CrowdStrike Inc v. Taasera Licensing LLC

1. Case Identification

• Case #: IPR2023-01465
• Patent #: 8,850,517
• Filed: October 19, 2023
• Petitioner(s): CrowdStrike, Inc.
• Patent Owner(s): Taasera Licensing LLC
• Challenged Claims: 1-24

2. Patent Overview

• Title: Method and System for Assessing Runtime Risk for an Application Program
• Brief Description: The ’517 patent is directed to methods and systems for detecting computer security risks, including advanced persistent threats, by using behavioral analysis. The technology assesses the runtime risk of an application by monitoring sequences of actions and identifies a behavior score based on that risk.

3. Grounds for Unpatentability

Ground 1: Obviousness over Wright in view of Daswani - Claims 1-24 are obvious over Wright in view of Daswani under 35 U.S.C. §103.

• Prior Art Relied Upon: Wright (Application # 2011/0023115) and Daswani (Patent 8,806,647).
• Core Argument for this Ground:
  • Prior Art Mapping: Petitioner argued that Wright discloses the core framework of the challenged claims. Wright teaches a method for assessing runtime risk by monitoring user interactions and code operations (termed "behavioral genes" and "code genes") and comparing them against a database of predetermined malicious patterns (termed "phenotypes"). This system includes a "behavior monitor" (runtime monitor), a "behavior gene database" (rules database), and a "phenotype database" (policy database). Wright's "genes" are rules identifying action sequences composed of user, application, and system actions. Petitioner asserted that while Wright teaches ranking these phenotypes to create "levels of confidence" about malicious activity, Daswani provides the specific mechanism for calculating a "behavior score." Daswani teaches a probabilistic scoring method for analyzing application behaviors, classifying them as "hard signals" (likely malicious) or "soft signals" (malicious in context), and combining them to calculate an overall "probability of maliciousness." Petitioner contended this probabilistic score from Daswani directly corresponds to the "behavior score" limitation in the ’517 patent claims.
  • Motivation to Combine: A Person of Ordinary Skill in the Art (POSITA) would combine the teachings of Wright and Daswani to improve Wright's malware detection system. Both references address the same problem of identifying malware through behavioral analysis. Wright discloses a system that ranks behaviors to create "levels of confidence" but is less specific on the scoring methodology. Daswani provides a sophisticated and flexible probabilistic scoring method that could be readily integrated into Wright's framework. A POSITA would have been motivated to incorporate Daswani's specific use of "hard" and "soft" signals and its probabilistic calculations to enhance the accuracy of Wright's system, improve its ability to create confidence levels, and minimize false positives.
  • Expectation of Success: A POSITA would have had a reasonable expectation of success in combining the references. The integration would involve applying Daswani's probabilistic signal analysis (hard and soft signals) to Wright's disclosed "behavioral genes" and "code genes." Petitioner argued this would be a straightforward application of a known scoring technique to an existing, compatible analysis framework, requiring only minimal experimentation to achieve a predictable improvement in risk assessment.

4. Arguments Regarding Discretionary Denial

• Petitioner argued against discretionary denial under both §314(a) (Fintiv) and §325(d).
• Fintiv (§314(a)): Petitioner asserted that although parallel litigation exists, it is part of a Multidistrict Litigation (MDL) proceeding. The scheduled trial date in the MDL court does not apply to this specific case, which must be remanded to its originating court for trial, making the actual trial date uncertain and likely to occur well after a Final Written Decision (FWD) in this IPR. Further, Petitioner stipulated that if the IPR is instituted, it will not pursue any invalidity ground in the district court that utilizes either Wright or Daswani, thereby eliminating any overlap of issues.
• §325(d): Petitioner contended that denial is unwarranted because the primary prior art references, Wright and Daswani, were never cited or considered during the original prosecution of the ’517 patent. Petitioner argued these references are materially different from the art previously considered by the examiner because they teach key limitations, such as the "runtime monitor including a processing device" and a risk assessment based on an "action sequence," which were central to the patent's allowance.

5. Relief Requested

• Petitioner requests institution of an inter partes review and cancellation of claims 1-24 of Patent 8,850,517 as unpatentable.