N OTE : This disposition is nonprecedential. 

# United States **Court of Appeals**  **for the Federal Circuit**

______________________

SOPHOS LIMITED, Appellant

v.

ANDREI IANCU, UNDER SECRETARY OF COMMERCE FOR INTELLECTUAL PROPERTY AND DIRECTOR OF THE UNITED STATES PATENT AND TRADEMARK OFFICE , Intervenor

______________________

2017

- 1567

______________________ Appeal from the United States Patent and Trademark Office, Patent Trial and Appeal Boa rd in No. IPR2015

- 01405.

______________________

Decided: March 28, 2018

______________________
S TANLEY J OSEPH P ANIKOWSKI , III , DLA Piper LLP (US), San Diego, CA, argued for appellant. Also repr esented by S EAN C. C UNNINGHAM , K ATHRYN R ILEY G RASSO

.

M OLLY R. S ILFEN , Office of the Solicitor, United States Patent and Trademark Office, Alexandria, VA, argued for intervenor. Also represented by N ATHAN K. K ELLEY ,SOPHOS LIMITED v. IANCU 2

S ARAH E. C RAVEN , T HOMAS W. K RAUSE , W ILLIAM L A M ARCA

.

______________________
Before P ROST , Chief Judge, O’M ALLEY , and T ARANTO , Circuit Judges.

T ARANTO , Circuit Judge

. In this inter partes review, Finjan Holdings, Inc. cha llenged various claims of Sophos Limited’s U.S. Patent No. 8,776,218, which describes and claims com puter programs that perform run time behavior

- based detection of malicious software. The Patent Trial and Appeal Board of the Patent and Trademark Office (PTO) determined that certain claims a re unpatentable for obviousness. Sophos appeals from the Board’s decisi on . With Finjan n o longer participating, the PTO’s Director has intervened. Because the Board’s claim construction, as the Board understood its scope, is incorrect, we vacate the Board’s decision and remand for further proceedings.

I

A
The ’218 patent relates to a compute r program that monitors “an executing computer process” for “indic ation[s] of malicious behavior ,” takes “[a] plurality of malicious behavior indications observed” in the executing computer process and compares that observed collection
to one or more “pred etermined collection [s] of malicious behaviors” in a database of such collections, and , if there is a “match[],” conducts further analysis and causes action to be taken

. ’218 patent, Abstract. The particular claim phrase at issue here involves assigning a “rank” to a predetermined collection of malicious behaviors , relative
to other co llections . Doing so can help determine the threat level when the observed set of malicious behaviors in the executing computer process is found to match aSOPHOS LIMITED v. IANCU 3

particu lar predetermined collection of malicious beha viors. See ’218 patent, col. 18, lines 26

– 30, col. 24, lines 10

– 14. Malicious software (malware) can take various forms such as “virus, worm, spam, phishing exploration, sp yware, [and] adware.” Id

., col. 3 , l ines 19

– 23. The patent describes using two kinds of databases for malware detection

. Each element in o ne database is a predetermined malicious behavior referred to as a “gene ,” which may be identified in an executing computer process being monitored

. Id

. , col. 1, lines 46

– 50. The patent gives

e xamples of genes (malicious behaviors), such as disabling operating system tools, disabl ing a firewall, add ing itself to firewall lists, copying itself to a system folder, and

open ing a hidden file. Id

., col. 2 , lines 16

– 24. E ach element in the other database is a predetermined colle ction of such genes, each such collection referred to as a “phenotype.” Id.

, col. 1, lines 52

– 56

. A phenotype may be any combination of such behaviors

— in particular, “a predetermi ned collection of malicious behaviors which may include a grouping of specific genes that are typically present in a type or family of malicious code.” Id

. , col. 18, lines 18

– 21; col. 1, lines 54

– 56

. The patent describes the process of testing an execu tin g or other program

— a “runtime object” in the case of an executing program

— by gathering observed indications of malicious behavior (genes) in the program, comparing a plurality of such indications to the phenotypes in the phenotype database, and “causing an action based on a prediction that the executing computer process is the type of malicious code as indicated by the phenotype.” Id. , col. 1, lines 56

– 58 ; see id. , col. 18, lines 22

– 25 (stating that a monitoring component “may be able to identify a phen otype of behaviors in an executing code by comparing a collection of observed behaviors with the predetermined collections of known malicious behaviors stored as phen otypes in a phenotype database”). What is sought in theSOPHOS LIMITED v. IANCU 4

comparison is a “match.” Id.

