Free Proposed Pretrial Order - District Court of Delaware - Delaware


File Size: 188.6 kB
Pages: 41
Date: October 11, 2006
File Format: PDF
State: Delaware
Category: District Court of Delaware
Author: unknown
Word Count: 11,416 Words, 65,559 Characters
Page Size: Letter (8 1/2" x 11")
URL

https://www.findforms.com/pdf_files/ded/8551/465-30.pdf

Download Proposed Pretrial Order - District Court of Delaware ( 188.6 kB)


Preview Proposed Pretrial Order - District Court of Delaware
Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 1 of 41

SRI v. ISS and Symantec Exhibit 7 to the Proposed PreTrial Order SRI'S List of Exhibits L.R. 16.4(d)(6)
Final Ex. No.

BATES RANGE

DOCUMENT DESCRIPTION

Symantec's Objections Basis for Admission: Response to Symantec's Objections

ISS's objections

Basis for Admission: Response to ISS's Objections

Prev. PTX No.

PTX-

1

U.S. Patent No. 6,321,338 (Porras et al. )

1

PTX-

2

n/a

U.S. Patent No. 6,484,203 (Porras et al. )

2

PTX-

3

n/a

U.S. Patent No. 6,708,212 (Porras et al .)

3

PTX-

4

n/a

U.S. Patent No. 6,711,615 (Porras et al .)

4

PTX-

5

n/a

File History for U.S. Patent 6,321,338, Serial No. 09/188,793

106 Document complete.

Document inadequately identified.

Document adequately identified.

5

PTX-

6

n/a

File History for U.S. Patent 6,484,203, Serial No. 09/658,137 File History for U.S. Patent 6,708,212, Serial No. 10/429,607 File History for U.S. Patent 6,711,615, Serial No. 10/254,457

106 Document complete.

Document inadequately identified. Document inadequately identified. Document inadequately identified.

Document adequately identified. Document adequately identified. Document adequately identified.

6

PTX-

7

n/a

106 Document complete.

7

PTX-

8

n/a

106 Document complete.

8

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 2 of 41

PTX-

9

Contents of the website at http://www.faqs.org/rfcs/

NT

Produced during Not timely: produced after Produced during 699 the close of discovery. summary judgment summary judgment briefing; publicly available briefing; publicly available Produced during Not timely: produced after Produced during 700 summary judgment the close of discovery. summary judgment briefing; publicly available briefing; publicly available Produced during Not timely: produced after Produced during 703 summary judgment the close of discovery. summary judgment briefing; publicly available; briefing; publicly available identification adequate

PTX-

10

Contents of the website at http://www.rfceditor.org/overview.html

NT

PTX-

11

http://www.isoc.org/isoc.org/isoc/conferences/ndss/9 NT; DI 8cfp.shtml; http://www.isoc.org/isoc/conferences/ndss/98/cfp.sht ml

PTX-

12

ISS-02892 ­ 02904

"EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances" by Phillip Porras and Peter G. Neumann An e-mail dated April 15, 2005 DM, 106 Document complete; description accurate 802, 901(a), 402 401; 402; 801; 803; 807; 901; PTO para. 24

705

PTX-

13

SYM_P_02806340280644

706

PTXPTXPTXPTX-

14 15 16 17

SRI_287656 ­ SRI_287659 SRI_E_0018138 SRIE_0052257 ­ SRIE_0052258 SYM_P_0507977SYM_P_0507996

SRI Invention Disclosure Form for Emerald

105, 802

105, 802 Email regarding the acceptance of the Live Traffic paper for publication A string of emails between Gary Jackson and Phillip 105, 802 Porras Re Live Traffic Analysis 105, 802 HTML version of the publication by Phillip Porras and Alfonso Valdes, Live Traffic Analysis of TCP/IP Gateways. www.web.arcive.org/eb/19980124000949/www.csl.s ri.com/emerald/live-traffic.html

401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24

105, 802 105, 802 105, 802 105, 802

401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24

733 712 732 713

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 3 of 41

PTX-

18

http://web.archive.org/web/19970713122019/ww NT w.isoc.org/conferences/ndss98/

Produced during Not timely: produced after Produced during 702 the close of discovery. summary judgment summary judgment briefing; publicly available briefing; publicly available

PTX-

19

PTX-

20

SUN 0000501-SUN 0000506; SUN 0000600-SUN 0000608

Excerpts from SunScreen EFS, Configuration and Management Guide An abstract of the publication by Phillip Porras and NT Alfonso Valdes, Live Traffic Analysis of TCP/IP Gateways, located at web.archive.org/web/19980124003236/http:/www.cs l.sri.com/ememerald/traffic-short.html Letter to Macchia re SRI_Network Security Patents Folder entitled Symantec re Letter to Schallop re SRI_Network Security Patents Letter to Schallup from Abramson re Symantec's infringement of SRI_patents Letter to Michael Schallup from Abramson re network-based intrusion Fedex packing slip to Schallup from SRI Letter to Petty from Abramson re prior art to SRI_Patents 105, 802 105, 802 105, 802 105, 802 105, 802 DI

802

803; 807

710

901(a), 802; 402, 403. Not Produced during Produced during 711 timely: produced after the summary judgment summary judgment briefing; publicly available; briefing; publicly available close of discovery. 401; 402; 803; 807; 901 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para.24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 Identification adequate 105, 802, 402, 403 105, 802 105, 802 105, 802 105, 802 105, 802, 402, 403, 408, document inadequately identified 105, 802, 402, 403 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24; identification adequate 401; 402; 803; 807; PTO para. 24

PTXPTXPTXPTXPTXPTX-

21 22 23 24 25 26

SRI_17515 ­ 17516 SRI_18069 ­ 18071 SRI_18075 SRI_18076 -18078 SRI_18080 SRI_2184144 ­2184147 SRI_9430 ­ 9431

622 620 619 617 618 627

PTX-

27

Letter to Richard `Macchia re SRI_Network Security 105, 802 Patents

401; 402; 803; 807; PTO para. 24

621

PTXPTX-

28 29

Agabian: 449 SYM_P_00943640094390 SYM_P_01633030163305 SYM_P_02818340281836 SYM_P_02856480285684

White Paper: Enterprise Security, Symantec, Security Information Management Symantec Security Management System, Integrating 402, 403 Product Data, Requirements, Draft 1.3 Symantec Correlation Capabilities Rev 3 Email thread btwn Schwarz and Smith re Security Information Manager 4.0 installed and performing well Symantec, Draft, SIMA 4.0, Minardi, F24H, Walkthrough 106, 402, 403

401; 402 401; 402

402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24

389 380

PTXPTX-

30 31

378 390

PTX-

32

901(a)

901; PTO para. 24

392

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 4 of 41

PTXPTXPTXPTXPTXPTXPTXPTX-

33 34 35 36 37 38 39 40

SYM_P_02860990286152 SYM_P_02866630286704 SYM_P_02885510288587 SYM_P_03649580364997 SYM_P_03689780369898 SYM_P_03703430370644 SYM_P_03726170372666 SYM_P_03755350375571 PNC 001-PNC 039 PNC 040-PNC 071 PNC 72-102 Bagley: 200 Bagley: 201

901(a) Global Technical Training, Symantec Security Information Manager Overview, Costco Symantec Response for JPMorgan Chase Security Information and Even Management RFI Symantec Security Information Manager 4.0; Product Functional Requirements ­ Draft Symantec Security Management Strategy Transformation FAQ Symantec Incident Manager, SSMS Solution General 402, 403 RFI Symantec Security Information, Manager 4.0, Support Team Training, Student Guide Unit 5, Symantec Incident Manager Managing incidents with Symantec Security Information Manager 4.0, Support Team ­ Minardi Training Course Statement of work between PNC and Symantec Symantec Sales Quote 106, 403 901(a) 901(a)

901; PTO para. 24

401; 402

106 Document complete 401; 402 901; PTO para. 24 901; PTO para. 24 901; PTO para. 24

402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403. Description mischaracterizes document. 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901; Description accurate

