# United States **Court of Appeals**  **for the Federal Circuit**

______________________ SRI INTERNATIONAL, I NC., Plaintiff

- Appellee

v.

CISCO SYSTEMS, INC., Defendant

- Appellant

______________________

2017

- 2223

______________________ Appeal from the United States District Court for the District of Delaware in No. 1:13

- cv

- 01534

- SLR

- SRF, Judge Sue L. Robinson.

______________________
O PINION I SSUED : March 20, 2019 O PINION M ODIFIED : July 12 , 2019 ∗

______________________

F RANK S CHERKENBACH , Fish & Richardson, PC, Boston, MA, argued for plaintiff

- appellee. Also represented by P ROSHANTO M UKHERJI ; D AVID M ICHAEL H OFFMAN , Austin, TX; H OWARD G. P OLLACK , Redwood City, CA; F RANCIS J. A LBERT , J OHN W INSTON T HORNBURGH , San Diego, CA.

∗ This opinion has been modified and reissued following a petition for rehearing filed by Defendant

- Appellant.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 2

W ILLIAM F. L EE , Wilmer Cutler Pickering Hale and Dorr LLP, Boston, MA, argued for defendant

- appellant. Also represented by A NDREW J. D ANFORD , L AUREN B. F LETCHER , L OUIS W. T OMPROS

.

______________________
Before L OURIE , O’M ALLEY , and S TOLL , Circuit Judges

.

Opinion for the court filed by Circuit Judge S TOLL

. Dissenting opinion filed by Circuit Judge L OURIE

. S TOLL , Circuit Judge

. This is an appeal from a final judgment in a patent

case. Cisco Systems, Inc. (“Cisco”) appeals the district court’s (1) denial of Cisco’s motion for summary judgment of patent ineligibility under § 101, (2) construction of the claim term “network traffic data,” (3) grant of summary ju dgment of no anticipation , and ( 4 ) denial of judgment as a matter of law of no willful infringement . Cisco also appeals the district court’s grant of enhanced damages, attorneys’ fees , and ongoing royalties

. We affirm the district court’s denial of summ ary judgment of ineligibility

, adopt its construction of “network traffic data

, ” and affirm its summary judgment of no anticipation. We vacate and remand the district court’s denial of judgment as a matter of law of no willful infringement, and therefore vacate and remand the district court’s enhance ment of damages and award of attorneys’ fees

. Finally, we affirm the district court’s award of ongoing royalties on post

- verdict sales of products that were actually found to infringe or are not colorably different. Accordingly, w e affirm

- in

- part, vacate

- in

- part, and remand for further proceedings consistent with this opinion.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 3

B ACKGROUND

I

While the interconnectiv ity of computer networks facilitates access for authorized users, it also increases a network’s susceptibility to attacks from hackers, malware, and other security threats. Some of these security threats can only be detected with information from multiplesources. For instance, a hacker may try logging in to several computers or monitors in a network. The number oflogin attempts for each computer may be below the threshold to trigger an alert, making it difficult to detect such an attack by looking at o nly a single monitor location in the network. In an attempt to solve this problem, SRI developed the inventions claimed in U .S. Patent Nos. 6,484,203 and 6,711,615

. The ’ 615 patent (titled “Network Surveillance”) is a continuation of the ’ 203 patent (tit led “Hierarchical Event Monitoring and Analysis”)

. II

SRI had performed considerable research and development on network intrusion detection prior to filing the patents

- in

- suit . In fact, SRI’s Event Monitoring Enabling Responses to Anomalous Live Disturbances (“EMERALD”) project had attracted considerable attention in this field. The Department of Defense’s Defense Advanced Research Projects Agency , which helped fund EMERALD, called it a “gem in the world of cyber defense” and “a quantum leap improvement over” previous technology. J.A. 127 2

– 7 3
at 27 2 : 16

– 17 , 273:7

– 9

. In October 1997, SRI presented a paper entitled “EMERALD: Event Monitoring Enabling Responses t o Anomalous Live Disturbances” (“EMERALD 1997”) at the 20th National Information Systems Security Conference.

EMERALD 1997 is a conceptual overview of the EMERALD system. It describes in detail SRI’s early research in intrusion detection technology and outlines theSRI INT ’ L , INC

. v. CISCO SYS ., INC

. 4

dev elopment of next generation technology for detecting network anomalies. SRI Int’ l Inc. v. Internet Sec. Sys., Inc.

, 647 F. Supp. 2d 323, 334 (D. Del. 2009) . The parties do not dispute that EMERALD 1997 constitutes prior art under 35 U.S.C. § 102(b). EME RALD 1997 is listed as a reference on the face of the ’615 patent.