, Abs tract; col. 17, lines 41

– 48 , 6 1– 65

. The patent explains the benefits: “Matching this runtime genotype data with known combinations stored in the phenotype database, with or without add itional content analysis, may enable the identification and interruptio n of malware while it is executing .” Id. , col. 17, lines 41

– 45 (figure numbers omitted). “By matching combinations of behaviors in this way, detection of ma lware may be improved over solutions where only singular behaviors and a static content analysis i s utilized.” Id.

, col. 17, lines 45

– 48. The patent specification contains one mention of “rank[ing]

. ” It says : “P henotype s may capture a combin ation or a series of behaviors that may be ranked to create increasing levels of confidence that the runtime object being monitored is executing a behavior pattern compar able to a known family of malware.” Id

., col. 18 , lines 26

– 30

. During prosecution of the patent, in response to a r ejection, Sophos amended its claims to add language specifically about ranking

, not previously recited in the claims

. J.A. 116, 120

. Both in the language of the ind ependent claims

, see infra p. 5 (quoting claim 1 ) and in its explanation accompanying the amendment , Sophos made clear that it is each phenotype (each one a “combination or a series of behaviors,” ’218 patent, col. 18, line 27) that is “ranked ,” so that matching one phenotype rather than another can provide more information about the likely malware threat of the runtime object being tested. S ophos explained:
[P]henotypes are created and ranked to provide increasing levels of confidence that a runtime o bject is executing a behavior pattern comparable to a known family of malware. A content analysis is then performed only after detected malicious b ehavior indications corre spond to a phenotype ha v-SOPHOS LIMITED v. IANCU 5

ing a predetermined level of confidence that the computer process contains a known family of malware. In this manner, the applicant’s tec hnique includes a progression from phenotype d etection to content analysis based on a likelihood of malware. Claim 1 has been amended to clarify this inventive concept.

J.A. 120.
The Board and the parties treat claim 1 as repr esentative. It reads: A computer program product embodied in a non

transitory computer readable medium that, when executing on one or more computers, performs the steps of:
monitoring an executing computer process for an indication of malicious behavior, wherein the indication of the malicious behavior is a result of comparing an operation with a pred etermined behavio r, referred to as a gene, where the gene is stored for reference in a d atabase and wherein the gene relates to at least one of API calls, registry access, process manipulation, and file system access;
performing the monitoring step a number of times to col lect a plurality of malicious beha vior indications; comparing the plurality of malicious behavior indications to a predetermined collection of malicious behaviors, referred to as a phen otype, which comprises a grouping of specific genes that are typically present in a type of malicious code, and wherein the phenotype is one of a number of phenotypes that are ranked to create increasing levels of confidence that aSOPHOS LIMITED v. IANCU 6

runtime object is executing a behavior pattern comparable to a known family of malware ; trigger ing a content analysis of the executing computer process when the plurality of mal icious behavior indications for the executing computer process corresponds to one of the number of phenotypes having a predete rmined level of confidence that the executing

co mputer process contains a known family of malware, thereby providing a prediction that the executing computer process is the type of malicious code; and
causing an action based on the prediction. ’218 patent, col. 23, line 60 through col. 24, line 24 (e mph asis added). Claim 11 depends on claim 1, and claim 12 contains an identical “wherein .

. . are ranked” clause in its comparing step. Id

., col. 24 , lines 65

– 67 ; col. 25, lines 1–23.