385 393 384 382 379 388 381 387

PTXPTXPTXPTXPTX-

41 42 43 44 45

468 469 470 184 185

White Paper provided by Symantec explaining real 901(a) time security monitoring Data Sheet: Security Technology Symantec Network Security 7100 Series Data Sheet: ISS Symantec Gateway Security 5600 Series

PTXPTXPTXPTXPTXPTXPTX-

46 47 48 49 50 51 52

SYM_P_00305440030552 SYM_P_00319010031933 SYM_P_00944470094457 SYM_P_00967180096749 SYM_P_00976940097711 SYM_P_0195825-47 SYM_P_02004300200442

How ManHunt Detects Threats How ManHunt Detects Threats

802, 901(a) 901(a)

801; 803; 807; 901; PTO para. 24 901; PTO para. 24

Global Marketing Communications Plan ­FINAL Symantec ManHunt 3.0 Symantec ManHunt Product Launch Kit, Enterprise 402, 403 Edition Symantec ManHunt Product Launch Guide, Enterprise Edition Symantec Proposal to XXXX for Intrusion Protection SNS 7100 Deployment/ Evaluation Strategies

401; 402

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24

175 161 180 176 177 168 166

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 5 of 41

PTX-

53

PTXPTXPTXPTXPTXPTXPTXPTXPTX-

54 55 56 57 58 59 60 61 62

PTXPTXPTXPTXPTXPTXPTXPTXPTXPTXPTXPTX-

63 64 65 66 67 68 69 70 71 72 73 74

SYM_P_0237443-458 White Paper: Enterprise Solutions Effective Intrusion Prevention: Protecting Networks Against the Threats of Today and Tomorrow SYM_P_03055325Technical FAQ; Symantec Network Security 7100 030532 Series Appliances FAQs Email thread from Bagley to Wheeler re SNS SYM_P01049320104936_ Correlation technote ­ DRAFT1 Symantec Network Security User Guide SYM_P_00150290015162 ManHunt Data Processing- Jeremy Bennett SYM_P_00192040019214 Symantec SNS 4.0 Sensor Architecture SYM_P_00367390036749 Paper: Symantec ManHunt detection SYM_P_00368890036893 Recourse Technologies ManHunt; Reducing the Risk SYM_P_00371070037119 of Compromise Symantec Network Detection Components SYM_P_00373500037365 SYM_P_0037480Symanted Blackbird 4.0 (Ursa Major Detection 0037501 Engine) Product Functional Requirement" Revision 0.97 SYM_P_0037697Symantec "ManHunt's Layered Detection" Jeremy 0037727 Bennett Symantec Corporation ManHunt Intrusion Detection SYM_P_00485720048593 System Symantec ManHunt System Training Robert Geiger SYM_P_00487660048815 Symantec "Ballymeade/Captiva PFR" SYM_P_00494280049461 Symantec Usra Major (ManHunt 4.0) Product SYM_P_00495310049559 Functional Requirements Revision 1.3 Recourse Technologies ManHunt Training SYM_P_00497580049781 Introduction Module, Version 2.11 Symantec Corp ManHunt Intrusion Detection System SYM_P_00506830050707 Ursa Major (ManHunt 4.0) High Level Design SYM_P_01628710162882 Document by Mark Janazura "Manhunt Setup, Application and Maintenance" SYM_P_02911510291586 Symantec "NGS Quarterly Business Review SNS and SYM_P_03304180330443 SGS Product Lines" Symantec ManHunt 3.0 Technical Evaluation and SYM_P_05314540531503 NSS Group Report Aberdeen Group Financial White paper SYM_P_025584025598

402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901 401; 402; 803; 807; 901

183

163 164 43 35 30 32 20 24 28

901(a) 802, 402, 403

901; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 106 Document complete 106 Document complete

29 22 27 40 26 31 25 36 44 41 34 241

802, 402, 403, 901(a)

401; 402; 801; 803; 807; 901; PTO para. 24

802, 402, 901(a) 403 901(a), 802, 402, 403

401; 402; 803; 807; 901 401; 402; 803; 807; 901

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 6 of 41

PTXPTXPTXPTXPTX-

75 76 77 78 79

SYM_P_550390550465 ISS_0055186200551863 SRIE_0005021 SRIE_0082984 SYM_P_00463220046364 SYM_P_00490690049071 SYM_P_00506520050659 SYM_P_00516420051647

Symantec 2003 annual report Anomaly Detection Demo email Email thread Valdes to Porras re EMERALD Email Moral to Porras 105, 402, 403, 802 802, 901(a), 402, 403 802, 901(a), 402, 403 401; 402; 801; 803; 807; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24

402, 901(a), 802, 403, 105 402 402, 901(a), 802, 403 402, 901(a), 802, 403 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24

242 297 55 57 59

PTXPTXPTX-

80 81 82

Symantec Network Security 7100 Series, Project Galileo, Commit to Solution Presentation, EMEA 415-04 ManHunt Enterprise, Architecture & Requirements 802, 402, 403, 901(a) [Draft] White Paper: Why is Symantec's Approach to IPS best? Email thread, Kumar to Bennett, Smith, et al re ManHunt

401; 402; 801; 803; 807; 901; PTO para. 24

52 67 61

PTXPTXPTXPTXPTXPTX-

83 84 85 86 87 88

SYM_P_00918870091889 SYM_P_01312140131222 SYM_P_033549703355537 SYM_P_04087520408780 Geyer: 272 SYM_P_05425540542563 Griswold: 343 (ISS_02125736-742)

Suzuki email to [email protected] Third Party Event Reception for ManHunt, Mike Lyle, Bob Geiger Symantec ManHunt v2.11, Technical Evaluation, An NSS Group Report Symantec, Brighton, Acquisition of High Speed Intrusion Detection Notes from site visit to Symantec MSS site Email string from Andy Sell to Angela Halliwell and Tony McDonald re favor Source code for attack for compromised host rule

402, 403 802, 402, 403, 901(a) 802, 901(a), 403, 402 901(a)

401; 402 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901 901; PTO para. 24

402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 901(a), 802; 402, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 Description mischaracterizes document. Document inadequately identified. Description mischaracterizes document. Document inadequately identified.

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 Identification adequate. Description accurate.

63 66 70 76 249 248

PTX-

89

105, 402, 403, 802

401; 402; 801; 803; 807; PTO para. 24

317

PTX-

90

Griswold: 344 (ISS_02125743-860)

Compilation of source code documents

105, 402, 403, 802

401; 402; 801; 803; 807; PTO para. 24

Identification adequate. Description accurate.

318

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 7 of 41

PTX-

91

ISS_0006028700060300

Fusion Update August 9th, 2002

105, 402, 403, 802

401; 402; 801; 803; 807; PTO Para. 24

312

PTX-

92

ISS_0052559600525600

Project Status Report

105, 402, 403, 802

401; 402; 801; 803; 807; PTO Para. 24

402

401; 402

310

PTX-

93

ISS_00535783-821

Security Fusion Module 2.0 Tech Support Chalk Talk 105, 402, 403, 802

401; 402; 801; 803; 807; PTO para. 24

313

PTXPTXPTX-

94 95 96

ISS_0054161000541631 ISS_0054183400541847 ISS_00687640068778

Development Stories RealSecure Fusion Sensor 2.0 Market Requirements Document RealSecure Fusion Sensor 2.0 Attack from a Compromised Host Definitions

105, 402, 403, 802 105, 402, 403, 802 105, 402, 403, 802

401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24

402 802, 402 402. Description mischaracterizes document.Illegible, at least part. 402; 802. Description mischaracterizes document. Cumulative, 802. Description mischaracterizes document. 106

401; 402 401; 402; 801; 803; 807; PTO para.24 401; 402; Description accurate; sufficiently legible

311 309 307

PTX-

97

ISS2_01445521001445522

Email string btwn Griswold, Ward, and Craig re quick questions about Fusion 2.0 for Ford meeting

105, 402, 403, 802

401; 402; 801; 803; 807; PTO para. 24

401; 402; 801; 803; 807; 315 PTO para. 24; description accurate 401; 402; 801; 803; 807 Description accurate 428 440

PTXPTX-

98 99

Hall: 500 Hall: 512

Proventia Enterprise Security Platform (ESP) RealSecure® Network Gigabit datasheet page from iss.net ISS SiteProtector 2.0 Comparison Guide for RealSecure Workgroup Manager (http://documents.iss.net/literature/SiteProtector/WG MTORSSPComparison.pdf) Symantec; The Complete ManHunt Symantec ManHunt Release History

802, 403, 402, 901(a), 105

401; 402; 801; 803; 807; 901; PTO para. 24

PTX-

100

Hall: 513

Document complete.

