Commerce Bancshares, Inc.v.Intellectual Ventures II LLC

Patent Trial and Appeal Board

Dec 1, 2014

10108078 (P.T.A.B. Dec. 1, 2014)

Trials@uspto.gov Paper 7
Tel: 571-272-7822 Entered: December 1, 2014
UNITED STATES PATENT AND TRADEMARK OFFICE

BEFORE THE PATENT TRIAL AND APPEAL BOARD

COMMERCE BANCSHARES, INC., COMPASS BANK, and FIRST
NATIONAL BANK OF OMAHA,
Petitioners,
v.
INTELLECTUAL VENTURES II LLC,
Patent Owner.

Case IPR2014-00793
Patent 6,715,084 B2

Before KRISTEN L. DROESCH, JENNIFER S. BISK, and
JUSTIN BUSCH, Administrative Patent Judges.
BISK, Administrative Patent Judge.
DECISION
Denying Institution of Inter Partes Review
37 C.F.R. § 42.108

INTRODUCTION
A. Background
Commerce Bank, Commerce Bancshares, Inc., and First National
Bank of Omaha (collectively, “Petitioner”) filed a Petition (Paper 1, “Pet.”)
requesting an inter partes review of claims 1–10 and 12–33 (the “challenged
claims”) of U.S. Patent No. 6,715,084 B2 (Ex. 1001, “the ’084 patent”).
Case IPR2014-00793
Patent 6,715,084 B2
2
Intellectual Ventures II LLC (“Patent Owner”) filed a Preliminary Response.
Paper 6 (“Prelim. Resp.”).
We have authority to determine whether to institute an inter partes
review. 35 U.S.C. § 314(b); 37 C.F.R. § 42.4(a). The standard for
instituting an inter partes review is set forth in 35 U.S.C. § 314(a), which
provides that an inter partes review may not be instituted “unless the
Director determines . . . there is a reasonable likelihood that the petitioner
would prevail with respect to at least 1 of the claims challenged in the
petition.”
After considering the Petition and Preliminary Response, we
determine that Petitioner has not established a reasonable likelihood of
prevailing on any of the claims challenged in the Petition. Accordingly, we
do not institute an inter partes review.
B. Related Matters
Prior to filing this Petition, two other Petitions challenging the ’084
patent were filed by International Business Machines Corporation
(“IBM”)—IPR2014-00681, Paper 4 and IPR2014-00682, Paper 4. We
denied an inter partes review in IPR2014-00681 (Paper 11) and instituted an
inter partes review of claims 26, 28, and 30–33 in IPR2014-00682 (Paper
11). Petitioner has also filed another Petition challenging the ’084 patent—
IPR2014-00801, Paper 1.
Petitioner indicates that the ’084 patent is the subject of concurrent
proceedings in various district courts, several of which name one or more of
the named petitioners as a defendant. See Pet. 1–2; Paper 5.
Case IPR2014-00793
Patent 6,715,084 B2
3
C. The ’084 Patent
The ’084 patent relates to network-based intrusion detection systems.
Ex. 1001, 1:7–10. Intrusion detection systems are used to determine that a
breach of computer security—access to computer resources by an
unauthorized outsider—has occurred, is underway, or is beginning. Id. at
3:38–49. Conventional intrusion detection products and services are based
on specialized equipment located on a customer’s premises and are directed
to the analysis of a single customer’s data. Id. at 4:51–67. These systems
may produce false alarms and are often unable to detect the earliest stages of
network attacks. Id. In contrast, the broad-scope intrusion detection system
of the ’084 patent analyzes the traffic coming into multiple hosts or other
customers’ computers or sites, providing additional data for analysis, and
consequently, the ability to recognize intrusions that would otherwise be
difficult or impossible to diagnose. Id. at 5:44–56.
As described, one embodiment of the broad-scope intrusion detection
system monitors the communications on a network or on a particular
segment of the network by a data collection and processing center coupled to
