good morning i'd like to address several errors that we believe part of claim construction from the decision of the board the first one i like to address deals with the construction of the term application community that was actually construed by the board as members of a community running the same program or a selected portion of the program we thought it was pretty clear that program refers to the program in the body of the claim which is used throughout the body of the claimant because that's what is being modeled and monitored the p tab so very narrowly both right and i think it is i think you can tell that it is in the following way which is there's no dispute about the scope of the content of the prior art not arguing about that issue at all it's literally a question issue is that if the term program is understood to mean as in the body of the claim the program that is being monitored claim one i think is representative it's a method of detecting anomalous program you notify an application community of the anonymous function call and it's in that context that you have the definition of an application community members of the community running the same program  or selected portions of the program it seems to me that that's part of the spec that it defines and if you point to as defining application community it defines more community as opposed application i think it does both i believe the passage if you're referring to is at cause i'm seven as we call them six excuse me out lines thirty one to forty seven and to look at the language i think that pretty clearly demonstrates that the application that's in the application community is essentially the program that's being referred to in the body of the claims so let's look at that language it says in column six of that passage models are shared among many members of the of a community running the same application refer to as an application community for example instead of running up a chick super application for days at a single site according to various embodiments style dozens of replicated applications can be one for short periods of time and the models created based on this tributed data can be shared that is exactly talking about the use of a distributed application community that engages in this process of creating models and of using models to look for anomalous function calls and that was on to say while only a portion of each application instance may be monitored for example the entire software body can be monitored across the entire community this is talking about the concept of monitoring and modeling and using an application  to solve a problem in the prior art which was there's a lot of computing power that's required to create these models but what if we in fact use an application community to monitor of the program or parts of a program it completely makes the claim almost uncomprehensible if the word program in the claim can be a worm because then you would have a claim that would read on detecting anomalous executions thirty nine right right let me briefly attack that so this deals with whether clothes on and dissipates and what is very unusual about the novices here is that there's no argument about because on invention is because i'm basically looks at a model created using a static picture of the program code u k and it is doing what's called anomaly detection it's trying to determine what's different from the normal and i think incorrect about the board's decision is that it took a passage from the background section on a prior art method under of the prior art misuse detection systems may miss for example slight variations of known mc malicious code that new previously and new previously unseen instances of  twenty two i'm i am on page twenty two because on explicitly states to one of ordinary skill in the art that malicious code may be included in the model and that's not because alms model that them to conceivably if there was a linkage but there's no linkage here in other words one is a prior art misuse detection system which is different than the invention in the patent they don't operate in anything like the went that deep it just took the two passages it found that in terrible after nine you had this fort dix illicit disclosure that malicious code may be included in the model but it's not designs model it's up prior art model and there was reference disclosing the use of a program code on knowingly infected with malicious code to build to some static model that is used to determine normal activity it's just not linkage i think there is an error as a matter of law but even if you apply the substantial evidence test i don't think that this would stand up because there is literally no connection it is apples and hardwood is the what is purported to be a claim construction issue that relates to more of the claims and it's pretty clear that it wasn't a claim construction issue that it was not raised after the institution decision and we think that there is just no reason for that to be at issue on appeal the second issue if you see what happens in cousin and how the board handled the disclosures of his office and how the board handled other evidence that was submitted to it as well because on as has been mentioned discusses the in its background section the model sometimes gets gets attacked data into them they are not they were effectively you know you know the i mean that's which and i think that's what your friend said is that right do you just you know any of the kind of statements that your friend i don't dispute what you have just said your honor what i think is important though is that because on is a unified reference and it disclose s what it discloses for purposes of anticipation and it discloses that there is there are circumstances where attack data inadvertently gets into the  into the model and that happens and then some and tax expert dr dr goodrich said the same thing and he said this just happens and so you're going to have situations where say it's defend the claim does it say where in the model includes a tactic i said and there may be other discussions specification but that hasn't been read into the claims in plain construction before the board or any other place and so the claims just say that the issue is that that what needs to be disclosed in a prior are correct reference is that attack data is included in the d my question was whether it's actually disclosed and and the in the prior art just it seems to me and you were using the word also that malicious phone to be included but we don't know that to included in the model it is a you know there's a reference that says sometimes this happens in the pattern that's what the the board relied on the board may have chosen its words or really want to said may but i think when it issue and your honor recognized it that they got the construction they wanted this was an agreed construction and now what we're doing and we actually do it on a couple of terms here is construing the construction and trying to determine if what the term in the construction that was agreed the same program means now columbia appears to be asserting but that was narrowly construed to mean only a here right the board to not do that but but there was no attempt to do that after the institution decision in this case is that yeah i don't think there was there was ever any any attempt to say wait a minute they're making this other  said in the district court if you have a situation where that's happened you go back and say wait a minute i think we're not on the same page that didn't happen we had a situation where the claim term was construed by agreement the board read that claim term on the arguments that had been made and the attempt to construe the construction now is to say that the same program has to be only the sort of untouched program that was the one that was being monitored that's taking the same program a construction was members of the members of the community running the a selection selected portion of a program so so what columbia is trying to do is reconsider the same program from the construction to mean only the application that is being monitored but what what the reference so if it's for instance the the kill signal that gets sent out includes for instance the name of the virus and the signature of the virus that has attacked the program that was running or if there was a warm then the worm gets sent that's what a worm does it gets replicated and sent to other computers and then it is a program that is running on all those computers and there's no dispute that war happens is you're trying that you're doing exactly the same thing and you are causing the same benefit by going out and notifying other computers to say hey something happened to me that was a problem i need to tell you about it too and that's what happens and that is that satisfies the construction of application community in this case you application the worm is a program but there are also in in the arnold reference there are you know they don't just talk about worms they talk about programs that you're running better than they infected with a virus and when you send a kill signal for those what you do is you send out something that identifies the virus and a signature of the virus so then you really are talking about the same application actually that it is a a program that's running on your computer that is also having an issue on the other computers or potentially as and so you say hey stop your programs because you're going to get infected so two basic ways that the program  that is referenced in the in the claim construction can be running on the other computers and that was a question of fact that the that the board  if i come back first to the issue of claims twenty nine and thirty nine of the one fifteen patent i think what you heard counsel argue is a reliance upon their expertise and not relying upon the disclosure in paragraph nine and their expert does say and i'll just quote the language it is sometimes difficult to find clean attack free training sets for training and intrusion detection model well that's not talking about paragraph nine this is an expert talking about how he would as a person of skull in the art think about training steps but the keyword here of course is sometimes because it would have to be all the time in order to say that the codes on reference reference necessarily discloses that would have to be an inherent to the argument and i think it's pretty difficult to get to inherent sealand from this statement by symant twenty percent right but my that's really a different question because what he's talking about is not the disclosure so he's not referring to paragraph in which talks about the prior art misuse detection correct statement of what takes place in a prior art misuse of system which has absolutely nothing to do of any kind whatsoever with the cazan model of anomaly detection  disclosures arranged as in the claim this isn't even close to being arranged as in the claim because his arms model it's a model of normal computer usage it's not doing what the prior art misuse detection systems that which was just were arranged as in the claim that would work the problem isn't so much limited to the fact that it's prior art but that it's completely unlinked prior art which has nothing to do after all with cars on disclos think would work in this instance thank you thank you very much dyed in the