441

PTXPTX-

101 102

SYM_P_00495960049645 SYM_P_00505390050549

402, 403 901(a)

401; 402 901; PTO Para. 24

402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24

198 200

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 8 of 41

PTXPTXPTXPTX-

103 104 105 106

SYM_P_01629880163028 SYM_P_01630860163100 Innes: 434 Innes: 435

Symantec; ManHunt Tech Exchange Symantec; ManHunt Architecture Product Lifecycle Announcement Proventia Network Anomaly Detection System data sheet

402, 403 402, 403 105, 402, 403, 802 105, 402, 403, 802

401; 402 401; 402 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24

402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 Description mischaracterizes document. Description mischaracterizes document. 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 Description accurate

196 197 366 367

PTX-

107

Proventia Prudential Network Anomaly Detection ISS 2_0034987200349873; Innes: 436 System User Guide Version 3.5 SYM_P_0176251SYM_P_0176253 SYM_P_0047130047173 SYM_P_00601210060152 SYM_P_00603360060396 SYM_P_01175280117548 SYM_P_00215990021663 SYM_P_00662900066304 SYM_P_01108380110841 SYM_P_01476110147648 SYM_P_01577500157765 SYM_P_01906150190649 SYM_P_02109100210912 Q & A re Manhunt's intrusion detection technology Symantec; Ursa Major; Requirements Checkpoint Presentation Symantec; ManHunt 3.0/ Orion; Product Functional Requirements Symantec; Orion ­ Symantec ManHunt 3.0, Requirement Checkpoint/ Commit to Solution Symantec; Symantec ManHunt 3.0 Ballymeade Project Commit to Solution Checkpoint Symantec Gateway Security 5400 Series, Version 1.0a Product Frequently Asked Questions Symantec Gateway Security 1600 Series, Mini-Me Project Everything you wanted to know about IDS/IPS but were afraid to ask Asbestos (Blackbird) Product Functional Requirements Reviewer's Guide Symantec Gateway Security Appliance 5400 Series IDS Guidance for Sugarbush

105, 402, 403, 802

Description accurate

368

PTXPTXPTXPTXPTXPTXPTXPTXPTXPTXPTXPTX-

108 109 110 111 112 113 114 115 116 117 118 119

901(a), 106, 402, 403, 802

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24

676 138 132 133 136 148 152 160 159 150 153 156

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 9 of 41

PTX-

120

SYM_P_03836130383763

Symantec Enterprise Firewall, Symantec Enterprise Firewall with BPN, Symantec Gateway Security Symantec Client VPN Functional Specification, Code Name: Ballymeade/Captive

802, 901(a), 402, 403, 105

401; 402; 801; 803; 807; 901; PTO para. 24

149

PTXPTXPTXPTX-

121 122 123 124

Sugarbush Product Functional Requirements SYM_P_044284700442954 SRI_163635 ­ 163674 Emerald Net ­ IDS Appliance User's Guide Ver. 2.0 105, 802 and related EMERALD Network Appliance 105, 802 SRI_88192 ­ 88203 Presentation re Emerald Business Strategy Framework SYM_P_0032023Symantec, ManHunt Appliance 1.0, Galileo, High 0032031 Level Design Document (HLDD) SYM_P_00320540032058 SYM_P_00349640034981 SRIE_2225 ISS48496-48511 McEwin: 122 Symantec, ManHunt Appliance 1.0, Galileo, In-Line, Monitoring High Level Specifications Galileo, Performance Test Plan

401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; PTO para. 24 105, 802 401; 402; 803; 807; PTO para. 24 901(a),802, 402, 403, 105 401; 402; 801; 803; 807; 901; PTO para. 24 901(a),802, 402, 403, 105 401; 402; 801; 803; 807; 901; PTO para. 24 901(a),802, 402, 403, 105 401; 402; 801; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403, 105 105, 802

155 516 522 78

PTXPTX-

125 126

79 85

PTXPTXPTX-

127 128 129

Email from Winarsky to Mark et al re Nokia ISS Product Line Architecture: A Glossary Proventia A Series

105, 802 105, 402, 403, 802 105, 402, 403, 802

401; 402; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24

105, 802 402

401; 402; 803; 807; PTO para. 24 401; 402

610 123 125

PTXPTX-

130 131

McEwin: 123 GAP 00019-GAP 00048 GAP 00108-GAP 00179 SRI_44834 SRI_75871 ­ 75873 ISS_0212572002125735

Proventia G line products Data Sheet Symantec Master Services Agreement

105, 402, 403, 802

126 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 Description accurate 265

PTX-

132

Symantec Enterprise Security Solutions Proposal for GAP Inc. Email from Neumann to Lunt re Intrusion detection, 105, 802 survivability 105, 802 Email from Neumann re software Engineer Module from the Network Sensor RS_PAM_NetworkSensor/Dev/RealSecure/Sensordll/issPAMSensorLib/issPamSensor.h 105, 402, 403, 802 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24

269

PTXPTXPTX-

133 134 135

105, 802 105, 802 Description mischaracterizes document.

602 607 375

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 10 of 41

PTXPTXPTX-

136 137 138

ISS_17243-18096 ISS_201256902125728 SYM_P_0517609SYM_P_0517610 ARB00660-00692

RealSecure Signatures Reference Guide, Version 6.5 105, 402, 403, 802 105, 402, 403, 802 Source Code for the bridge module RS_PAM_NetworkSensors/dev/RealSecure/Sensor_d ll/issPamSensorLib/issPamSensor.cpp 402, 403 Email, Horvath to Little and Castles, 09/20/02

401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402

377 Description mischaracterizes document. 402, 901(a), 802, 403, 105 402, 802, 403 802 402, 802, 403; 901(a) 802, 901(a), 402, 403 Description accurate 401; 402; 801; 803; 807; 901; PTO para. 24 401;402; 801; 803; 807 801; 803; 807 401; 402; 801; 803; 807; 901 401; 402; 803; 807; 901 376 276

PTX-

139

Amendment No. 1 to License and Distribution Agreement btwn Arbor Networks, Inc. and ISS- GA Proventia Network Anomaly Detection System Quick Start Guide Version 3.5 Arbor Networks Press Release: News & Events from their website

105, 402, 403, 802, 901(a) 105, 402, 403, 802, 901(a) 105, 402, 403, 802, 901(a)

401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 801; 803; 807; 901 401; 402; 803; 807; 901

657

PTXPTXPTX-

140 141 142

ARB00693-00740 Morville: 537 Morville: 538

662 658 659

PTXPTX-

143 144

105, 402, 403, 802, Arbor Networks' Peakflow solutions ensure the security and operational integrity of the world's most 901(a) critical networks; from website~Corporate Profile page 105, 402, 403, 802, Morville: 548 U.S. Patent Application Pub. No. 2005/0005017 901(a) 105, 802 SRI_105503 - 105524 Summary of Advanced Network Security and Information Warfare Research in CSL/SRI_by Porras SYM_P_05355485 ­ EMERALD: Event Monitoring Enabling Responses 535497 to Anomalus Live Disturbances by Porras And Neumann DI

401; 402; 803; 807; 901; 902 401; 402; 803; 807; PTO para. 24 Identification adequate

402, 403, 802 105, 802 Document inadequately identified.

401; 402; 803; 807 401; 402; 803; 807; PTO para. 24 Identification adequate.

