[00:00:00] Speaker 04:
down.

[00:00:55] Speaker 02:
Please proceed.

[00:00:56] Speaker 02:
Good morning, Your Honors, and may it please the Court.

[00:00:59] Speaker 02:
The Board's construction of the R-ranked limitation is unreasonable because it is not consistent with the intrinsic record.

[00:01:08] Speaker 02:
The Board stated that the ranking occurs only in the context of the claim comparison and that the most problematic phenotype is ranked according to how similar it is to the executing computer program.

[00:01:21] Speaker 02:
But this is not how the claimed invention works.

[00:01:24] Speaker 01:
Can I ask you this?

[00:01:26] Speaker 01:
So I'm inclined to think that that paragraph on page 11 of the board's opinion is rather central both to what it was thinking became central to the director's characterization of the patent and became seemingly central to the reason for finding the two pieces of prior art sufficient to

[00:01:51] Speaker 01:
to find unpatentability here.

[00:01:53] Speaker 01:
Yes, Your Honor.

[00:01:54] Speaker 01:
It's not clear to me whether that's quite the issue that in most of your blue brief, you have framed about timing.

[00:02:06] Speaker 01:
That is, mostly you say the ranking has to occur before the comparison.

[00:02:17] Speaker 01:
But it's correct, Your Honor.

[00:02:19] Speaker 01:
What you just said, which has struck me in preparing the case as kind of the heart of what's going on is that the board had the wrong notion of ranking in mind, ranking by similarity distance, as opposed to ranking the things in the library by whatever information you can get about the level of peril.

[00:02:40] Speaker 01:
And I guess I'm concerned about the extent to which you've really preserved and presented the argument that you're making now.

[00:02:49] Speaker 02:
Your Honor, the board's error with respect to focusing on the similarity distances as giving rise to the ranking is what led directly to its error on the timing question.

[00:03:02] Speaker 02:
Your Honor is correct that we have not challenged the construction of the term ranking as including or not including similarity distances.

[00:03:13] Speaker 02:
What we have challenged is the board's construction of the R-ranked limitation

[00:03:19] Speaker 02:
as allowing the ranking to occur during or after the clean comparison.

[00:03:24] Speaker 01:
I guess my problem with that is that it seems to me that you could have a post-comparison ranking that's different from ranking according to similarity of the object that the test subject by saying, we've just figured out which one this is like.

[00:03:48] Speaker 01:
We haven't yet looked through our library of phenotypes and decided which of those phenotypes are really, really dangerous and which less so.

[00:03:57] Speaker 01:
Now we're going to figure that out and then take action.

[00:04:01] Speaker 02:
Your honor, in theory, you could have that, but you couldn't have that in the context of the claimed invention here.

[00:04:07] Speaker 02:
And the reason for that, your honor, begins with the claim language.

[00:04:11] Speaker 02:
That in the comparing limitation, the action that is described here is

[00:04:16] Speaker 02:
comparing the plurality of malicious behavior indications to a predetermined collection of malicious behaviors, referred to as a phenotype.

[00:04:25] Speaker 02:
And then that claim limitation goes on to tell us several characteristics of a phenotype.

[00:04:31] Speaker 02:
One of those characteristics is that it comprises a grouping of specific genes that are typically present in a type of malicious code.

[00:04:39] Speaker 02:
Another characteristic is that the phenotype is one of a number of phenotypes.

[00:04:45] Speaker 02:
And that class of phenotypes are ranked to create increasing levels of confidence that a runtime object is executing a behavior pattern comparable to a known family of malware.

[00:04:57] Speaker 02:
There is no disclosure in the claim language or elsewhere in the intrinsic record of calculating these rankings either on the fly or after the claim comparison.

[00:05:10] Speaker 02:
Rather, both the structure of the claim language and then the description of

[00:05:16] Speaker 02:
the ranking and this behavioral monitoring process in the specification and the prosecution history shows that these rankings must exist before the comparison.

[00:05:26] Speaker 02:
Because all that you do is to detect a phenotype.

[00:05:31] Speaker 02:
And when that phenotype matches one of the existing phenotypes in the database, you determine whether that phenotype has the predetermined level of confidence necessary to trigger a content analysis.