B Finjan petitioned for an inter partes review of claims 1 through 20 un der 35 U.S.C. §§ 311

– 19. The Board

, acting as the delegate of the PTO’s Director under 37 C.F.R. § 42.4(a), instituted a review of claims 1, 11, and 12 on multiple grounds , all under 35 U.S.C. § 103

. Finjan Holdings, Inc. v. Sophos Ltd.

, IPR2015

- 01405, Paper No. 9, at 27 (P .T.A.B. Dec. 15, 2015) ( Institution Decision ). 1 The Board decided to review claims 1 and 12 for obviou sness over U.S. Patent No. 7,809,670 (Lee) and U.S. Patent

1 The ’218 patent, which issued from a 2009 appl ica tion, is governed by the version of § 103 that was in effect before the provision’s amendment by the Leahy

Smith America Invents Act, Pub. L. No. 112

- 29, § 3(n)(1), 125 Stat. 284, 293 (2011).SOPHOS LIMITED v. IANCU 7

No. 8,171,545 (Cooley) , and also over U.S. Patent No. 7,0 89,428 (Farley) and Cooley. Id. The Board decided to review claim 11 for obviousness over Lee, Cooley, and U.S. Application No. 2007/0240217 (Tuvell) and also over Farley, Cooley, and Tuvell. Id.
In its Final Written Decision, the Board construed the claim phrase requiring that phenotypes “are ranked .” Finjan Holdings, Inc. v. Sophos Ltd.

, IPR2015

- 01405, 2016 WL 7987957, at * 4–6 ( P.T.A.B. Nov. 30, 2016) ( Final Written Decision ). The Board first construed the term “ranked” to mean simply “ordered,” id. at *4, meaning that the phenotypes must be ordered vis -à- vis each other. The Board then concluded that, in the phrase “are ranked,” ranking “ may occur as part of the comparing step such that phenotypes are not ‘already ranked’” before the comparing st ep begins

. I d. at *6 (emphasis added). The “may” in that conclusion, however, ultimately does not accurately reflect the Board ’s understanding of “are ranked.” A s the key substantive basis for its claim construction, the Board explained its understandi ng of the claimed ranking in a way that actually pre cludes pre

comparison ranking. Specifically, the Board said that “[a]s a result of the comparison, the phenotypes ‘are ranked’”; “[i]t is only in the context of the comparison that the ranking occurs”; a nd “[t]he reason f or the comparison between the ‘malicious behavior indications’ a n d the ‘phenotypes’ is to identify the most problematic phen otype, which is ‘ranked’ according to how similar it is to the ‘executing computer program. ’” Id. at *5 (emphases ad ded). In short, the Board’s understanding is that the invention ranks phenotypes based on their similar ity to a particular runtime object being examined. The Director confirms that this is the Board’s construction and that theSOPHOS LIMITED v. IANCU 8

construction necessarily precludes pre

- comparison ran king. Director’s Br. 1

– 2. 2
The Board then applied that understanding . Using that similarity

- based understanding, it found that both Lee and Farley disclosed the “are ranked” limitation. Final Written Decision , 2016 WL 7987 957, at *14, *18

– 19. And, as a result, it held that claims 1, 11, and 12 are unpatentable for obviousness. Id. at * 20. Sophos timely appeal ed the Board’s decision under 35 U.S.C. §§ 141(c) and 319

. Finjan declined to participate in this appeal , and the PTO ’s Director intervened

, purs uant to 35 U.S.C. § 143, to defend the Board’s decision

. Appellee’s Notice of Non

- Participation, ECF No. 12 (Apr. 4, 2017) ; Notice of Intervention by the United States Patent and Trademark Office , ECF No. 18 (May 17, 2017). We have jurisdiction under 28 U.S.C. § 1295(a)(4)(A).