the network. Id. at 7:18–24; 7:31–35. Because the data collection and
processing center gathers information from multiple network devices,
including potentially multiple customers, it has access to a broader scope of
network activity. Id. at 8:13–21. This additional data allows for the
recognition of additional patterns of suspicious activity beyond those
detectable with conventional systems. Id. at 8:21–22.
To detect intrusions, the ’084 patent describes one technique of
collecting suspicious network traffic events, forwarding those events to a
central database and analysis engine, and then using pattern correlations to
Case IPR2014-00793
Patent 6,715,084 B2
4
determine suspected intrusion-oriented activity. Id. at 8:23–31. Upon
detection of suspected malicious activity, adjustments to devices such as
firewalls can be made to focus sensitivity on attacks from suspected sources
or against suspected targets. Id. at 8:31–35; 10:49–67. In addition, if any
intrusions or attempted intrusions have been detected, alerts can be sent both
to the system to which the suspicious communication was directed and also
to systems that have not yet received the communication. Id. at 11:54–12:4.
D. Illustrative Claims
Of the challenged claims in the ’084 patent, claims 1, 9, 19, and 26 are
independent. Claims 1 and 26 are illustrative and recite:
1. A method of alerting at least one device in a networked
computer system comprising a plurality of devices to an anomaly,
at least one of the plurality of devices having a firewall,
comprising:
detecting an anomaly in the networked computer system using
network-based intrusion detection techniques comprising
analyzing data entering into a plurality of hosts, servers, and
computer sites in the networked computer system;
determining which of the plurality of devices are anticipated to be
affected by the anomaly by using pattern correlations across the
plurality of hosts, servers, and computer sites; and
alerting the devices that are anticipated to be affected by the
anomaly.
26. A data collection and processing center comprising a computer
with a firewall coupled to a computer network, the data collection
and processing center monitoring data communicated to the
network, and detecting an anomaly in the network using network-
based intrusion detection techniques comprising analyzing data
entering into a plurality of hosts, servers, and computer sites in the
networked computer system.
Case IPR2014-00793
Patent 6,715,084 B2
5
E. Asserted Prior Art
Petitioner relies upon the following prior art references as its basis for
challenging claims 1–10 and 12–33 of the ’084 patent.1
Reference Patents/Printed Publications Exhibit
Porras Phillip A. Porras & Alfonso
Valdes, Live Traffic Analysis of
TCP/IP Gateways, Proceedings of
the 1998 ISOC Symposium on
Network and Distributed Sys.
Security (Dec. 12, 1997)
Ex. 1004 (“Porras”)
Graham U.S. Patent No. 7,237,264 Ex. 1005 (“Graham”)
F. The Asserted Grounds of Unpatentability
Petitioner contends that the challenged claims are unpatentable under
35 U.S.C. §§ 102 and/or 103 based on the following grounds (Pet. 4):
Statutory Ground Basis Challenged Claims
§ 102(b) Porras 1–9 and 12–18
§ 103 Porras 10
§ 103 Porras and Graham 1–9 and 12–33
ANALYSIS
A. Real Party-In-Interest
Patent Owner asserts that the Petition should be denied for failing to
name all real parties-in-interest, as required by 35 U.S.C. § 312(a)(2).
Prelim. Resp. 4–8. Specifically, Patent Owner contends that Petitioners
failed to name both Banco Bilbao Vizcaya Argentaria, S.A. (BBVA) (id. at
4–6) and IBM (id. at 6–8) as real parties-in-interest.
Patent Owner asserts that BBVA is a real party-in-interest because it
owns and controls BBVA Compass Bancshares, Inc. (“BBVA Compass”),