667 596

PTX-

145

540

PTXPTX-

146 147

Pruss: 231 ISS04439-0440

ISS ­ Advanced SiteProtector RealSecure Server Sensor marketing brochure

105, 402, 403, 802 105, 402, 403, 802

401; 402; 801; 803; 807 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24

PTX-

148

ISS_05991-059989

RealSecure SiteProtector Security Fusion Module 2.0 105; 402; 403; 802; multiple documents Frequently Asked Questions

PTXPTX-

149 150

ISS16455-16466 ISS2_00105902-04

RealSecure Server Sensor FAQ The Protocol Analysis Module

105, 402, 403, 802 105, 402, 403, 802

401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24

Description mischaracterizes document. 402,cumulative. Description mischaracterizes document. Document inadequately identified. 106

Description accurate 401; 402; description accurate; identification adequate

213 115

372

118 Document complete 117

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 11 of 41

PTXPTXPTX-

151 152 153

ISS2_00653565+C178 Meet with Dell email HEALTHSOUTH 028 Security Network design diagram SYM_P_05489940549907 Network Surveillance by Porras et al

105, 402, 403, 802 105, 402, 403, 802, 901(a) 105, 802

401; 402; 801; 803; 807; PTO para. 24 401; 402; 803; 807; 901 401; 402; 803; 807; PTO para. 24

402, 802 802, 901(a), 402, 403 105, 802

401; 402; 801; 803; 807; PTO para. 24 401; 402; 803; 807; 901 401; 402; 803; 807; PTO para. 24

109 443 656

PTX-

154

M00001-00050

Managed Security Services Agreement

901(a)

901

802, 901(a), 402, 403, 105

401; 402; 801; 803; 807; 901

462

PTX-

155

M00070-00083

Symantec Invoice

901(a)

901

802, 901(a), 402, 403, 105

401; 402; 801; 803; 807; 901

463

PTXPTX-

156 157

M00225-00260 ISS05920-21

Symantec MSS Implementation: Implementation Method of Procedure SiteProtector Security Fusion Module from web datasheet

901(a) 105, 402, 403, 802

901 401; 402; 801; 803; 807; PTO para. 24

802, 901(a), 402, 403, 105 Description mischaracterizes document.

401; 402; 801; 803; 807; 901 Description accurate.

467 92

PTXPTXPTXPTXPTXPTX-

158 159 160 161 162 163

ISS2_01396595-615 ISS68417-68431 ISS68461-68476 ISS68487-68505 ISS68535-68551 ISS68738-69746

RealSecure SiteProtector Security Fusion Module presentation; Holly Turner Third-Party Module 2003 Project Plans

105, 402, 403, 802 105, 402, 403, 802

105, 402, 403, 802 RealSecure SiteProtector Security Fusion Module Presentation- Hollly Turner 105, 402, 403, 802 RealSecure SiteProtector Security Fusion Module presentation; Holly Turner ISS: "Fusion Less is More" Holly Turner and Carolyn 105, 402, 403, 802 Reuss 105, 402, 403, 802 Security Fusion Module Upcoming Releases and Competitive Info Presentation- Holly Turner Symantec IDS & IPS capability in SNS 7100 Series vs. SGS 5400 Series Symantec Gateway Security 5400 Technical Briefing Tasha Van Es 402, 403 Introduction to Symantec Incident Manager

401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24

93 402, 802 401; 402; 801; 803; 807; PTO para.24 103 100 94 401; 402; 801; 803; 807; 96 PTO para. 24 802, 402, 403. Description 401; 402; 801; 803; 807; 99 mischaracterizes PTO para. 24; Description accurate document. 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 47 229 230 802, 402, 403

PTXPTXPTX-

164 165 166

SYM_P_00479890047991 SYM_P_00200600020142 Van Es: 248

401; 402

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 12 of 41

PTXPTX-

167 168

Van Es: 254 SRI_014443SRI_014453

Symantec Security Information Manager 9500 Series 402, 403 "Computer Security research and Development at SRI_International" article 105, 802

401; 402 401; 402; 803; 807; PTO para. 24

402, 901(a), 802, 403, 105 105, 802

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; PTO para. 24

233 648

PTX-

169

SRI_051898- 51903

"Knowledge-Based Intrusion Detection" article

105, 802

401; 402; 803; 807; PTO para. 24

105, 802

401; 402; 803; 807; PTO para. 24

646

PTX-

170

SRI_142069SRI_142154

"Detecting Unusual Program Behavior Using the Statistical Component of the Next-generation Intrusion Detection expert System (NIDES)" "IDES: An Intelligent System for Detecting Intruders" article

105, 802

401; 402; 803; 807; PTO para. 24

105, 802

401; 402; 803; 807; PTO para. 24

650

PTX-

171

TL 0010-0021

105, 802

401; 402; 803; 807

105, 802

401; 402; 803; 807

647

PTX-

172

SRI_047974-47984

SRI_IDES Statistical Anomaly Detector by Javitz, Valdes and Tamaru

105, 802

401; 402; 803; 807; PTO para. 24

105, 802

401; 402; 803; 807; PTO para. 24

541

PTX-

173

SRI_13361-13404

Darpa Order D985-Award/Contract

105, 802

401; 402; 803; 807; PTO para. 24

105, 802

401; 402; 803; 807; PTO para. 24

545

PTXPTX-

174 175

SRI_48679-48694 SRIE_18565

Emerald- Statistical-Analyzer TCP Monitor Documentation Valdes email to Porras re Stats work

105, 802 105, 802

401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24

105, 802 105, 802

401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24

569 554

PTX-

176

SRIE_274329-274414 MIT Lincoln Laboratory Offline Component of the 1999 DARPA Intrusion Detection Evaluation

105, 802

401; 402; 803; 807

581

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 13 of 41

PTX-

177

SRIE_399156-399159 Lunt email to Valdes and others re Tentative Agenda 105, 802 for DARPA-Intrusion Detection Conference

401; 402; 803; 807; PTO para. 24

105, 802

401; 402; 803; 807; PTO para. 24

566

PTXPTX-

178 179

SRIE_449229-449232 Neumann email to Porras Valdes, Gilham, Frivold, Japan re Notes on New NIDES; SRI_Proprietary SRIE_53628 Valdes email to Porras and Neumann re Frank Jou meeting SYM_P_554967 Article titled, History re SRI

105, 802 105, 802

401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24

105, 802 105, 802

401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24; description accurate; sufficiently legible 401; 402; 801; 803; 807; 901; PTO para. 24; Description accurate; sufficiently legible 401; 402; 801; 803; 807; PTO para. 24

546 561

PTX-

180

105, 802

105, 802

568

PTX-

181

SYM_P_68937-68942 Statistical Methods for Computer Usage Anomaly Detection Using NIDES SYM_P_79206-79370 SRI_International- Final Technical Report SYM_P_01598180159845 Bennett: 41 ISS_01744269 American Express- Resource Technologies 802, 402, 403 401; 402; 801; 803; 807; PTO para. 24

105, 802

571

PTXPTX-

182 183

105, 802 402, 901(a), 802, 403, 105 402, 901(a), 802, 403, 105 802, 901(a), 402, 403. Illegible, at least in part. Description mischaracterizes document. 802, 901(a), 402, 403. Illegible, at least in part. Description mischaracterizes document. 802, 402, 403

575 251

PTXPTX-

184 185

List of resellers and end users of Symantec (Appendix I to Interrogatory Responses) ISS Financial data

42 922

Partially illeg. 106, 402, 403, 802, 901(a)

401; 402; 801; 803; 807; PTO para. 24; document complete; sufficiently legible 401; 402; 801; 803; 807; PTO para. 24; document complete 401; 402; 801; 803; 807; 901; PTO para. 24

PTX-

186

ISS_01832561

ISS Financial data

Partially illeg. 106, 402, 403, 802, 901(a)

923

PTX-

187

ISS_11292-299

Proventia Security Product Family brochure

901(a), 802, 402, 403

812

PTX-

188

ISS_20657-ISS_20662 ISS WGM to SP comparison guide- Figures and Appendix

105, 402, 403, 802

401; 402; 801; 803; 807; PTO para. 24

802, 402, 403

401; 402; 801; 803; 807; PTO para. 24

847

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 14 of 41

PTX-

189

ISS_21064-66

Proventia Intrusion Prevention Appliance brochure

901(a), 802, 402, 403

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24; description accurate

802, 402, 403

401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24; identification adequate; document complete 401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24

811

PTX-

190

ISS_353052- 353405

ISS RealSecure 5.5 Student Guide

802, 901(a), 402, 403

802, 402, 403

816

PTX-

191

ISS_4387-4393

Proventia Enterprise Security Platform (ESP) brochure

DM, 106, 901(a), 802, 402, 403

802, 402, 403, 106. Document inadequately identified.