[00:05:45] Speaker 02:
If you could calculate that level of confidence on the fly and go back while your system is under attack to figure out whether these stored phenotypes are sufficiently likely to indicate malware to trigger a content analysis, there would be some description in the claims or in the specification of this process happening during the comparison process.

[00:06:12] Speaker 02:
But there is no such description.

[00:06:15] Speaker 02:
All you do is make a comparison, look for a match, and if the matched phenotype has the predetermined level of confidence necessary to trigger a content analysis, you then proceed to the content analysis.

[00:06:28] Speaker 04:
I guess going back to where Judge Toronto started, try to understand the argument.

[00:06:35] Speaker 04:
Frankly, my read of the briefs is that this is very much just a time.

[00:06:39] Speaker 04:
Does this occur before?

[00:06:40] Speaker 04:
Does this occur after comparison?

[00:06:42] Speaker 04:
Does this occur during comparison?

[00:06:43] Speaker 04:
Yes, Your Honor.

[00:06:44] Speaker 04:
But it seems like the heart of the question isn't really what is the timing of the ranking.

[00:06:48] Speaker 04:
It's a question of what is the ranking?

[00:06:52] Speaker 04:
What are you ranking?

[00:06:54] Speaker 04:
Am I right about that?

[00:06:55] Speaker 02:
Your Honor, you are right that part of the issue is what is the ranking.

[00:07:01] Speaker 02:
But it is understanding the character of the ranking that directly leads to an answer on the timing question.

[00:07:08] Speaker 04:
Because in your view of what ranking is, it clearly is pre

[00:07:14] Speaker 04:
precedes and is separate and apart from the comparison step?

[00:07:18] Speaker 02:
Yes, Your Honor.

[00:07:19] Speaker 02:
And the reason for that is because, one, the claim language is written in a way that uses our rank as an adjectival phrase to indicate that the ranking happened before the claim comparison.

[00:07:32] Speaker 02:
Two, there's no disclosure anywhere of conducting the ranking process on the fly during or after the claim comparison.

[00:07:41] Speaker 02:
And three, Your Honor,

[00:07:43] Speaker 02:
the patent office has not given any reason to reject Safas's construction other than its view that the ranking constitutes a calculation of levels of similarity.

[00:07:58] Speaker 02:
Once you've dispelled that notion, you see that, for example, you can accomplish the comparison by only comparing one runtime object phenotype to one stored phenotype.

[00:08:12] Speaker 02:
And if you get an exact match and that matched phenotype has the level of confidence necessary to trigger a content analysis, then you've performed those steps of the method.

[00:08:25] Speaker 02:
However, we know from the claim language that you need to have a number of phenotypes that are ranked.

[00:08:32] Speaker 02:
How could you have a number of phenotypes that are ranked if you've only performed the comparison step one time under the board's view?

[00:08:42] Speaker 02:
that you calculate these rankings on the fly, the only way you could have a number.

[00:08:46] Speaker 01:
Yes, your honor.

[00:08:48] Speaker 01:
I guess it just comes back to what I started with and the chief followed up on.

[00:08:56] Speaker 01:
I am inclined at the moment to think that it is just dead wrong.

[00:09:01] Speaker 01:
to characterize what is going on here in the way the director does and the way the board did in the middle paragraph on 11.

[00:09:09] Speaker 01:
This is not about similarity distances between elements of the library, the phenotype library and the thing.

[00:09:18] Speaker 01:
What I'm trying to figure out is whether you have given us a fair opportunity to, whether you've preserved that point here.

[00:09:26] Speaker 01:
Because that, and I take it that the government's argument

[00:09:31] Speaker 01:
as I understand it is because it's tied to similarity distance the ranking actually cannot occur earlier and the board didn't even say that.

[00:09:41] Speaker 01:
But yet you have made your argument mostly, maybe not entirely.

[00:09:47] Speaker 01:
This is kind of what I'm trying to figure out in terms of whether the ranking can occur earlier or even has to occur earlier.

[00:09:57] Speaker 01:
But I don't really understand why

[00:10:01] Speaker 01:
a correct ranking of the phenotypes in the library without regard to the test subject couldn't occur just after the comparison.

[00:10:11] Speaker 02:
Right.

[00:10:12] Speaker 02:
Your honor, you are correct on how we've characterized the issue as a timing issue.

