occurs only in the context of a clean comparison and that the most problematic phenotype is ranked according to how similar it is to the executing computer program but this is not how the clean invention works can i ask you this so i don't claim to sink that that paragraph on page eleven of the board's opinion is rather central both to what it was thinking became central to the director's characterization not clear to me whether that's quite the issue that you knew most of europe will brief you have framed it about timing that is mostly you what's going on is that the board had the wrong notion of ranking in mind when king by similarity distance as opposed to ranking the things in the library by whatever information you can get at the level of  and i'm i guess i'm concerned about the extent to which you've really preserved and presented the argument that you're making now your honor the boards with respect to focusing on the similarity distances is giving rise to the ranking is what way directly to it's error on the timing question your honor is korat that we have not showing the construction of the term ranking is including or not including similarity distances what we have challenge is the worst construction of the are ranked when it teachin as allowing the ranking to occur during or after the clean comparison that it seems to me that you could have a post comparison ranking that's different from ranking according to similarity of the but the object that the test subject by saying we've just figured out which one this is like we haven't yet look through our library phenotypes and decided which of those phenotypes are really really dangerous and which less so now we're going to figure it that out and then take action drawn or in theory you could have that but you couldn't have that in the context of the claimed invention here and the reason for that your honor begins with the claim language that in the comparing limitation the action that is described here is comparing the core ality of malicious behavior indications to a pre determined collection of malicious behavior malicious code another characteristic is that the pheno tight is one of a number of you know types in that class of phenotypes are ranked to create increasing levels of confidence that a runtime object is executing a behavior pattern comparable to a known family of mellower there is no disclosure in the claim language or elsewhere in the intrinsic record of calculating these rankings either on the fly or after the clean comparison rather both the structure of the claim language and then the description of the ranking and this behavioral monitoring process in the specification in the prosecution history shows that these rankings must exist before the comparison because all that you do is to detect a phenotype and when that phenotype matches one of the existing phenotypes in the database you determine whether that phenotype has the pre determined level of confidence necessary to trigger a content analysis if you could calculate that was full of confidence on the fly in and go  back while your system is under attack to figure out whether the stored phenotypes are sufficiently likely to indicate malware the trigger a content analysis there would be some description in the flames or in the specification of this process happening during the comparison process but there is no such description all you do is make a comparison look for a match and if the match phenotype has the pre determined level what do you rank it is and i write about that if you're on it you are right that part of the issue is what is the ranking but it is understanding the character of the ranking that directly leads to an answer on the one claim language is written in a way that uses our rank as an adjutant of a phrase to indicate that the ranking happened before the clean comparison to there's no disclosure anywhere of conducting the ranking process on the fly during or after the clean comparison and three your honor the the patent office has not given any reason to reject sauces construction other that that the ranking constitutes a calculation of levels of similarity once you've dispel that notion you see that for example you can accomplish the comparison by then you've you've performed those stats of the method however we know from the claim language that you need to have a number of pheno types that are around how could you have a number of you know t a fair opportunity to leave preserve that point here because at that at and i take it that the government's argument as i understand it is because it's tied to similarity to since the writing actually cannot can occur earlier or or or even has to occur earlier but i don't really understand why a correct ranking of the phenotypes in the library without regard to understanding of how you mention works by discussing it in our opening a reply brief but you are correct that we are framing this in in terms of a timing issue in our position is that the ranking of the stored phenotypes must occur before is likely present once you understand that we believe that that gets you a while longer way toward the correct construction here which is however once you understand you have to understand what's being done in order to  timing matters that is correct your honor and then once we get to that point we have more work to do in order to show that this clean term should be tempore really limited to ranking occurring before the clean comparis and that comparison alone without any on the fly ranking is going to enable you to draw a conclusion that this behavior is that or that this series of behaviors is so bad that we think it's probably this particular family of mal one would expect to find some description of that in the in transit record instead what you have is only the discussion of these pre determined collections of malicious behaviors the phenotypes that the prosecution history says are created  fly during the comparison in the claims of the show i would like to reserve the rest of my time for reporting on it thank you in income eighteen it's actually it doesn't seem to me to be talking about the ranking that softness is now talking about it's talking about behaviors that may be right in the behaviors of the genes the the white male right and i mean i wasn't sure that were you're looking at the same thing i have that word fact between behaviors and may felt to me like it was a typo and should be added and should be and and  that may be right but either way i think that it's the behaviors that are that are being talked about in this sentence that the individual lf and the claim language itself talks about the ranking happening well it says to create increasing levels of confidence that a runtime