813

PTXPTX-

192 193

ISS_541632-541642 ISS_592180- 592291

ISS Market Requirements Document Security Fusion 802, 402, 403 Module 2.0 802, 901(a), 402, 403 License and Distrubution Agreement dated August 12, 2005 between Arbor Networks and ISS 105, 802 The EMERALD Project Current Downloads as of (9/4/97) from http://web.arcive.org/web/19980124000015/www.csl .sri.com/emerald/downloads.html

401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 803; 807; PTO para. 24

802, 402, 403 802, 402, 403

808 814

PTX-

194

ISS02126097

825

PTXPTXPTX-

195 196 197

ISS04149-04157 ISS06011-06017 ISS23541-557

Heberlein, Dias, Levitt, Mukherjee, Wood, and Wolber, A Network Security Monitor "RealSecure Guard FAQ" Mukherjee, Heberlein, and Levitt, Network Intrusion Detection

890 402; 403; 802; 105 401; 402; 801; 803; 807; PTO para. 24 802, 402 401; 402; 801; 803; 807; PTO para. 24 1225 1236

PTX-

198

N/A

802, 403, 402, 901(a) Symantec Buys Spam Killer, gets Street Cred http://www.baselinemag.com/article.2/0,1540,19818 94,00.asp

401; 402; 803; 807; 901; 902

802,403, 402, 901(a), 105.Document inadequately identified.

401; 402; 803; 807; 901; 902; identification adequate

779

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 15 of 41

PTX-

199

SRI_000001-000052

"RealSecure Network Sensor and Gigabit Network Sensor Frequently Asked Questions"

Illegible, 105, 106, 402, Sufficiently legible; 401; 403, 802, 901(a) 402; complete; 801; 803; 807; 901; PTO para.24

802, 901(a), 402, 106.Illegible, at least in part.

401; 402; 801; 803; 807; 901; PTO para. 24; sufficiently legible

879

PTX-

200

SRI_00001-9

RealSecure Network Sensor and Gigabit Network Sensor FAQs

105, 402, 403, 802, 901(a)

401; 402; 801; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403

401; 402; 801; 803; 807; 901; PTO para. 24

850

PTX-

201

SRI_000020-33

ISS Enhanced Dynamic Threat Protection via Automated Correlation and Analysis

105,402, 403, 802, 901(a)

401; 402; 801; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403

401; 402; 801; 803; 807; 901; PTO para. 24

851

PTX-

202

SRI_000034-35

RealSecure 10/100 brochure

105, 402, 403, 802, 901(a)

401; 402; 801; 803; 807; 901; PTO para. 24

802, 901(a), 106. Illegible, 801; 803; 807; 901; PTO at least in part. para. 24; sufficiently legible; document complete 802, 901(a), 106. Illegible, 801; 803; 807; 901; PTO at least in part. para. 24; sufficiently legible; document complete 802, 901(a), 106.Illegible, 401; 402; 801; 803; 807; at least in part, 402, 403. 901; PTO para. 24; sufficiently legible; document complete 802, 901(a), 106, 403, 401; 402; 801; 803; 807; 402 901; PTO para. 24; document complete 105, 802. Document 401; 402; 803; 807; PTO inadequately identified. para. 24; identification adequate 802, 901(a), 402, 403 401; 402; 803; 807; 901; PTO para. 24 802, 901(a), 402, 403 401; 402; 803; 807; 901; PTO para. 24 106, 403, 802. 401; 402; 803; 807; PTO Description para. 24; description mischaracterizes accurate; document document. complete

852

PTX-

203

SRI_000035-36-37

RealSecure Network Gigabit brochure

105, 402, 403, 802, 901(a) 105, 402, 403, 802, 901(a)

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24

853

PTX-

204

SRI_000047-48

SiteProtector Third Party Module brochure

854

PTX-

205

SRI_000049-520

Site Protector Third Party Module Frequently Asked 105, 402, 403, 802, 901(a) Questions EMERALD Site-wide Correlation Engine

855

PTX-

206

SRI_05165688051693 SRI_110331-110357

105, 402, 403, 802, DM 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; PTO para. 24; description accurate; document complete

1270

PTXPTXPTX-

207 208 209

Threat Analytics- A Cybershield Initiative version 2-0-802, 403, 402, 901(a) 12-04, 0, 4 Abstract of Live Traffic Analysis of TCP/IP Gateways 105, 802 SRI_112470 by Porras and Valdes DM, 802, 105, 106 SRI_277983 -277997 EMERALD eXpert/estat Draft 0.1

1305 819 742

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 16 of 41

PTX-

210

SRI_287660SRI_287662

USPTO Notice of Allowance and Fees Due re Application 10/429,611

106, 402, 403, 802,901(a)

401; 402; 803; 807; 901; document complete

402, 802, 901(a), 403, 106

401; 402; 803; 807; 901; document complete

829

PTX-

211

SRI_287663

USPTO Notice of Allowability re Application 10/429,611 USPTO Information Disclosure Statement by Applicant for Application 10/429,611

106, 402, 403, 802,901(a) 106, 402, 403, 802,901(a)

401; 402; 803; 807; 901; document complete 401; 402; 803; 807; 901; PTO para. 24; document complete 401; 402; 803; 807; 901; document complete

402, 802, 901(a), 403, 106 402, 802, 901(a), 403, 106

401; 402; 803; 807; 901; document complete 401; 402; 803; 807; 901; PTO para. 24; document complete 401; 402; 803; 807; 901; document complete

830

PTX-

212

SRI_287664SRI_287681

831

PTX-

213

SRI_287682SRI_287683

Issue Classification for Application 10/429,611

106, 402, 403, 802,901(a)

402, 802, 901(a), 403, 106

832

PTXPTX-

214 215

SRI_287684SRI_287690 SRI_287691SRI_287692

Confirmation No. 3015 and Amendments to the Claims re 10/429,611 Fold out poster/cd- SRI_Timeline of Innovations

106, 402, 403, 802,901(a) 106, 402, 403, 802, 901(a), partially illeg.

401; 402; 803; 807; 901; document complete 401; 402; 803; 807; 901; PTO para. 24; sufficiently legible; document complete 401; 402; 803; 807; 901(a); PTO para. 24

402, 802, 901(a), 403, 106 402, 802, 901(a), 403, 106. Illegible, at least in part. 802, 901(a), 402, 403

401; 402; 803; 807; 901; 833 document complete 401; 402; 803; 807; 901; 834 PTO para. 24; sufficiently legible; document complete 401; 402; 803; 807; 901; PTO para. 24 835

PTX-

216

SRI_287693SRI_287697

SRI_International ­ 60 years ­ 1946-2006 - Timeline 802, 403, 402, 901(a) of Innovations

PTXPTXPTXPTX-

217 218 219 220

SRI_287698SRI_287701 SRI_287706SRI_287709 SRI_287710SRI_287713 SRI_287714

SRI_International's Timeline of InnovationsInventing the Future for More Than 55 Years SRI_International's Timeline of InnovationsInventing the Future for the Past 55 Years SRI_International's Timeline of InnovationsInventing the Future for the Past 50 Years SRI- What They Are Saying About Us

802, 403, 402, 901(a) 802, 403, 402, 901(a) 802, 403, 402, 901(a) 802, 403, 402, 901(a)

401; 402; 803; 807; 901(a); PTO para. 24 401; 402; 803; 807; 901(a); PTO para. 24 401; 402; 803; 807; 901(a); PTO para. 24 401; 402; 803; 807; 901(a); PTO para. 24 401; 402; 803; 807; 901(a); PTO para. 24 401; 402; 803; 807; 901; PTO para. 24; legible

802, 901(a), 402, 403 802, 901(a), 402, 403 802, 901(a), 402, 403 802, 901(a), 402, 403

401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24

836 837 838 839

PTX-

221

SRI_287715SRI_287716 SRI_287717SRI_287746

SRI_International - Breakthrough Ideas- Real-World 802, 403, 901(a) Solutions World-Changing Innovations partially illeg, 802, 901(a), 402, 403, 106

802, 901(a), 402, 106, 403. Illegible, at least in part. 802, 901(a), 402, 403, 106. Illegible, at least in part.