[00:10:16] Speaker 02:
We did preserve the challenge to the boards and the patent offices understanding of how the invention works by discussing it in our opening and reply briefs, but you are correct that we are framing this in terms of a timing issue in our position

[00:10:31] Speaker 02:
is that the ranking of the stored phenotypes must occur before the claim comparison.

[00:10:37] Speaker 02:
And Your Honor, this is not a case of lexicography or disavowal.

[00:10:42] Speaker 02:
This is the type of case where we look at the claim term.

[00:10:46] Speaker 02:
We believe that the claim term has a plain meaning based on the claim language alone.

[00:10:51] Speaker 02:
However, even if the court finds some grammatical ambiguity there, this is one of those cases like trivascular.

[00:11:00] Speaker 02:
the suit on source case that the Patent Office cites, and Microsoft v. Proxycom, where you need to look and say, is the way that the board construed this limitation consistent with the specification in that does it cause... Can I just take you back?

[00:11:17] Speaker 04:
Yes, Your Honor.

[00:11:17] Speaker 04:
Because some of this is not getting to what I understand the heart to do, the heart of what Judge Toronto is struggling with, and I think I share that, which is you keep going back to the timing.

[00:11:28] Speaker 04:
Is it because

[00:11:30] Speaker 04:
the way you've chosen to characterize it as before the comparison is synonymous with the argument we've been talking about is, let's talk about what your ranking and what the ranking is, and that it's not vis-a-vis the comparison.

[00:11:45] Speaker 04:
It's separate and distinct between the phenotypes in the library.

[00:11:49] Speaker 02:
Your Honor, those two issues are not synonymous.

[00:11:54] Speaker 02:
We think that once you have the correct understanding of how the claimed invention works,

[00:11:59] Speaker 02:
that these rankings are not similarity distances.

[00:12:02] Speaker 02:
Rather, they correspond to levels of confidence that malware is likely present.

[00:12:08] Speaker 02:
Once you understand that, we believe that that gets you a long way toward the correct construction here.

[00:12:15] Speaker 03:
However, you have to understand what's being done in order to understand why the timing matters.

[00:12:23] Speaker 02:
That is correct, Your Honor.

[00:12:24] Speaker 02:
And then once we get to that point, we have more work to do in order to show that this claim term should be temporally limited to ranking occurring before the claim comparison takes place.

[00:12:37] Speaker 02:
And Your Honor, as we described in our briefs, the claims, the specification, and the prosecution history... Well, what is the specification add?

[00:12:45] Speaker 04:
I mean, the board referred to it.

[00:12:46] Speaker 04:
It's ranked as used once in the specification, right?

[00:12:49] Speaker 04:
And it's not clear to me that that paragraph adds much.

[00:12:52] Speaker 02:
Your Honor, the most probative portion of that paragraph is the specification's description of an example of how this comparison process works.

[00:13:05] Speaker 02:
And the specification says at appendix 58, column 18, lines 34 to 41, that including greater combinations of behaviors in the phenotype database may enable more detailed analysis of a suspicious code.

[00:13:20] Speaker 02:
It gives us an example of that analysis.

[00:13:22] Speaker 02:
For example, an analysis of a suspicious code may be moved from accessing the registry in this location is bad to this process is exhibiting the same behavior as the family of malware configger based on a comparison of a detected phenotype with an existing phenotype.

[00:13:41] Speaker 02:
So as the specification describes it, all you're doing in this process is comparing the detected phenotype, the runtime object,

[00:13:49] Speaker 02:
with the existing stored phenotype.

[00:13:51] Speaker 02:
And that comparison alone, without any on-the-fly ranking, is going to enable you to draw a conclusion that this behavior is bad, or that this series of behaviors is so bad that we think it's probably this particular family of malware.

[00:14:07] Speaker 02:
And then you look to see whether that probability is high enough to trigger a content analysis.

[00:14:12] Speaker 02:
If those assessments of how likely the series of behaviors is to be malware could be calculated on the fly, one would expect to find some description of that in the intrinsic record.

[00:14:26] Speaker 02:
Instead, what you have is only the discussion of these predetermined collections of malicious behaviors, the phenotypes that the prosecution history says are created and ranked and that are then stored in the database.

[00:14:39] Speaker 01:
The word predetermined.

[00:14:41] Speaker 01:
applies to the collections that define each phenotype, right?

[00:14:47] Speaker 01:
Not the rankings.