II Sophos argues that the Board, in construing the ran king limitation, misunderstood what “are ranked” means in the context of the claims. More specifically, Sophos contends that the Board was wrong in its fundamental view that t he predetermined phenotypes, which are stored in the database

, are ranked based on how similar they are
to the set of malicious behav ior indications observed in a particular monitored runtime object ( progra m)

. The only

2 The Director states that “[t]he Board construed the term ‘are ranked’ to mean ranking while the compar ison is happening” and that the issue presented is: “Did the Board reasonably construe ‘are ranked

, ’ where the known collections of behaviors do not have a natural

or der, or ranking, except with respect to how similar they are to the unknown program, and that similarity cannot be known until the comparison is occurring?” Director’s Br. 1 –2 (emphasis added)

.SOPHOS LIMITED v. IANCU 9

reasonable understanding of the claim phrase

, Sophos

says, is quite different: a phenotype is ranked relative to others based in some way on its indicati ng known ma lware ; the runtime object is scrutinized to see if its set of observed behavio rs matches one of the phenotypes in the phenotype database ; and it is the rank of a matched phenotype that determin es the level of confidence that the runtime object is like a known family of malware (trigge ring content analysis and action)

. We agree with Sophos

. The Board reached its conclusion regarding the scope of its claim construction on the basis of its degree -ofsimilarity

- to

- runtime -object understanding of the “are ranked” limitation

. Final Written Decision , 2016 WL 7987957, at * 5

. On appea l, the Director defends the Board’s construction of the “are ranked” limitation on that basis , stating that “the ranking is done during the claimed process to determine which phenotype most closely corresponds to a particular unknown program.” Director’s Br. 15. At oral argument, the Director effe ctively agree d that we may address the correctness of this basis for the Board’s adoption of the claim construction challenged by Sophos. 3

In an inter partes review proceeding, the Board is to give a claim “its broadest reasonable construction in light of the specification of the patent in which it appears.” 37 C.F.R. § 42.100(b); see Cuozzo Speed Techs., LLC v. Lee

, 136 S. Ct. 2131, 2142 (2016) (affirming the PTO’s author ity to prescribe such a standard). “We review the Board’s constructions based on intrinsic evidence de novo.” HTC

3 See Oral Argument at 19:47

– 23:45, 24:21

– 25:10, So phos Ltd. v. Iancu , No. 17

- 1567 (Fed. Cir. Mar. 9, 2018), http://oralarguments.cafc.uscourts.gov/default.aspx?fl=20 17- 1567 .mp3 (agreeing that the Board’s construction was based on its understanding of ranking and that the Board’s understanding may be reviewed in t his appeal).SOPHOS LIMITED v. IANCU 10

Corp. v. Cellular Commc ’ ns Equip., LLC , 877 F.3d 1361, 1367 (Fed. Cir. 2017). This includes “ the Board ’ s expre ssion of its understan ding of the scope of the claim term .” Id.
The Board’s view necessarily calls for ranking phen otypes vis -à- vis each other . T hat is inherent in the Board’s construction of “ranked” to mean “ordered.” Final Written Decision , 2016 WL 7987957, at * 4

. And the Director
agrees, at least implicitly

, when it defends the Board’s understanding of ranking as supplying a phenotype

- to

phenotype order where a “natural order , or ranking, ” does not exist for the phenotypes . Director’s Br. 1

– 2.

B ut n either the Board’s explanation nor the Director’s defense of that explanation in this court indicates how the claim can reasonably be understood to call for that ran king to be based on how similar phenotypes in a database are to a particular runtime object being scrutiniz ed . The “broadest reasonable interpretation

. . . is an interpret ation that corresponds with what and how the inventor describes his invention in the specification .” In re Smith Int’l, Inc. , 871 F.3d 1375, 1382

– 83 (Fed. Cir. 2017); see Microsoft Corp. v. P roxyconn , Inc. , 789 F.3d 1292, 1298 (Fed. Cir. 2015) (prosecution history is relevant to this inquiry as well)

, overruled in another respect by Aqua Prods., Inc. v. Matal , 872 F.3d 1290 (Fed. Cir. 2017) ; In re NTP, Inc. , 654 F.3d 1279, 1288 (Fed. Cir. 2011 ) (“While the Board must give the terms their broadest reasonable construction, the construction cannot be divorced from the specification and the record evidence.”); In re Suitco Surface, Inc. , 603 F.3d 1255, 1260 (Fed. Cir. 2010) (“The broadest

- construct ion rubric .