401; 402; 803; 807; 901; 840 PTO para. 24; sufficiently legible 401; 402; 803; 807; 901; 841 PTO para. 24; sufficiently legible

PTX-

222

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 17 of 41

PTX-

223

SRI_287747SRI_287749 SRI_287750SRI_287765

San Jose Mercury News "For the Love of Research" 802, 901(a), 402, 403, 106 Discover What We're Discovering 802, 901(a), 402, 403

401; 402; 803; 807; 901; 902; document complete 401; 402; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403, 106 802, 901(a), 402, 403

401; 402; 803; 807; 901; 902; document complete 401; 402; 803; 807; 901; PTO para. 24

842

PTX-

224

843

PTX-

225

SRI_287766SRI_287769

Donna Linne letter to Nilsa Monina of DCMS-San Francisco dated October 29, 1998

802, 901(a), 402, 403

401; 402; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403. Not 401; 402; 803; 807; 901; timely: produced after the PTO para. 24; produced close of discovery. timely 802, 901(a), 402, 403 401; 402; 803; 807; 901; 902

844

PTX-

226

SRI_37174-37175

802, 402, 403, 901(a) Article titled "DARPA's EMERALD Proves Worth in Cyperdefens" from U.S. Department of Defense from http://www.defenselink.mil/news/aug2000/n0814200 0_20008144.html

401; 402; 803; 807; 901; 902

1293

PTX-

227

SRI_37176-37179

SRI_Timeline of SRI_International Innovations: 2000s SRI_Timeline of SRI_International Innovations 1980s

802, 402, 403, 901(a)

401; 402; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403

401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24

1294

PTX-

228

SRI_37192-37195

DM, 802, 403, 402, 901(a)

401; 402; 803; 807; 901; 802, 901(a), 402, 403 PTO para. 24; description accurate 401; 402; 803; 807; 901; PTO para. 24 802, 901(a), 402, 403

1295

PTX-

229

SRI_37196-37202

SRI_Timeline of SRI_International Innovations 1990s

802, 403, 402, 901(a)

401; 402; 803; 807; 901; PTO para. 24

1296

PTX-

230

SRI_72894-72897

Article titled "EMERALD's Component-Based Approach to Network Security Distrubuted RealTime Security Monitoring by Claude J. Bauer

901(a), 802, 403, 402

401; 402; 803; 807; 901; 902

802, 901(a), 402, 403

401; 402; 803; 807; 901; 902

1299

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 18 of 41

PTX-

231

SRI_E_0017849

Email exchange between Jerzy Rub and Porras re Live Traffic Analysis paper

802, 402, 403, 901(a)

401; 402; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403

401; 402; 803; 807; 901; PTO para. 24

714

PTX-

232

SRI_E_0017912

Email exchange between Shyhtsun Felix Wo and Porras re Live Traffic Analysis paper, 11/1997

802, 402, 403, 901(a)

401; 402; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403

401; 402; 803; 807; 901; PTO para. 24

715

PTX-

233

SRI_E_00179290017930

Email exchange between Aziz Mounji and Porras re Live Traffic Analysis paper, 11/1997

802, 402, 403, 901(a)

401; 402; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403

401; 402; 803; 807; 901; PTO para. 24

716

PTX-

234

SRI_E_00180340018038

802, 402, 403, 901(a) Email/authors kit from Steve Welke to Porras and others whose papers were accepted for publication in NDSS '98

401; 402; 803; 807; 901

802, 901(a), 402, 403

401; 402; 803; 807; 901

717

PTX-

235

SRI_E_0018138

Email exchange between Valdes and Porras re the acceptance of Live Traffic Analysis paper, presentation

105, 802

401; 402; 803; 807; PTO para. 24

105, 802

401; 402; 803; 807; PTO para. 24

718

PTX-

236

SRI_E_0018143

10/21/97 email to Emerald Team requesting a copy of 802, 402, 403, 901(a) Live Traffic Analysis article for [email protected]

401; 402; 803; 807; 901

901(a), 802, 402, 403

401; 402; 803; 807; 901

723

PTX-

237

SRI_E_0018147

PTX-

238

SRI_E_0018233

PTX-

239

SRI_E_0018234

10/1/97 email from Matt Schonlau of AT&T to Emerald Team asking to be sent a copy of Live Traffic paper when available 11/11/97 email from Sal Stolfo to Porras thanking him for sending a copy of the Live Traffic Analysis paper 9/10/87 email from Stolfo to Porras re Live Traffic Analysis paper

802, 402, 403, 901(a) 802, 402, 403, 901(a) 802, 402, 403, 901(a)

401; 402; 803; 807; 901 401; 402; 803; 807; 901 401; 402; 803; 807; 901

901(a), 802, 402, 403 901(a), 802, 402, 403 901(a), 802, 402, 403

401; 402; 803; 807; 901 401; 402; 803; 807; 901 401; 402; 803; 807; 901

724

720

721

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 19 of 41

PTX-

240

SRI_E_0018239

Email from Valdes to Porras forwarding an email re the Live Traffic Analysis

105, 802

401; 402; 803; 807; PTO para. 24

105, 802

401; 402; 803; 807; PTO para. 24

722

PTX-

241

SRI_E_0018242

9/5/07 email from George Lentz to Emerald Team requesting 2 papers, including Live Traffic Analysis paper

105, 802

401; 402; 803; 807

105, 802

401; 402; 803; 807; PTO para. 24

725

PTX-

242

SRI_E_0018248

9/4/07 email from Lentz to Emerald Team requesting 901(a),802, 403, 402 papers

401; 402; 803; 807; 901

901(a), 802, 402, 403

401; 402; 803; 807; 901

726

PTX-

243

SRI_E_0018254

9/3/07 email from Jennifer Dealy to Emerald Team requesting Live Traffic Analysis paper

802, 402, 403, 901(a)

401; 402; 803; 807; 901

901(a), 802, 402, 403

401; 402; 803; 807; 901

727

PTX-

244

SRI_E_00399112

8/29/97 email from Gary Jackson to Emerald Team requesting Live Traffic Analysis paper

802, 402, 403, 901(a)

401; 402; 803; 807; 901

901(a), 802, 402, 403

401; 402; 803; 807; 901

728

PTX-

245

SRI_E_00522320052233

12/7/97 email from Porras to [email protected] and [email protected] re requests for Live Traffic paper

802, 402, 403, 901(a)

401; 402; 803; 807; 901; PTO para. 24

901(a), 802, 402, 403

401; 402; 803; 807; 901; PTO para. 24

729

PTX-

246

SRIE_0004894

Email from Valdes to Porras, Bercow and Skinner w/ 802, 403, 402, 901(a) disappointment over Atomic Tangerine/commercialization btw Valdes, Porras and Doug Moran

401; 402; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403

401; 402; 803; 807; 901; PTO para. 24

1286

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 20 of 41

PTX-

247

SRIE_00438130043814

Email from Porras to Moran re Lunch and discussing 403, 802, 402, 901(a) EMERALD and Recourse