III

T he patents share a nearly identical specification and

a priority date of November 9, 1998. At the summary judgment stage, SRI assert ed claims 1

– 4, 14

– 16, and 18 of the ’615 patent and claims 1

– 4, 12

– 15, and 17 of the ’203 patent. By the time of trial, SRI had narrowed the asserted claims to claims 1, 2, 12, and 13 of the ’203 patent and claims 1, 2, 13, and 14 of the ’615 patent. The jury considered only this narrower set of clai ms. The parties identify differ ent representative claims. Cisco proposes claim 1 of the ’203 patent , while SRI proposes claim 1 of the ’615 patent. The claims are substantially similar

, as the minor differences between them are not material to any issu e on appeal. As such, we adopt SRI’s proposal and use ’615 patent claim 1 as the representative claim

. 1 It reads:

1. A computer

- automated method of hierarchical event monitoring and analysis within an enterprise network comprising:

1 The minor differences between the two claims are in the detecting clause

— claim 1 of the ’615 patent allows for network traffic data selected from “ one or more of ” the enumerated categories, and includes two extra categories in its list: “ network connection acknowledgements ” and

“ network packets indicative of well

- known network

- service protocols .” Compare ’203 patent col. 14 ll. 19

– 35 (claim 1)

, with ’615 patent col. 15 ll. 2

– 21 (claim 1)

.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 5

deploying a plurality of network monitors in the enterprise network;
detecting, by the network monitors, suspicious network activity based on analysis of networktraffic data selected from one or more of the following categories: {network packet data tran sfer commands, network packet data transfer errors, network packet data volume, networkconnection requests, network connection denials, error codes included in a network packet, network connection acknowledgements, and network packets indicative of well

- k nown network

- service protocols};
generating, by the monitors, reports of said suspicious activity; and
automatically receiving and integrating the reports of suspicious activity, by one or more hierarchical monitors.

’615 patent col. 15 ll. 2

– 2 1

. After S RI sued Cisco for infringement of the ’615 patent and the ’203 patent
, Cisco unsuccessfully moved for summary judgment on several issues, including that the claims are ineligible and that the EMERALD 1997 reference anticipates the claims. 2 SRI Int ’ l, Inc. v. Cisco Sys.,

2 The patents previously survived multiple anticipation challenges based on the EMERALD 1997 reference. The Patent Office considered EMERALD 1997 during the original prosecution and issued the patents over it. J.A. 32734 ¶ 47; J.A. 32814

– 15 ¶ 207. In addition, during the two reexaminations, the Patent Office again considered the validity of the asserted claims over EMERALD 1997 and again found the claims valid. J.A. 32734 ¶ 47. Additionally, in SRI International Inc. v. Internet SecuritySRI INT ’ L , INC

. v. CISCO SYS ., INC

. 6

Inc. , 179 F. Supp. 3d 339 (D. Del. Apr. 11, 2016) (“ Summary Judgment Op. ”). The district court denied Cisco’s motion s and instead sua sponte granted summary judgment of no anticipation in SRI’s favor. 3 Id. at 369.

The court then held a jury trial on infringement, validity, and willful infringement of claims 1, 2, 13, and 14 of the ’615 patent and claims 1, 2, 12, and 13 of the ’203 patent , as well as damages

. The jury found that Cisco intrusion protection system (“IPS”) products, Cisco remote management services, Cisco IPS services, Sourcefire 4 IPS products, and Sourcefire professional services directly and indirectly infringed the asserted claims. T he jury awarded SRI a 3.5% reasonable royalty for a total of $23,660,000 in

compe nsatory damages

. The jury also found by clear and convincing evi dence that Cisco’s infringement was willful.
After post

- trial briefing, the district court denie d Cisco’s renewed motion for JMOL of no willfulness

. SRI

Sys tems
, Inc. , a jury found the patents not anticipated by EMERALD 199 7 . 647 F. Supp. 2d at 350. The districtcourt denied JMOL, concluding that the verdict was supported by expert testimony that EMERALD 1997 failed to disclose the claim limitation at issue. Id. We affirmed without opinion. SRI Int’ l Inc. v. Internet Se c. Sys., Inc.

, 401 F. App’x 530 (Fed. Cir. 2010).

3 The parties disputed only whether EMERALD 1997 discloses detection of any of the network traffic data categories listed in claim 1 of the ’203 and ’615 patents and whether EMERALD 1997 is enabled. One o f the claimed categories of network traffic is “network connection requests,” which Cisco asserts is disclosed by EMERALD 1997.

4 “Sourcefire” is a network security company that Cisco acquired in 2013. J.A. 2467

– 68. Cisco now markets network security products and services under the Sourcefire name.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 7

Int’l, Inc. v. Cisco Sys., Inc. , 25 4 F. Supp. 3d 680, 7 17 (D. Del. 2017) (“ Post

- Trial Motions Op. ”). Based on the willfulness verdict, the district court determined that “some enhancement is appropriate given Cisco’s litigation conduct,” the “fact that Cisco lost on all issues during summa ry judgment,” and “its apparent disdain for SRI and its business model.” Id. at 723. The court then doubled the damages award

. It also granted SRI’s motion for attorneys’ fees

, compulsory license, and prejudgment interest.