1 Petitioner also proffers the Declaration of Dr. George Kesidis. See Ex.
1003.
Case IPR2014-00793
Patent 6,715,084 B2
6
one of the identified real parties-in-interest. Id. at 4. Patent Owner argues
that BBVA Compass has admitted that it is controlled by BBVA, and
admitted that BBVA serves as a source of strength and capital to BBVA
Compass. Id. at 5 (citing Ex. 2001, 28, 30).
Patent Owner asserts that IBM is a real party-in-interest because IBM
entered (with the parties named as petitioners in this case) a “Common
Interest and Confidentiality Agreement” purportedly containing “strategies
of attorneys jointly defending cases against” Patent Owner. Id. at 7 (citing
Ex. 2003, 1). IBM is not a named defendant in the district court cases
involving the ’084 patent. Thus, according to Patent Owner, the existence of
this agreement, between IBM and other named defendants to the district
court case, “is compelling circumstantial evidence that an agreement to
defend and/or indemnify [Petitioner] likely exists.” Id. at 7–8.
Whether a party who is not a named participant constitutes a real
party-in-interest to a proceeding is a highly fact-dependent question. Office
Patent Trial Practice Guide, 77 Fed. Reg. 48,756, 48,759 (Aug. 14, 2012)
(citing Taylor v. Sturgell, 553 U.S. 880 (2008); 18A Charles Alan Wright,
Arthur R. Miller & Edward H. Cooper, Federal Practice & Procedures
§§ 4449, 4451 (2d ed. 2011)). The Office Patent Trial Practice Guide
provides guidance regarding factors to consider in determining whether a
party is a real party-in-interest. Id. One important consideration is whether
a non-party exercises, or could have exercised, control over a party’s
participation in the proceeding. Id. An example justifying the real party-in-
interest label is a party that funds, directs, and controls an IPR petition or
proceeding. Id. at 48,760.
Case IPR2014-00793
Patent 6,715,084 B2
7
Patent Owner’s evidence does not demonstrate sufficiently that
BBVA or IBM exercised, or could have exercised, control over the filing of
this Petition. Likewise, Patent Owner’s evidence does not demonstrate
sufficiently that BBVA or IBM funded, directed, and controlled the filing of
this Petition.
Based on the record before us, Patent Owner does not provide a
sufficient factual basis to conclude that BBVA or IBM should have been
identified as a real party-in-interest. Accordingly, we do not deny the
Petition for failure to identify all real parties-in-interest under 35 U.S.C.
§ 312(a)(2).
B. Claim Construction
Petitioner proposes interpretations for “an anomaly in the network,”
“network-based intrusion detection techniques,” “alerting the device/alerts
the device,” and “adjusting the firewall/controlling the device.” Pet. 7–9.
Patent Owner disputes Petitioner’s analysis and provides its own
interpretations for “anomaly,” “determining which of the plurality of devices
are anticipated to be affected by the anomaly,” and “alert [-ing/-s] the
device.” Prelim. Resp. 11–16. Of these terms, we consider it necessary, for
purposes of this decision, to construe the terms “anomaly” and “determining
which . . . are anticipated to be affected by the anomaly.” None of the
remaining terms requires an express construction at this time.
1. “anomaly”
Petitioner proposes that “an anomaly in the network” be construed as
“an irregularity in the network indicative of misuse of network systems or
resources.” Pet. 8. Patent Owner disagrees, arguing that the inclusion of
Case IPR2014-00793
Patent 6,715,084 B2
8
“indicative of misuse of network systems or resources” does not comport
with the broadest reasonable construction of the term. Prelim. Resp. 11.
We agree that Petitioner’s construction of this term is not the broadest
reasonable construction. Instead, the Specification supports a construction
using the plain and ordinary meaning of anomaly—a departure from the
usual or expected; an abnormality or irregularity. See Ex. 2004 (defining
anomaly as a “departure from the regular arrangement, general rule, or usual
method; abnormality”). For example, the ’084 patent states that “[a]nomaly
detection systems look for statistically anomalous behavior . . . [s]tatistical
scenarios can be implemented for user, dataset, and program usage to detect
‘exceptional’ use of the system.” Ex. 1001, 3:54–57.
2. “determining which of the plurality of devices are anticipated
to be affected by the anomaly”
Petitioner does not propose explicitly a construction for “determining
which of the plurality of devices are anticipated to be affected by the
anomaly” (“the determining limitation”).2 Patent Owner proposes that the
broadest reasonable construction is “deciding or ascertaining which devices
are expected or foreseen to be affected by the detected anomaly.” Prelim.
Resp. 13–15. Patent Owner bases this construction on dictionary definitions
of “determine” and “anticipate.” Id. at 13 (citing Exs. 2007, 2008 (defining
determine as “to set limits to; bound; define . . . to reach a decision about