401; 402; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403

401; 402; 803; 807; 901; PTO para. 24

1251

PTX-

248

SRIE_0052257SRIE_0052258

Gary Jackson email to Phil Porras re Live Traffic Analysis

105, 802

401; 402; 803; 807

105, 802

401; 402; 803; 807

732

PTXPTX-

249 250

SRIE_0077330 SRIE_0077373

Email from Bercow to Valdes re Valdes' input about 802, 403, 402, 901(a) Recourse (SRIE_0077330) Email from Bercow to Moran re Phil and Moran's lunch, EMERALD and Recourse 802, 403, 402, 901(a)

401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24

802, 901(a), 402, 403 402, 802, 901(a), 403

401; 402; 803; 807; 901; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24

909 1252

PTX-

251

SRIE_186231

Porras email to Skinner and Valdes dated June 21, 1998 re estat delivery

901(a), 802, 402, 403

401; 402; 803; 807; 901; PTO para. 24

901(a), 802, 402, 403

401; 402; 803; 807; 901; PTO para. 24

748

PTX-

252

SRIE_38302

Porras email to Skinner, Fong and Porras dated December 30,1998 re EMERALD near-term deliverables status

901(a), 802, 403, 402

401; 402; 803; 807; 901; PTO para. 24

901(a), 802, 402, 403

401; 402; 803; 807; 901; PTO para. 24

751

PTX-

253

SYM_P_0019055SYM_P_0019074

Symantec Guide to Correlation Techniques by Darrell 403, 402 M. Keinzle, PhD., dated November 6, 2003

401; 402

802, 901(a), 402, 105

401; 402; 801; 803; 807; 901; PTO para. 24

776

PTX-

254

SYM_P_0020640SYM_P_0020675

Symantec Security 5400 Series PowerPoint Presentation

802, 901(a), 402, 105

401; 402; 801; 803; 807; 901; PTO para. 24

736

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 21 of 41

PTX-

255

SYM_P_0031160SYM_P_0031299

Event Correlation Overview Darrell Kienzle Symantec Research Labs

Range incl. mult. docs 401; 402 Assuming SRI intended to designate SYM_P_0031160-199. 402, 403

802, 901(a), 402, 105

401; 402; 801; 803; 807; 901; PTO para. 24

762

PTX-

256

SYM_P_0036968SYM_P_0036976

403, 402 ManHunt's Event Dictionary Requirements for a Normalized Event Dictionary by Mike Smith, Jeremy Bennett

401; 402

802, 901(a), 402, 403, 105

401; 402; 801; 803; 807; 901; PTO para. 24

775

PTX-

257

SYM_P_0052675SY M_P_0052717 SYM_P_0053881SY M_P_0054272 SYM_P_0092443SYM_P_0092447 SYM_P_0097932SYM_P_0094941 SYM_P_0104928SYM_P_0104931 SYM_P_01049340104936 SYM_P_01124200112444 SYM_P_0137493SY M_P_0137545 SYM_P_0158602SY M_P_0158648 SYM_P_0163052SY M_P_0163055 SYM_P_0187490189001

Burton Group In-Depth Research Report: Security Enterprise w/Network Behavior Anomaly Symantec TM network Security Administration Guide

802, 402, 403, 901(a)

401; 402; 803; 807; 901

802, 901(a), 402, 403 802, 901(a), 402, 105

401; 402; 803; 807; 901 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24

862

PTXPTX-

258 259

764 783

PTX-

260

PTX-

261

402, 403 Symantec Global Enterprise Marketing Communications Brief v 3.0 Symantec NEW IDS Story Commbrief Symantec Iforce IDs Appliance, Powered By Sun and Symantec V2 Business Infrastructure Readiness Project Pandora Dated 7/29/03 Patrick Wheeler email to Sandeep Kumar dated August `4, 2004 re SS correlated technote- Draft 1 TechNote: Symantec Network Security's Real-Time Event Correlation Feature Symantec ManHunt Strategy and Roadmap v. 1.11 Blackbird Event Metadata 2.2 Specification Manhunt 2.1 Q2 2002 AF: Event Receiver Specification by Michael Smith, modified February 24, 2004 Symantec Universal Event Collector Configuration Guide

401; 402

802, 901(a), 402, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 105 802, 901(a), 402

872

760

PTXPTXPTXPTXPTXPTX-

262 263 264 265 266 267

1265 1261 789 790 792 1267

402, 403 402, 403 402, 403

401; 402 401; 402 401; 402

802, 901(a), 402 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 22 of 41

PTX-

268

SYM_P_0209016SYM_P_0209094 SYM_P_0209981SY M_P_0210011 SYM_P_0236964SYM_P_0236967 SYM_P_0284104SY M_P_0284130 SYM_P_0286483SY M_P_0286498 SYM_P_0300071SY M_P_0300099 SYM_P_0336255SYM_P_0336259

PTXPTXPTXPTXPTXPTX-

269 270 271 272 273 274

Symantec K2 (Symantec Network Security 7100 Series Product functional requirements dated March 18, 2005 IPS Selection Criteria and SNS - Patrick Wheeler, Product Manager, dated July 26, 2005 Tolly Test Summary Draft Outline Product: Symantec Security Information Manager 4.0 Sim 4.0 fy06 Business Plan Version 5 Symantec Worldwide Sales & Marketing Conference Symantec Network Security Analyst quarterly dated August 2005

402, 403

401; 402

802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24

737

797 798 800 801 802 804

802, 403

401; 402; 801; 803; 807; PTO para. 24

802, 402, 403

401; 402; 801; 803; 807; PTO para. 24

PTXPTX-

275 276

SYM_P_0384490SY M_P_0384493 SYM_P_0407795SYM_P_0407800

Manhunt Deployment Guide Manhunt Event Stream Provider Specification by Brian Hernacki, Bob Geiger created 4/26/00

802, 402, 403 802, 403, 402

401; 402; 801; 803; 807; PTO para. 24 401; 402; 801; 803; 807; PTO para. 24

802, 901(a), 402, 403, 105 802, 901(a), 402, 105

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24

805 753

PTX-

277

SYM_P_0553071

Interrogatory 17 Supplemental Data

Document inadequately identified. Description mischaracterizes document. 401; 402; 801; 803; 807; PTO para. 24 802, 901(a), 402, 403, 105 802, 901(a), 402, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 403, 105 802, 901(a), 402, 105

Identification adequate; description accurate

924

PTXPTXPTXPTXPTX-

278 279 280 282 283

SYM_P_385550SYM_P_385660 SYM_P_415808SYM_P_415839 SYM_P_53323SYM_P_53396 SYM-P-0049575SYM_P_0049583 SYM-P-0057094SYM-P-0057237

Recourse ManHunt v. 1.1 Deployment Guide- 802, 403, 402 Beta Proprietary and Confidential Manhunt 3.0 "Orion" Engineering Design Document created December 27, 2001 Symantec SGS 2.0 Gateway Network Detection Component (gNDC) Workshop Symantec Halon component Functional Requirements 402, 403 Symantec TM Manhunt 3.0 User Guide

401; 402

401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24 401; 402; 801; 803; 807; 901; PTO para. 24

778 754 738 763 765

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 23 of 41

PTX-

284

ISS RealSecure SiteProtector Comparison Guide for 402, 403, 802 ICEcap Manager Version 1.5 dated January 2002 (http://documents.iss.net/literature/SiteProtector/KEC aptorRSSPComparison.pdf)

401; 402; 801; 803; 807

402, 802. Document inadequately identified.

401; 402; 801; 803; 807; Identification adequate

806

PTXPTXPTX-

285 286 287

US Patent Application Publication re US 2002/0019945 A1 US Patent Application Publication re US 2002/0078381A1 Proventia Security Product Family Datasheet NP, DM http://documents.iss.net/literature/proventia/prov entia_platform-brochure.pdf

Publicly available; identified in Dr. Kesidis' expert report; description accurate

106. Not timely: never produced or disclosed. 106. Not timely: never produced or disclosed. 901(a), 802, 402, 403. Document inadequately identified. Not timely: never produced or disclosed.