[00:14:48] Speaker 02:
Correct, Your Honor.

[00:14:50] Speaker 02:
If the intrinsic record contained the phrase predetermined rankings, we probably wouldn't be here.

[00:14:55] Speaker 02:
The predetermined collections are part of the evidence that when taken together makes it unreasonable for the board to conclude that you can actually perform this ranking on the fly during the comparison in the claims at issue.

[00:15:10] Speaker 02:
I would like to reserve the rest of my time for rebuttal, Your Honors.

[00:15:13] Speaker 02:
Thank you.

[00:15:22] Speaker 05:
May it please the Court?

[00:15:23] Speaker 05:
I'd like to start with the questions from Judge Trontow and Chief Judge Prost.

[00:15:27] Speaker 05:
And the problem here, there was a lot of discussion of what's not in the specification.

[00:15:32] Speaker 05:
And the problem here is that there's really almost nothing in the specification about how this ranking works.

[00:15:38] Speaker 05:
It's not at all clear.

[00:15:39] Speaker 01:
Column 18 is not bad.

[00:15:41] Speaker 01:
I'm sorry, what's that?

[00:15:41] Speaker 01:
Column 18 is not bad in describing things.

[00:15:44] Speaker 05:
Well, I disagree with that.

[00:15:47] Speaker 05:
So I was looking at it this morning, and even the one time the word ranked is used in column 18, it doesn't seem to me to be talking about the ranking that Sophos is now talking about.

[00:16:01] Speaker 05:
It's talking about behaviors that may be ranked.

[00:16:05] Speaker 05:
And the behaviors of the genes,

[00:16:08] Speaker 05:
the smaller bits that are compiled.

[00:16:10] Speaker 01:
So I wasn't sure that word, you're looking at the same thing I am, that word that between behaviors and may felt to me like it was a typo and should be and.

[00:16:20] Speaker 05:
It should be?

[00:16:21] Speaker 05:
And.

[00:16:22] Speaker 05:
And.

[00:16:22] Speaker 05:
That may be right.

[00:16:29] Speaker 05:
But either way, I think that it's the behaviors

[00:16:35] Speaker 05:
that are being talked about in this sentence, that the individual behaviors within a phenotype and not separate phenotypes being ranked.

[00:16:43] Speaker 05:
There's no discussion in this specification at all of separate phenotypes being ranked.

[00:16:49] Speaker 05:
And so all we have after that is just the claim language itself.

[00:16:54] Speaker 05:
And the claim language itself talks about the ranking happening while it says,

[00:17:02] Speaker 05:
to create increasing levels of confidence that a runtime object is executing a behavior pattern comparable to a known family of malware.

[00:17:10] Speaker 05:
So within the claim itself, all we have is that it has to be relative to something that we wouldn't have known ahead of time.

[00:17:18] Speaker 05:
There wouldn't have been a runtime object ahead of time to compare to.

[00:17:22] Speaker 05:
So I think the specification is really of no help here.

[00:17:27] Speaker 05:
And similarly, I guess,

[00:17:29] Speaker 05:
Sofos talks about the scaled analysis also as potentially being relevant to the ranking and the scaled analysis that's also in column 18.

[00:17:41] Speaker 05:
And that also seems to me to be talking about an analysis within an individual phenotype of the genes within that phenotype, not comparing different phenotypes to each other.

[00:17:55] Speaker 05:
And furthermore, the specification

[00:17:59] Speaker 05:
does talk about how the phenotypes are designed to represent a family of malware.

[00:18:04] Speaker 05:
So it just doesn't make sense that you would rank them relative to each other when you already know that each one represents a family of malware.

[00:18:14] Speaker 03:
What about the language in the prosecution history that at least seems to indicate pretty clearly that the phenotypes are created and ranked at the same time?

[00:18:27] Speaker 05:
Also, I don't think it indicates that they're created and ranked at the same time.

[00:18:33] Speaker 05:
It indicates that they are created and they are ranked.

[00:18:37] Speaker 05:
And then it adds on the same language that's in the claim to create increasing levels of confidence that a runtime object is executing a behavior pattern comparable to a known family of malware.

[00:18:50] Speaker 05:
So it, again, is talking about

[00:18:53] Speaker 05:
runtime object that is executing some behavior that you wouldn't have known ahead of time.

[00:18:58] Speaker 03:
But it says a content analysis is then performed.