Cisco appeals the district court’s claim construction and denial of summary judgment of in eligibility, 5 as well as its grant of summary judgment of no anticipation, enhanced damages, attorneys’ fees , and ongoing royalties

. We have jurisdiction under 28 U.S.C. § 1295(a)(1).

D ISCUSSION

I

We review de novo whether a claim is drawn to patent

eligible subject matter. Berkheimer v. HP Inc. , 881 F.3d 1360, 1365 (Fed. Cir. 2018) (citing Intellectual Ventures I LLC v. Capital One Fin. Corp. , 850 F.3d 1332, 1338 (Fed. Cir. 2017) ). Section 101 defines patent

- eligible

5 We may review this denial of summary judgment because “a denial of a motion for summary judgment maybe appealed, even after a final judgment at trial, if the motion involved a purely legal question and t he factual disputes resolved at trial do not affect the resolution of that legal question.” United Techs. Corp. v. Chromalloy Gas Turbine Corp. , 189 F.3d 1338, 1344 (Fed. Cir. 1999) (citing Wolfgang v. Mid

- Am

. Motorsports, Inc. , 111 F.3d 1515, 1521 (10th Cir. 1997); Rekhi v. Wildwood Indus., Inc.

, 61 F.3d 1313, 1318 (7th Cir. 1995)). Neither party contends that fact issues arise in the patent

- eligibility analysis in this case. Therefore, we may review the purely legal question of patent eligibility.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 8

subject matter as “any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof.” 35 U.S.C. § 101. Laws of nature, natural phenomena, and abstract ideas, however, are not patentable. See Mayo Collaborative Servs. v. Prometheus Labs., Inc. , 566 U.S. 66, 70

– 71 (2012) (citing Diamond v. Diehr , 450 U.S. 175, 185 (1981) ).

To determine whether a patent claims ineligible subject matter, the Supreme Court has established a two

- step framework. First, we must determine whether the claims at issue are directed to a patent

- ineligible concept such as an abstract idea. Alice Corp. v. CLS Bank Int’l

, 573 U.S. 208, 217 (2014). Second, if the claims are directed to an abstract idea, we must “consider the elements of each claimboth individually and ‘as an ordered combination’ to determine whether the additional elements ‘transform the nature of the claim’ into a patent

- eligible application.” Id. (quoting Mayo , 56 6 U.S. at 79). To transform an abstract idea into a patent

- eligible application, the claims must do “more than simply stat [e] the abstract idea whi le adding the words ‘apply it.’ ” Id. at 221 (quoting Mayo , 566 U.S.
at 72 (in ternal alterations omitted) ).

We resolve the eli gi bility issue at Alice step one and conclude that claim 1 is not directed to an abstract idea. See Enfish, LLC v. Microsoft Corp. , 822 F.3d 1327, 1337 (Fed. Cir. 2016). T he district court concluded that theclaims are more complex than merely reciting the performance of a known business practice on the Internet and are better understood as being necessarily rooted in computer technology in order to solve a specific problem in the realm of computer n etworks. Summary Judgment Op.

, 179 F. Supp. 3d at 353

– 54 (citing ’203 patent col. 1 ll. 37

– 40 ; DDR Holdings, LLC v. Hotels.com, L.P. , 773 F.3d 1245, 1257 (Fed. Cir. 2014)). We agree. The claims are directed to using a specific technique

— using a pluralit y of network monitors that each analyz e specific types of data on the network and integrating reports from the monitors

— toSRI INT ’ L , INC

. v. CISCO SYS ., INC

. 9

solve a technological problem arising in computer networks : identify ing hackers or potential intrude rs into the network.
Contrary to Cisco’s assertion , the claims are not directed to just analyzing data from multiple sources to detect suspicious activity. Instead, the c laims are directed to an improvement in computer network technology

. Indeed, representative claim 1 recites using ne twork monitors todetect suspicious network activity based on analysis of network traffic data, generating reports of that suspicious activity, and integrating those reports using hierarchical monitors. ’ 615 patent col. 15 ll. 2

– 21

. T he “focus of the cla ims is on the specific asserted improvement in computer capabilities”

— that is, providing a network defense system that monitor s network traffic in real

- time to automatically detect large

- scale attacks. Enfish , 822 F.3d at 1335

– 36

. The specification bols ters our conclusion that theclaims are directed to a technological solution to a technological problem. The specification explains that , whilecomputer networks “offer users ease and efficiency in exchanging information