object is executing at behavior pattern comparable to a known family malware so within that claim it's all we have is that it's that it has to be relative to something that we wouldn't have known ahead of time there wouldn't have been a runtime object ahead of time to compare to so so it just doesn't make sense that you would rank them relative to each other when you already know that each one represents a family of malware what about the the language in the process in history that at least seems to indicate pretty clearly that the you know  are created and linked at the same time so that it is also relative to the it i don't think it indicates that they're created in ring to the same time it indicates that they are they are created and they are  and then it ends on the same language that's in the claims of to create increasing levels of confidence that a runtime object is executing a behavior pattern comparable to a known family of melkor so we'd again is talking about a runtime object that is executing some behavior that you wouldn't have know ahead of time but it's a content analysis and then performed so clearly that we're talking about you know types in related rank before the content certain threshold of malicious behavior and if you're above the threshold then you do look at a deeper dive he do a content analysis too to see if you should be fixing something stopping the could not be before that's right i think that is how the born decision reads i mean certainly certainly in the broad enough to include the present time but  of what it had in mind and it's and that this invention is about and that's what you then defend it on that's right and i think the paragraph i meant to point to i'm sorry was on page thirteen of the joint appendix where the board says the full paragraph on that page i guess the last sentence says the argument of president owner that phenotypes are already ranked prior to the comparison does not make sense says that different malware is better or worse than other malware it and i think that would be as we put our brief i think it would be pretty hard to say that i mean different types of malware do different harmful things and the purpose is to figure out if the thing that you're looking at is any type of malware and if so what family is it from so so that the ranking ahead of time according to i mean i suppose potentially it could be ranked according to how bad the malware is ahead of time but i don't know that seems like a very subjective judgement and would depend a lot on the user and what their preferences are and regardless you would want to be combating any kind of malware that you've already determined is a virus well that you might want to combat it in different ways and doesn't the last element of the claim say something about taking some attack is so you might want to shut down the program or you might want to i mean i don't think it is it in visioning keeping going but ending soon but it's but certain types of malware might be affecting your hard drive and other types might be affecting your you know outlook contacts are sort of trying to figure out information about you and so the reaction that you would have would be different but i don't think it's because one's better an and and like i said before the there's nothing in the specifications indicate what kind of ranking is happening and so i agree that there's a lot of being a similarity distance which also appears in a crucial paragraph on page eleven of the board's decision is right around and i think definitely the crux of being right but i mean i think that's a hard question because it it is in some ways wrapped up in the time in question ok to meet three points that only relate to the important issues of claim destruction methodology at the heart of this appeal first the parties agree that this is not a situation where you have a plain meaning in the clean language and you're is there something that tells us that i think a cell phone set there really isn't anything in the patent that does that so when you try to figure out what it means it's not a bat i guess to say it's a similarity of s your honor there are two places in the p that do not expressly define ranking but give us a very strong indication of what a ranking is the first is in the claim one appendix sixty one column twenty four the triggering stat that begins one sixteen where we trigger a content analysis if we find a match in the stored phenotype that is not a runtime object is quote one of the number of phenotype having a pre determined level of confidence that the executing computer process contains a known family of malware that that level of confidence is a ranking and we calibrate the system it could be expressed in terms of a percentage it could perhaps be a color coded system but the point is that this system is calibrated to a certain level of confidence and then it's the right thing that level of confidence is being applied to the runtime object triggering limitation in the claim i made where the pheno types have a level of confidence associated with them it's not necessarily an ordinal ranking of one two three four five it could be ranks like you might have been in the military rank it could be translated more precisely into a percentage was full of probability that we have now where when a runtime object is trying to perform that havior and by the same token when you detect a series of having a very very similar grammatical structure in the monitoring it talks about comparing an operation with a pre determined behavior referred to as a gene just like we saw with phenotypes in the comparing stat and then it twenty three lines sixty seven the patent says we're the gene is stored for reference in a database and where in the gene relates to at least one of several activities and we see this it exact  grammatical structure that's used in the comparing stat be in use in the monitoring stat and clearly referring to actions that occur in the past is stored or to present characteristics of the gene that were attributed to it before the monitoring step was performed and therefore we have we have a parallel structure so which we can connect the grammar in the comparing stat and therefore the context of the claim langridge gives us a very strong indication that the phenotypes must be right before the clean comparison and your honor this is where the important plane construction methodology comes in in the court's recent decision in re smith international the court s determining whether the patent offices construction is reasonable you don't just ask those the specification preclude this construction you don't even just ask is the patent offices can struction not inconsistent with the specification rather you