[00:19:02] Speaker 03:
So clearly they were talking about the phenotypes being created and ranked before the content analysis is performed, right?

[00:19:09] Speaker 05:
That's right.

[00:19:09] Speaker 05:
The content analysis is performed after, so that's the

[00:19:16] Speaker 05:
the triggering step.

[00:19:18] Speaker 05:
So you have the comparing step first, which is you see whether you're above this certain threshold of malicious behavior.

[00:19:26] Speaker 05:
And if you're above the threshold, then you do a deeper dive.

[00:19:30] Speaker 05:
You do a content analysis to see if you should be fixing something, stopping the program, something like that.

[00:19:39] Speaker 05:
So the point is that the content analysis isn't performed until after the comparing step is done.

[00:19:47] Speaker 03:
Right, so you're saying that the board actually made, reached the conclusion that it could not be beforehand.

[00:19:55] Speaker 05:
That's right.

[00:19:56] Speaker 05:
I think that is how the board's decision reads.

[00:20:00] Speaker 05:
I mean, certainly it's broad enough to include the present time, but it seems to more or less preclude the past.

[00:20:12] Speaker 01:
And that's the position you take in your green brief.

[00:20:16] Speaker 05:
That's right.

[00:20:16] Speaker 05:
And if you look at the board's decision, for example, at page 11 of the joint appendix, I guess the paragraph after the one you were talking about before, the third paragraph.

[00:20:32] Speaker 05:
Oh, I'm sorry.

[00:20:34] Speaker 05:
That's not the one I wanted to look at.

[00:20:36] Speaker 01:
Well, that middle paragraph on page 11 seems to me the statement of what it had in mind that this invention is about, and that's what you then

[00:20:46] Speaker 01:
defend it on.

[00:20:49] Speaker 05:
That's right.

[00:20:50] Speaker 05:
And the paragraph I meant to point to, I'm sorry, was on page 13 of the joint appendix where the board says in the full paragraph on that page, I guess the last sentence, it says the argument of patent owner that phenotypes are already ranked prior to the comparison does not make sense when the claim as a whole is read because the purpose of ranking the phenotypes is to assess the risk that the runtime object is malware.

[00:21:16] Speaker 05:
not to assess the risk that the predetermined phenotype is malware.

[00:21:20] Speaker 01:
Right, but I guess that strikes me as almost nonsensical.

[00:21:26] Speaker 01:
That is, if you had a library of ranked phenotypes, ranked according to just how bad the malware they might be like is, then the purpose of comparing the object, the runtime object, to that library is to figure

[00:21:46] Speaker 01:
out if it's like the really bad one or the not so bad one.

[00:21:51] Speaker 01:
That satisfies the purpose perfectly well.

[00:21:53] Speaker 05:
Well, there's nothing in the specification that says that different malware is better or worse than other malware.

[00:22:00] Speaker 05:
And I think that would be, as we put it on our brief, I think it would be pretty hard to say that.

[00:22:04] Speaker 05:
I mean, different types of malware do different harmful things.

[00:22:08] Speaker 05:
And the purpose is to figure out if the thing that you're looking at is any type of malware

[00:22:14] Speaker 05:
And if so, what family is it from?

[00:22:18] Speaker 05:
So the ranking ahead of time, I suppose potentially it could be ranked according to how bad the malware is ahead of time.

[00:22:30] Speaker 05:
But that seems like a very subjective judgment and would depend a lot on the user and what their preferences are.

[00:22:39] Speaker 05:
And regardless, you would want to be

[00:22:41] Speaker 05:
uh, combating any kind of malware that you've already determined is a virus.

[00:22:47] Speaker 01:
Well, but you might want to combat it in different ways.

[00:22:50] Speaker 01:
It doesn't the last element of the claim say something about taking some action, different actions, shut the thing down or keep going, but take care of it soon.

[00:23:03] Speaker 05:
Oh, right.

[00:23:03] Speaker 05:
Absolutely.

[00:23:03] Speaker 05:
But you want, but what you do depends on the family of malware and what it's sort of

[00:23:09] Speaker 05:
attack is.

[00:23:11] Speaker 05:
So you might want to shut down the program or you might want to... I mean, I don't think it is envisioning keeping going but ending soon, but certain types of malware might be affecting your hard drive and other types might be affecting your outlook contacts or sort of trying to

[00:23:33] Speaker 05:
figure out information about you.