. . does not give the PTO an unfettered license to interpret claims to embrace anything remotely related to the claimed invention. Rather, claims should always be read in light of the specification and teachings in the underlying patent.”). Here, t he Board’s central understanding is unreasonabl e in light of theSOPHOS LIMITED v. IANCU 11

specification and, indeed, of the claim’s own statement of its objective.
We have been pointed to nothing in t he ’218 patent that disclose s ranking the predetermined phenotypes accordi ng to their degree of similarity to a particular set of malicious behaviors observed in a particular runtime object. To the contrary, the patent speaks consistently of seeking a “match” of a phenotype for the runtime object’s set of malicious

- behavior indications, never of examining degrees of similarity. ’218 patent, Abstract; col. 17, lines 41

– 48, 64. In addition, t h e Board’s notion would call for

re

- ranking the group of phenotypes with every new runtime object that is evaluated

. T he patent says nothing to that effect.
More fundamentally, the Board’s notion of ranking the phenotypes by how similar each is to a partic ular runtime object is detached from the essential function of the invention

. As claim 1 itself makes clear, t he function of the comparison of a runtime object to phenotypes is to develop information about the threat presented by a runtime object, whose r isk of being any type of malware is not known before the comparison . T hat risk information comes from matching behavior indications observed in the runtime object with a phenotype independently assessed for its threat indication

, i.e. , what a particular phenotype indicate s about the presence of a certain kind of malware

. See

, e.g. , ’218 patent, col. 18, lines 36 –41 (one phenotype may indicate that the collection of observed behavior indications is “bad” while another may indicate, more specif ically, that the “process is exhibiting the same behavior as [a known] family of malware”) ; J.A. 529 (Finjan’s statement to the Board that “[t]he purpose of ranking the phenotypes is to assess the risk that the runtime object is malware”) . It is t he pheno type

- to

phenotype ranking , independent of similarity to the runtime object, that is the source of the information used
to evaluat e the runtime object, and to trigger a contentSOPHOS LIMITED v. IANCU 12

analysis and action based on th e evaluation, which is the claimed invention’s st ated function. ’218 patent , col. 1, lines 43

– 58 ; col. 18, lines 26

– 30. Yet the Board’s notion of

s imilarity

- based ranking eliminates th e essential ind ependent source of information for assessing the runtime object , and it leaves nothing in its place that the Board or the Director has explained would still allow the claimed invention to perform its function.

The Board fundamentally misread the patent when it said , in its crucial paragraph, that “[t]he reason for the comparison

. . . is to identify the most problematic phen otype.” Final Written Decision , 2016 WL 7987957, at * 5 (emphasis added). That statement gets the direction of inference in the patented process backwards . The point of the comparison is not to start with a known danger pr esented by the runtime object and infer how problematic a phenotype is by the degree of similarity to the runtime object. The danger of the runtime object is not yet known

. T he point of the comparison is to infer something about precisely that danger, by using independ ent information (through ranking) about how problematic a particular matched phenotype is. Ranking of phenotypes ind ependent ly of similarity to the runtime object is an esse ntial component of that process.
In short, n othi ng in the claims, the specification, or the prosecution history supports the Board’s understan ding that the predetermined phenotypes are ranked based on their similarity to the observed malicious behavior indications. We conclude that the Board’s understanding is “ divorced from the specification ” and is “ legally inco rrect. ” Smith , 871 F.3d at 1382 (quoting Microsoft

, 789 F.3d at 1298 ).

The Board’s incorrect understanding of why and how ranking is performed in the context of the ’218 patent appears to be a central basis for its determination that Lee and Farley disclose the “are ranked” limitation. ButSOPHOS LIMITED v. IANCU 13

we do not decide the issue of whether the prior art di scloses the “are ranked” limitation under a proper co nstruction. We remand to the Board for further proceedings consiste nt with this opinion.

III

The Board’s decision is vacated and the matter remand ed for further proceedings.

No costs.

VACATED AND REMANDED