Ao Kaspersky Lab v. Open Text Inc

1. Case Identification

• Case #: IPR2024-00292
• Patent #: 8,201,243
• Filed: December 8, 2023
• Petitioner(s): AO Kaspersky Lab
• Patent Owner(s): Open Text Inc.
• Challenged Claims: 1-14

2. Patent Overview

• Title: Systems and Methods for Identifying an Origin of Pestware Activity
• Brief Description: The ’243 patent discloses methods for identifying the source of pestware on a computer by monitoring computer activity, identifying a suspected pestware object, tracing the object to an externally networked source, and reporting that source to a research entity.

3. Grounds for Unpatentability

Ground 1: Claims 1-7 and 9-14 are obvious over Williamson in view of Piccard

• Prior Art Relied Upon: Williamson (Patent 8,719,924) and Piccard (Application # 2007/0016951).
• Core Argument for this Ground:
  • Prior Art Mapping: Petitioner asserted that Williamson taught a behavior-based malware detection system using a kernel driver to monitor API calls and a heuristic engine to analyze activity against weighted factors. However, Williamson lacked a mechanism for identifying the external origin of the malware. Piccard allegedly supplied this missing element by teaching the use of history logs (e.g., web browser history) to identify the external source (e.g., a website) from which malware was downloaded and reporting this source to a remote host computer for analysis. For dependent claims, Piccard was cited for disclosing source identification via IP address or URL and the use of logs like browser history and cache.
  • Motivation to Combine: A POSITA would combine Piccard with Williamson to improve Williamson’s system. Williamson’s method of detecting malware by observing its behavior requires letting the malicious code run, which endangers the computer. Piccard’s approach of identifying the source would allow for proactive blocking and would also provide a continuous stream of new malware source data to improve the training and classification ability of Williamson’s heuristic engine.
  • Expectation of Success: Petitioner argued a POSITA would have a reasonable expectation of success, as the combination required predictable software modifications to integrate Piccard's known source-identification techniques into Williamson's known detection architecture.

Ground 2: Claims 1-14 are obvious over Kidron in view of Williamson and Piccard

• Prior Art Relied Upon: Kidron (Patent 7,934,103), Williamson (Patent 8,719,924), and Piccard (Application # 2007/0016951).
• Core Argument for this Ground:
  • Prior Art Mapping: Petitioner alleged Kidron taught a network-based system where local machines monitor for irregular behavior and report to a central server for analysis and countermeasure deployment. Williamson allegedly improved upon Kidron by teaching a more robust, local heuristic analysis using weighted factors, which would not be dependent on network connectivity or delays from central server analysis. Piccard, as in Ground 1, added the capability to trace the identified pestware back to its specific external origin (e.g., a URL) and report it to a research entity.
  • Motivation to Combine: A POSITA would combine Williamson with Kidron to improve the speed and resilience of malware detection, allowing each local machine to perform its own sophisticated heuristic analysis without relying solely on a central server. A POSITA would then add Piccard’s teachings to this enhanced system to provide the crucial, missing capability of identifying and reporting the ultimate source of the malware, allowing for more effective countermeasures like blocking malicious websites enterprise-wide.
  • Expectation of Success: The combination was presented as an integration of known security techniques into a single, more effective system, which would have been a predictable implementation for a POSITA.

4. Key Claim Construction Positions

• Petitioner proposed that the Board adopt the claim constructions from the parallel district court litigation for the purposes of the IPR.
• This includes construing "pestware" as "a trojan, spyware, adware, or malware program that collects information about a person or an organization" and applying the plain and ordinary meaning to all other contested terms.

5. Arguments Regarding Discretionary Denial

• §314(a) (Fintiv): Petitioner argued against discretionary denial, asserting that the parallel litigation is in its early stages with minimal discovery completed. Petitioner further argued that the district court trial date was recently postponed and is now close to the Final Written Decision deadline, and there is limited overlap in prior art, as Williamson, Piccard, and Kidron were not previously raised in the district court proceedings.
• §325(d) (Advanced Bionics): Petitioner contended that denial is inappropriate because the petition relies on new prior art references and combinations that were never considered or applied by the Examiner during prosecution. Because the asserted grounds are materially different from what the USPTO previously reviewed, Petitioner argued the Advanced Bionics framework favors institution.
• General Plastic Factors: Petitioner argued against denial based on other pending IPRs against the ’243 patent. Petitioner asserted it is a different entity from the petitioners in the other IPRs, there was no coordination, and the prior art and arguments asserted are different, thus weighing against denial.

6. Relief Requested

• Petitioner requested the institution of an inter partes review and the cancellation of claims 1-14 of the ’243 patent as unpatentable.