Document complete; publicly available Document complete; publicly available 401; 402; 801; 803; 807; identification adequate; publicly available; identified in Dr. Kesidis' expert report

809 810 818

PTX-

288

NT Live Traffic Analysis of TCP/IP Gateways dated November 10, 1997 from http://web.archive.org/web/19980124000949.www.c sl.sri.com/emerald/live-traffic.html

Document inadequately Publicly available; produced during summary identified. Not timely: judgment briefing produced after the close of discovery.

Identification adequate; 827 publicly available; produced during summary judgment briefing

PTX-

289

Abstract of Live Traffic Analysis of TCP/IP Gateways dated August 1, 1997 from http://web.archive.org/web/19980124003236/www.c sl.sri.com/emerald/

Document inadequately identified. Not timely: produced after the close of discovery.

Identification adequate; 828 publicly available; produced during summary judgment briefing

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 24 of 41

PTX-

290

Book titled A Heritage of Innovation ­SRI_'s First Half Century by Donald Nielsen

NP

Publicly available

Not timely: never produced or disclosed.

Publicly available

845

PTX-

291

NP RealSecure Network Datasheet (http://documents.iss.net/literature/realsecure/rsn/10100datasheet.pdf) NP "SiteProtector Security Fusion" (http://documents.iss.net/literature/SiteProtector/Data sheet-Fusion2.0.pdf) 105, 802 Curriculum vitae Dr. George Kesidis ISS webpage http://www.iss.net/education/schedules/bycourses/by_course-course=94=north-america.php Ex. A to Symantec's Supplemental Responses to Interrogatory No. 9 and 17 Ex. A to Symantec's Supplemental Response to Interrogatory No. 18 Ex. B to Symantec's Supplemental Response to Interrogatory No. 18 ISS's Response to SRI_Interrogatory No. 1 Symantec's Response to SRI_Interrogatory No. 9 NP, DI

Publicly available; identified in Dr. Kesidis' expert report Publicly available; identified in Dr. Kesidis' expert report 402; 403; 803; 807

PTX-

292

Document inadequately identified. Not timely: never produced or disclosed. Not timely: never produced or disclosed. 105, 802

PTXPTX-

293 294

Identification adequate; publicly available; identified in Dr. Kesidis' expert report Publicly available; identified in Dr. Kesidis' expert report 401; 402; 803; 807

848

875

915

Publicly available; Document inadequately produced during summary identified. judgment briefing; adequately identified

Identification adequate; 920 publicly available; produced during summary judgment briefing 926

PTX-

295

105, 402, 403. Document Identification adequate; inadequately identified. 401; 402 105, 402, 403 105, 402, 403 105, 802, 402, 403 401; 402; 801; 803; 807 105, 402, 403, 802 401; 402; 801; 803; 807 401; 402 401; 402

PTXPTXPTXPTX-

296 297 298 299

927 928 1301 1302

PTX-

300

Symantec's Response to SRI_Interrogatory No. 17

105, 402, 403, 802

401; 402; 801; 803; 807

1303

PTX-

301

Symantec's Response to SRI_Interrogatory No. 18

105, 402, 403, 802

401; 402; 801; 803; 807

1304

PTX-

302

Appendixes referenced in Symantec's Responses to DI Interrogatory No. 17

Adequately identified

Document inadequately identified.

Adequately identified.

1306

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 25 of 41

PTX-

303

Appendixes referenced in Symantec's Responses to Interrogatory No. 9

403, 402

401; 402

1307

PTX-

304

Symantec Annual Report and quarterly SEC filings, 1999 Symantec Annual Report and quarterly SEC filings, 2000 Symantec Annual Report and quarterly SEC filings, 2001 Symantec Annual Report and quarterly SEC filings, 2002 Symantec Annual Report and quarterly SEC filings, 2003 Symantec Annual Report and quarterly SEC filings, 2004 Symantec Annual Report and quarterly SEC filings, 2005 Symantec Annual Report and quarterly SEC filings, 2006 Symantec sales data spreadsheets NP Publicly available

PTX-

305

PTX-

306

PTX-

307

PTX-

308

PTX-

309

PTX-

310

PTX-

311

802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed. 802, 901(a), 402, 403. Not timely: never produced or disclosed.

401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available 401; 402; 801; 803; 807; 901; publicly available

1308

1309

1310

1311

1312

1313

1314

1315

PTX-

312

NP, DI

Adequately identified; produced by Symantec

802, 901(a), 402, 403. Not 401; 402; 801; 803; 807; timely: never produced or 901; produced by disclosed. Symantec

1316

PTX-

313

CD containing emerald.avi file

NP, DM, 402, 403, 802, 401; 402; 803; 807; 901; 901(a) PTO para. 24; produced at SRI 287301 on 2/14/2006; description accurate

802, 901(a), 402, 403. Not timely: never produced or disclosed. Description mischaracterizes document.

401; 402; 803; 807; 901; PTO para. 24; produced at SRI 287301 on 2/14/2006; description accurate

1317

Case 1:04-cv-01199-SLR

Document 465-30

Filed 10/06/2006

Page 26 of 41

PTX-

314

Cited in Dr. George http://www.iss.net/RSSP/window.html Kesidis' Infringement Report re ISS SRI 058107-18 Defending Networks in an Information War: A Proposal to ARPA under BAA 96-03

DI

PTX-

315

Publicly available; identified in Dr. Kesidis' Infringement Report; identification adequate 401; 402; 803; 807; 901; PTO para.24

Document inadequately identified. 402, 901, 802, 403

Identification adequate; publicly available; identified in Dr. Kesidis' Infringement Report 401; 402; 803; 807; 901; PTO para.24

1318

1319

402, 403, 802, 901 401; 402; 803; 807; PTO para. 24 401; 402; 803; 807; 901; PTO para. 24 802,105,901 401; 402; 803; 807; 902; PTO para. 24 1320

PTX-

316

SRI 014413-014442

PTX-

317

SRI 014512-014517

Anderson, Boucher, Neumann, Valdes. Analysis and Response for Intrusion Detection in Large Networks: A Proposal in Response to ARPA ITO BAA 96-03 105, 802 BAA 96-03 Proposer Information Pamphlet

402, 403, 802, 901 PTX318 SRI 030166-030243 Memorandum to Linne re BAA 96-03 and attachments thereto 105, 802 Letter fr Linne to Advanced Research Projects Agency Attn: BAA96-03 Topic Area: Survivablility of Information Systems 402, 403, 802, 901 401; 402; 803; 807; PTO para. 24

402, 901, 802, 403, 105; description mischaracterizes document 802, 105, 901; Description mischaracterizes document. 402, 802, 403, 105; incomplete document 402, 901, 802, 403, 105; incomplete document 402, 901, 802, 403, 105

401; 402; 803; 807; 901; 1321 PTO para. 24; description accurate 401; 402; 803; 807; 901; 1322 PTO para. 24; description accurate 401; 402; 803; 807; PTO para. 24; document complete 401; 402; 803; 807; 901; PTO para. 24; document complete 401; 402; 803; 807; 901; PTO para. 24 1323

PTX-

319 SRI 030460

401; 402; 803; 807; 901; PTO para. 24 401; 402; 801; 807; 901; PTO para. 24

PTX-

320 SRIE 00296520029653 Email from Porras to Platon, Stauden dated 10/6/00 402, 403, 802, 901

1326

PTX-

321 SRIE0083010 Email from Moran to Porras dated 7/18/01 402, 403, 802, 901 Email from Porras to Lindqvist re Form posted from Mozilla dated 10/11/00 402, 403, 802, 901 Email from Winarsky to Gibson; cc: Lincoln, Mark, Porras, Abramson, etc dated 9/3/04 Email from Douglas Moran to Phil Porras dated October 18, 2000 Email from Phil Porras to Peter Neumann dated October 9, 1996 ISS Organization Charts 105, 106, 402, 403, 802, 901 402, 403,