2 This language is recited by claim 1. Claim 9 has a similar limitation,
“determining a device that is anticipated to be affected by the anomaly,” as
does Claim 19, “determining which of the devices are anticipated to be
affected by the anomaly.” Claim 26 does not include the determining
limitation, but claim 29, dependent from claim 26, recites, “adjusts a firewall
of a plurality of devices . . . that is anticipated to be affected by the
anomaly.”
Case IPR2014-00793
Patent 6,715,084 B2
9
after thought and investigation; decide upon”)); id. at 14 (citing Exs. 2009,
2010 (defining anticipate as “to . . . expect . . . to foresee (a command, wish,
etc.) and perform in advance”)).
Patent Owner’s proposed construction is consistent with the
Specification. For example, the Specification states that “[a]n anomaly is
detected in the computer system, and then it is determined which device[] or
devices are anticipated to be affected by the anomaly in the future. These
anticipated devices are then alerted to the potential for the future anomaly.”
Ex. 1001, 5:57–65. Although the Specification also states that “the devices
are polled in a predetermined sequential order, and a device anticipated to be
affected by the anomaly is a device that has not been polled,” the ’084 patent
does not clearly depart from the plain and ordinary meaning and redefine
“anticipated to be affected” to be equivalent to devices that have not been
polled. Id. at 5:66–6:2; see also Fig. 5, 10:65–11:9 (using language—“hosts
. . . that have not yet been hit by the intrusion attempt”—consistent with the
plain language of the determining limitation).
In keeping with the broadest reasonable interpretation that is
consistent with the Specification, we construe the determining limitation to
mean deciding or ascertaining which devices are expected or foreseen to be
affected by the anomaly.
C. The Asserted Grounds
1. Anticipation by Porras (Ex. 1004)
Petitioner challenges claims 1–9 and 12–18 as anticipated by Porras.
Pet. 11–27. With respect to the determining limitation, required by all these
claims, Petitioner points to Porras’s disclosure that “gateway monitors may
‘report, in series, suspicious activity . . . [s]uch reports could lead to
Case IPR2014-00793
Patent 6,715,084 B2
10
enterprise-layer responses or warning to other domains that have not yet
experienced or reported the session anomalies.’” Pet. 13 (quoting Ex. 1004,
10), 17–18. Petitioner also points to language in Porras stating that “results
correlation enables the detection of spreading attacks against a common
service, which first raise alarms in one domain, and gradually spread domain
by domain.” Id. According to Petitioner, Porras “thus discloses [the
determining limitation].” Pet. 13 (citing Ex. 1003 ¶¶ 75–76). Neither
Petitioner, nor the testimony of Dr. Kesidis that Petitioner points to, explains
anything more about how these portions of Porras disclose the determining
limitation. Pet. 13, 17–18; Ex. 1003 ¶¶ 75–76.
Patent Owner asserts that Petitioner does not sufficiently show that
Porras discloses the determining limitation. Prelim. Resp. 24–26. We agree
with Patent Owner that the cited portion of Porras expressly states that
warnings are sent to domains that have not yet experienced the anomaly.
This disclosure indicates that Porras must determine which devices have
been affected by the attack to differentiate the domains that have not been
affected from those that have. We are not persuaded, however, that Porras
discloses determining which of the devices are expected to be affected by the
attack.
We have reviewed the rest of the portions of Porras relied upon by
Petitioner (Pet. 17–18), and we are not persuaded that any of them disclose
the determining limitation. Nor does Petitioner point to persuasive evidence
that the determining limitation is inherently disclosed by Porras. Thus, we
deny Petitioner’s challenge that Porras anticipates claims 1–9 and 12–18.
Case IPR2014-00793
Patent 6,715,084 B2
11
2. Obviousness Over Porras
Petitioner challenges claim 10 as obvious over Porras. Pet. 27–29.
Claim 10 recites:
10. The method of claim 9, wherein the plurality of devices are polled
in a predetermined sequential order, the first device being polled prior
to detecting the anomaly, and the device anticipated to be affected by
the anomaly is a device that has not been polled.
Petitioner does not assert that Porras explicitly discloses polling the plurality
of devices “in a predetermined sequential order.” Id. Instead, Petitioner
relies on Porras’s disclosure that enterprise-level modules may receive
reports “in series” from surveillance modules. Id. at 28 (citing Ex. 1004,
10).
Petitioner asserts that polling surveillance modules, as recited in claim
10, would be an obvious design choice for gathering information in order to
detect anomalies. Id. (citing Ex. 1003 ¶ 128). Specifically, Dr. Kesidis
testifies that polling surveillance modules in a sequence would be only one
of two choices for gathering information (the other method being “the
devices push information to the enterprise surveillance module”). Ex. 1003
¶ 128. Dr. Kesidis further states that “if this obvious design choice to use
polling was implemented, devices that are ‘anticipated to be affected’ . . .
would be devices in domains that had not yet been polled.” Id.
Dr. Kesidis’s assertion that polling in a predetermined sequential
order is one of only two design choices does not cite to any objective
evidence, but simply concludes that this is so. For that reason, this