[00:23:35] Speaker 05:
And so the reaction that you would have would be different.

[00:23:38] Speaker 05:
But I don't think it's because one's better and one's worse.

[00:23:41] Speaker 05:
It's because their route of attack is different.

[00:23:48] Speaker 05:
And like I said before, there's nothing in the specification to indicate what kind of ranking is happening.

[00:24:01] Speaker 05:
I agree that there's a lot of inference on the part of the board and on our part in terms of how this invention works.

[00:24:07] Speaker 05:
I don't think that should iner to the patentee's benefit that they fail to describe what's happening in the ranking step.

[00:24:17] Speaker 05:
If the court has no other questions, I'm happy to yield the rest of my time.

[00:24:21] Speaker 01:
Can I just ask, do you think it is open to us to decide whether your characterization

[00:24:30] Speaker 01:
of ranking as being a similarity distance, which also appears in the crucial paragraph on page 11 of the board's decision, is right or wrong?

[00:24:44] Speaker 05:
I think definitely the crux of Sophos's argument is when the timing of the ranking.

[00:24:55] Speaker 05:
They don't exactly dispute the

[00:25:00] Speaker 05:
the question of what is being ranked.

[00:25:03] Speaker 05:
But I think that's a hard question, because it is in some ways wrapped up in the timing question.

[00:25:19] Speaker 02:
OK.

[00:25:19] Speaker 02:
Your Honor, I would like to make three points that all relate to the important issues of claim construction methodology at the heart of this appeal.

[00:25:28] Speaker 02:
First, the parties agree.

[00:25:30] Speaker 02:
that this is not a situation where you have a plain meaning in the claim language and you're simply looking to see if the patentee can derogate from that through lexicography or disavowal.

[00:25:41] Speaker 02:
Rather, the parties agree, as the patent office says, that you need to draw some inferences here from the intrinsic record as a whole.

[00:25:48] Speaker 02:
If there's a 112 problem, that's not before the patent officer of this court in an IPR.

[00:25:55] Speaker 02:
One of the tools of construction that is valuable here is illustrated in the tuner processors case that the parties discussed in the briefing.

[00:26:02] Speaker 01:
Forget about the cases.

[00:26:03] Speaker 01:
Let's talk about the specifics here.

[00:26:06] Speaker 02:
Yes, Your Honor.

[00:26:08] Speaker 01:
Where in the patent is there a description of what exactly constitutes ranking?

[00:26:15] Speaker 01:
And does something in the patent describe identifying one phenotype in the library as

[00:26:25] Speaker 01:
in some way, I'm going to use better and worse to mean higher or lower on whatever the scale is, which I assume is implicit in ranking.

[00:26:34] Speaker 01:
So is there something that tells us that?

[00:26:37] Speaker 01:
I think Ms.

[00:26:37] Speaker 01:
Sylfan said there really isn't anything in the patent that does that.

[00:26:42] Speaker 01:
So when you try to figure out what it means, it's not a bad guess to say it's a similarity comparison.

[00:26:48] Speaker 02:
Your honor, there are two places in the patent

[00:26:51] Speaker 02:
that do not expressly define ranking, but give us a very strong indication of what a ranking is.

[00:26:57] Speaker 02:
The first is in the claim language.

[00:26:59] Speaker 02:
At appendix 61, column 24, the triggering step that begins at line 16, where we trigger a content analysis if we find a match.

[00:27:13] Speaker 02:
And the stored phenotype that is matched by the runtime object is, quote,

[00:27:18] Speaker 02:
one of the number of phenotypes having a predetermined level of confidence that the executing computer process contains a known family of malware.

[00:27:27] Speaker 02:
That level of confidence is a ranking.

[00:27:30] Speaker 02:
And we calibrate the system.

[00:27:32] Speaker 02:
It could be expressed in terms of a percentage.

[00:27:35] Speaker 02:
It could perhaps be a color-coded system.

[00:27:38] Speaker 02:
But the point is that this system is calibrated to a certain level of confidence.

[00:27:44] Speaker 02:
And then it's the ranking.

[00:27:45] Speaker 01:
That level of confidence is being applied to the runtime.

[00:27:48] Speaker 01:
object.

