysis of TCP/IP Gateways dated November 10, 1997 from http://web.archive.org/web/19980124000949.www.c sl.sri.com/emerald/live-traffic.html
Document inadequately Publicly available; produced during summary identified. Not timely: judgment briefing produced after the close of discovery.
Identification adequate; 827 publicly available; produced during summary judgment briefing
PTX-
289
Abstract of Live Traffic Analysis of TCP/IP Gateways dated August 1, 1997 from http://web.archive.org/web/19980124003236/www.c sl.sri.com/emerald/
Document inadequately identified. Not timely: produced after the close of discovery.
Identification adequate; 828 publicly available; produced during summary judgment briefing
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 24 of 41
PTX-
290
Book titled A Heritage of Innovation SRI_'s First Half Century by Donald Nielsen
NP
Publicly available
Not timely: never produced or disclosed.
Publicly available
845
PTX-
291
NP RealSecure Network Datasheet (http://documents.iss.net/literature/realsecure/rsn/10100datasheet.pdf) NP "SiteProtector Security Fusion" (http://documents.iss.net/literature/SiteProtector/Data sheet-Fusion2.0.pdf) 105, 802 Curriculum vitae Dr. George Kesidis ISS webpage http://www.iss.net/education/schedules/bycourses/by_course-course=94=north-america.php Ex. A to Symantec's Supplemental Responses to Interrogatory No. 9 and 17 Ex. A to Symantec's Supplemental Response to Interrogatory No. 18 Ex. B to Symantec's Supplemental Response to Interrogatory No. 18 ISS's Response to SRI_Interrogatory No. 1 Symantec's Response to SRI_Interrogatory No. 9 NP, DI
Publicly available; identified in Dr. Kesidis' expert report Publicly available; identified in Dr. Kesidis' expert report 402; 403; 803; 807
PTX-
292
Document inadequately identified. Not timely: never produced or disclosed. Not timely: never produced or disclosed. 105, 802
PTXPTX-
293 294
Identification adequate; publicly available; identified in Dr. Kesidis' expert report Publicly available; identified in Dr. Kesidis' expert report 401; 402; 803; 807
848
875
915
Publicly available; Document inadequately produced during summary identified. judgment briefing; adequately identified
Identification adequate; 920 publicly available; produced during summary judgment briefing 926
PTX-
295
105, 402, 403. Document Identification adequate; inadequately identified. 401; 402 105, 402, 403 105, 402, 403 105, 802, 402, 403 401; 402; 801; 803; 807 105, 402, 403, 802 401; 402; 801; 803; 807 401; 402 401; 402
PTXPTXPTXPTX-
296 297 298 299
927 928 1301 1302
PTX-
300
Symantec's Response to SRI_Interrogatory No. 17
105, 402, 403, 802
401; 402; 801; 803; 807
1303
PTX-
301
Symantec's Response to SRI_Interrogatory No. 18
105, 402, 403, 802
401; 402; 801; 803; 807
1304
PTX-
302
Appendixes referenced in Symantec's Responses to DI Interrogatory No. 17
Adequately identified
Document inadequately identified.
Adequately identified.
1306
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 25 of 41
PTX-
303
Appendixes referenced in Symantec's Responses to Interrogatory No. 9
403, 402
401; 402
1307
PTX-
304
Symantec Annual Report and quarterly SEC filings, 1999 Symantec Annual Report and quarterly SEC filings, 2000 Symantec Annual Report and quarterly SEC filings, 2001 Symantec Annual Report and quarterly SEC filings, 2002 Symantec Annual Report and quarterly SEC filings, 2003 Symantec Annual Report and quarterly SEC filings, 2004 Symantec Annual Report and quarterly SEC filings, 2005 Symantec Annual Report and quarterly SEC filings, 2006 Symantec sales data spreadsheets NP Publicly available
PTX-
305
PTX-
306
PTX-
307
PTX-
308
PTX-
309
PTX-
310
PTX-
311
802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed.
401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available
1308
1309
1310
1311
1312
1313
1314
1315
PTX-
312
NP, DI
Adequately identified; produced by Symantec
802, 901(a), 402, 403. Not 401; 402; 801; 803; 807; timely: never produced or 901; produced by disclosed. Symantec
1316
PTX-
313
CD containing emerald.avi file
NP, DM, 402, 403, 802, 401; 402; 803; 807; 901; 901(a) PTO para. 24; produced at SRI 287301 on 2/14/2006; description accurate
802, 901(a), 402, 403. Not timely: never produced or disclosed. Description mischaracterizes document.
401; 402; 803; 807; 901; PTO para. 24; produced at SRI 287301 on 2/14/2006; description accurate
1317
Case 1:04-cv-01199-SLR
Document 465-30
Filed 10/06/2006
Page 26 of 41
PTX-
314
Cited in Dr. George http://www.iss.net/RSSP/window.html Kesidis' Infringement Report re ISS SRI 058107-18 Defending Networks in an Information War: A Proposal to ARPA under BAA 96-03
DI
PTX-
315
Publicly available; identified in Dr. Kesidis' Infringement Report; identification adequate 401; 402; 803; 807; 901; PTO para.24
Document inadequately identified. 402, 901, 802, 403
Identification adequate; publicly available; identified in Dr. Kesidis' Infringement Report 401; 402; 803; 807; 901; PTO para.24
1318
1319
402, 403, 802, 901 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 802,105,901 401; 402; 803; 807; 902; PTO para. 24 1320
PTX-
316
SRI 014413-014442
PTX-
317
SRI 014512-014517
Anderson, Boucher, Neumann, Valdes. Analysis and Response for Intrusion Detection in Large Networks: A Proposal in Response to ARPA ITO BAA 96-03 105, 802 BAA 96-03 Proposer Information Pamphlet
402, 403, 802, 901 PTX318 SRI 030166-030243 Memorandum to Linne re BAA 96-03 and attachments thereto 105, 802 Letter fr Linne to Advanced Research Projects Agency Attn: BAA96-03 Topic Area: Survivablility of Information Systems 402, 403, 802, 901 401; 402; 803; 807; PTO para. 24
402, 901, 802, 403, 105; description mischaracterizes document 802, 105, 901; Description mischaracterizes document. 402, 802, 403, 105; incomplete document 402, 901, 802, 403, 105; incomplete document 402, 901, 802, 403, 105
401; 402; 803; 807; 901; 1321 PTO para. 24; description accurate 401; 402; 803; 807; 901; 1322 PTO para. 24; description accurate 401; 402; 803; 807; PTO para. 24; document complete 401; 402; 803; 807; 901; PTO para. 24; document complete 401; 402; 803; 807; 901; PTO para. 24 1323
PTX-
319 SRI 030460
401; 402; 803; 807; 901; PTO para. 24 401; 402; 801; 807; 901; PTO para. 24
PTX-
320 SRIE 00296520029653 Email from Porras to Platon, Stauden dated 10/6/00 402, 403, 802, 901
1326
PTX-
321 SRIE0083010 Email from Moran to Porras dated 7/18/01 402, 403, 802, 901 Email from Porras to Lindqvist re Form posted from Mozilla dated 10/11/00 402, 403, 802, 901 Email from Winarsky to Gibson; cc: Lincoln, Mark, Porras, Abramson, etc dated 9/3/04 Email from Douglas Moran to Phil Porras dated October 18, 2000 Email from Phil Porras to Peter Neumann dated October 9, 1996 ISS Organization Charts 105, 106, 402, 403, 802, 901 402, 403,