testimony is not persuasive. Even if we were persuaded that this limitation
was an obvious design choice, however, we are not persuaded by
Petitioner’s conclusion that polling leads to the determination of devices that
Case IPR2014-00793
Patent 6,715,084 B2
12
are “anticipated to be affected.” We agree with Patent Owner that Petitioner
does not explain how polling in this manner leads to determining “a device
that is anticipated to be affected by the anomaly.” Prelim. Resp. 36–38.
Instead, Petitioner seems to define two types of devices—those that have
been polled and those that have not—and defines summarily those that have
not been polled as being “anticipated to be affected.” Pet. 28; Ex. 1003
¶ 128. It is not clear that all devices that have not been polled are those
devices that are expected or foreseen to be affected by the anomaly, and thus
Petitioner has not shown that identifying devices that have not been polled
meets the determining limitation as we have construed it.
Thus, we conclude that Petitioner has not shown a reasonable
likelihood of prevailing on the ground that claim 10 would have been
obvious over Porras.
3. Obviousness over Porras and Graham (Ex. 1005)
Petitioner challenges claims 1–9 and 12–33 as obvious over Porras
and Graham. Pet. 29–60. Petitioner maintains that Porras discloses all the
limitations of these claims, but concedes that Porras “does not describe in as
much detail as Graham how to anticipate that a device may be affected.”
Pet. 32. Petitioner asserts that “[a] person of ordinary skill in the art would
have been motivated to combine the domain-level architecture and intrusion
detection techniques of Graham with the enterprise-level, hierarchical
intrusion detection techniques of [Porras] in order to obtain the results
claimed in the ’084 patent.” Pet. 31 (citing Ex. 1003 ¶¶ 129–35).
Patent Owner argues that Petitioner did not provide sufficient
articulated reasoning with some rational underpinning to support the legal
conclusion of obviousness. Prelim. Resp. 39 (citing KSR Int’l v. Teleflex
Case IPR2014-00793
Patent 6,715,084 B2
13
Inc., 550 U.S. 398, 418 (2007)). Instead, according to Patent Owner,
Petitioner devotes the majority of its argument to showing the references are
analogous and provides only “two conclusory statements parroting
exemplary rationales from the MPEP.” Prelim. Resp. 39.
We agree with Patent Owner that Petitioner’s stated rationale is not
sufficiently specific. First, the detailed argument asserting that the prior art
references are analogous art (Pet. 30–31; Ex. 1003 ¶¶ 129–131) does not
suffice as an articulated reason with a rational underpinning to combine
specific teachings in the references as is required for a showing of
obviousness. See KSR, 550 U.S. at 418.
Further, Petitioner’s rationale that a skilled artisan would have
combined the two references “in order to obtain the results claimed in the
’084 patent” explicitly relies on the invention itself as the reason for the
combination. Pet. 31. Petitioner points to testimony of Dr. Kesidis that is
slightly more detailed, but the testimony does not persuade us that Petitioner
has shown a reasonable likelihood of prevailing on this issue. Specifically,
Dr. Kesidis states that a skilled artisan would have looked to both Porras and
Graham “as these references both sought to remedy the same problem,”
including “the issue of prior art systems that created ‘false positive’ results
due to having insufficient information.” Ex. 1003 ¶ 132. Dr. Kesidis also
asserts that “there was a design need or market pressure to solve a problem
and a finite number of identified, predictable solutions” such that the
combination of Porras and Graham “would have yielded the methods and
systems claimed in the ’084 patent.” Id. ¶ 134. Dr. Kesidis, however, does
not provide support for his conclusions with persuasive explanation or
citation to objective evidence. For example, Dr. Kesidis asserts that at the
Case IPR2014-00793
Patent 6,715,084 B2
14
time of the invention there was “a finite number of identified, predictable
solutions” to the problem of “false positives.” Ex. 1003 ¶ 134; see id. ¶ 132.
Dr. Kesidis, however, does not refer to evidence explaining how many
solutions were available, what those solutions were, or specifically why a
skilled artisan would have chosen the solutions disclosed in Porras and
Graham to solve the relevant problem.
Because we are not persuaded that Petitioner’s proffered rationale to
combine Porras and Graham is based on anything other than hindsight, we
are not persuaded that Petitioner has established that there is a reasonable
likelihood that claims 1–10 and 12–33 are unpatentable as obvious over
Porras and Graham.
CONCLUSION
For the foregoing reasons, we determine that Petitioner has not shown
a reasonable likelihood that it would prevail in demonstrating that any of the
challenged claims of the ’084 patent are unpatentable on at least one
challenged ground.
ORDER
ORDERED that an inter partes review of U.S. Patent No. 6,715,084 is
not instituted based on this Petition.

Case IPR2014-00793
Patent 6,715,084 B2
15
PETITIONERS:
Robert M. Evans, Jr.
Marc Vander Tuig
SENNIGER POWERS LLP
revans@senniger.com
mvandertuig@senniger.com

Geoffrey K. Gavin
JONES DAY
ggavin@jonesday.com

Jason S. Jackson
KUTAK ROCK
jason.jackson@kutarock.com

PATENT OWNER:

Jonathan M. Strang
Lori A. Gordon
STERNE, KESSLER, GOLDSTEIN & FOX P.L.L.C.
jstrang-PTAB@skgf.com
lgordon-PTAB@skgf.com

Donald J. Coulman
INTELLECTUAL VENTURES MANAGEMENT
dcoulman@intven.com