[00:27:49] Speaker 01:
So what in the patent describes what I took it to be your notion that the elements of the pre-existing library are ranked with respect to each other in some way?

[00:28:02] Speaker 02:
Yes.

[00:28:04] Speaker 02:
Your honor, they are ranked according to the level of confidence that that particular phenotype is an indication of malware.

[00:28:13] Speaker 02:
It doesn't mean, your honor, that there necessarily needs to be... Where does it say that?

[00:28:17] Speaker 02:
in this triggering limitation in the claim language, where the phenotypes have a level of confidence associated with them.

[00:28:26] Speaker 02:
It's not necessarily an ordinal ranking of one, two, three, four, five.

[00:28:30] Speaker 02:
It could be ranks like you might have in the military or on a yellow, orange, red.

[00:28:36] Speaker 01:
I think you said you had two things.

[00:28:38] Speaker 01:
Yes.

[00:28:40] Speaker 02:
Your Honor, the second is in the example from the specification that I previously read, which

[00:28:47] Speaker 02:
gives us information when we find a match, like accessing the registry in this location is bad, or this process is exhibiting the same behavior as the family of malware config.

[00:28:59] Speaker 02:
You can look at those assessments of you.

[00:29:01] Speaker 02:
This is bad.

[00:29:03] Speaker 02:
It's being a type of ranking.

[00:29:04] Speaker 02:
It could be translated more precisely into a percentage level of probability that we have malware when a runtime object is trying to perform that behavior.

[00:29:16] Speaker 02:
By the same token, when you detect a series of behaviors, a phenotype, and you say, aha, this is a dead ringer for Conficker, that is itself a ranking in the sense that you're getting a level of confidence from that that it's malware.

[00:29:30] Speaker 03:
One last question.

[00:29:31] Speaker 03:
Yes, Your Honor.

[00:29:32] Speaker 03:
Is there a relationship between the is stored language in the monitoring step and the are ranked language that we're talking about here?

[00:29:40] Speaker 02:
Yes, Your Honor, there is.

[00:29:41] Speaker 02:
And that's where the parallel to the tuna processors case comes in.

[00:29:45] Speaker 02:
We have the advantage in this claim language of having a very, very similar grammatical structure in the monitoring step.

[00:29:55] Speaker 02:
It talks about comparing an operation with a predetermined behavior referred to as a gene, just like we saw with phenotypes in the comparing step.

[00:30:03] Speaker 02:
And then in column 23, line 67, the patent says, where the gene is stored for reference,

[00:30:09] Speaker 02:
in a database and wherein the gene relates to at least one of several activities.

[00:30:15] Speaker 02:
And we see this exact same grammatical structure that's used in the comparing step being used in the monitoring step and clearly referring to actions that occurred in the past is stored or to present characteristics of the gene that were attributed to it before the monitoring step was performed.

[00:30:38] Speaker 02:
And therefore, we have

[00:30:40] Speaker 02:
we have a parallel structure to which we can connect the grammar in the comparing step.

[00:30:45] Speaker 02:
And therefore, the context of the claim language gives us a very strong indication that the phenotypes must be ranked before the claim comparison.

[00:30:54] Speaker 02:
And Your Honor, this is where the important claim construction methodology comes in.

[00:30:59] Speaker 02:
In the court's recent decision in M. Ray Smith International, the court said in determining whether the patent office's construction is reasonable, you don't just ask,

[00:31:08] Speaker 02:
does the specification preclude this construction?

[00:31:12] Speaker 02:
You don't even just ask, is the patent novice's construction not inconsistent with the specification?

[00:31:18] Speaker 02:
Rather, you need to say, is the construction consistent with the specification in that?

[00:31:23] Speaker 02:
Does it correspond to how the inventor described the operation of the invention in the patent?

[00:31:30] Speaker 02:
In your honors, in this case, it is only Sophos's construction that meets that task.

[00:31:35] Speaker 02:
We therefore ask you,

[00:31:37] Speaker 02:
to vacate the final written decision and remand for application of the correct construction to the prior art.

[00:31:43] Speaker 02:
Thank you, Your Honor.

[00:31:44] Speaker 04:
Thank you.

[00:31:44] Speaker 04:
We thank both sides of the cases submitted.

[00:31:46] Speaker 04:
That concludes our proceedings.

[00:31:49] Speaker 03:
All rise.