, ” ’ 615 patent col. 1 ll. 28

– 29
, “ thevery interoperability and sophisticated integration of technology that make networks such v al uable assets also makethem vulnerable to attack, and make dependence on networks a potential liability. ” Id. at col. 1 ll. 3 6

– 39

. The specification further teaches that, in conventional networks, seemingly localized triggering events can have globally disastrous effects on widely distributed systems

— like the 1980 ARPAnet collapse and the 1990 AT&T collapse. See id. at col. 1 ll. 43

– 47. T he specification exp lains that the claimed invention is directed to solving these weaknesses in conventional networks and provides “a framework for the recognition of more global threats to interdomain connectivity, including coordinated attempts to infiltrate or destroy conn ectivity across an entire network enterprise.” Id. at col. 3 ll. 44

– 48

.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 10

Cisco argues that the claims are directed to an abstract idea for three primary reasons

. First, Cisco argues that the claims are analogous to those in Electric Power Group , LLC

v. Alstom S.A. , 830 F.3d 1350 (Fed. Cir. 2016)

, and aresimply directed to generic steps required to collect and analyze data. We disagree. The Electric Power claims were drawn to using comput ers as tools to solve a power grid problem, rather than improving the functionality of comput ers and computer networks themselves. Id. at 1354. We conclude that the claims are more like the patent

- eligible claims in DDR Holdings

. In DDR

, we emphasized that the claims were directed to more than an abstract idea that

m erely required a “computer network operating in its normal, expected manner.” 773 F.3d at 1258. Here, the claims actually prevent the normal, expected operation of a conventional computer network

. Like the claims in DDR

, the claimed technology “overrides the routine and conventional sequence of events” by detecting suspicious network activity, generating reports of suspicious activity

, and receiving and integrating the reports using one or more hierarchical monitor s

. Id

. Second, Cisco argues that the invention does not involve “ an improvement to computer functionality itself

. ” Enfish , 822 F.3d at 1336

. In Alice

, the Supreme Court advised that claims directed to independently abstract ideas that use computers as tools a re still abstract. 573 U.S.
at 222

– 23

. However, the claims here are not directed to using a computer as a tool

— that is, automating a conventional idea on a computer. Rather, the representative claim improves the technical functioning of the computer and computer networks by reciting a specific technique for improving computer network security.

Cisco also submits that the asserted claims are so general that they encompass steps that people can “go through in their minds,” allegedly confirming that th ey are directed to an abstract concept. Appellant Br. 27

– 28 (citing Capital One , 850 F.3d at 1340 ; Intellectual Ventures I LLC v.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 11

Symantec Corp. , 838 F.3d 1307, 1318 (Fed. Cir. 2016); CyberSource Corp. v. Retail Decisions, Inc. , 654 F.3d 1366, 1371 (Fed. Cir. 2011) )

. We disagree. This is not the type of human activity that § 101 is meant to exclude

. I ndeed, we tend to agree with SRI that the human mind is not equipped to detect suspicious activity by using network monitors and analyzing network packets as recited by the claims.

Because we conclude that the claims are not directed to an abstract idea under step one of the Alice analysis, we need not reach step two

. See Enfish , 822 F.3d at 1339. Accordingly, we affirm the district court’s summary judgment that the claims are patent

- eligible.

II

A district court’s claim construction based solely on intrinsic evidence is a legal question that we review de novo

. See Teva Pharm. USA, Inc. v. Sandoz , Inc.

, 135 S. Ct. 831,841 (2015). Claim construction seeks to ascribe the “ordinary and customary meaning” to claim terms as a person of ordinary skill in the art would have understood them at the time of invention. Phillips v. AWH Corp. , 415 F.3d 1303 , 1312

– 14 (Fed. Cir. 2005) (en banc) ( quoting Vitronics Corp. v. Conceptronic, Inc. , 90 F.3d 1576, 1582 (Fed. Cir.1996)). “[T]he claims themselves provide substantial guidance as to the meaning of particular claim terms.” Id.
at 1314. In addition, “the person of ordinary skill in the art is deemed to read the claim term not only in the context of the particular claim in which the disputed term appears,but in the context of the entire patent, including the specification.” Id. at 1313.

The district co urt construed “ [ n ] etwork traffic data” to mean “data obtained from direct examination of network packets.” SRI Int’l, Inc. v. Dell Inc. , No. CV13

- 1534

- SLR, 2015 WL 2265756, at *1

– 2 (D. Del. May 14, 2015)

. After reviewing the parties’ pleadings on summary judgment, the district court determined that its con s truction wouldSRI INT ’ L , INC

. v. CISCO SYS ., INC

. 12

benefit from clarification. The district court explained that

“ [ t ] o say that the data ‘is obtained from direct examination of network packets’ means to differentiate the original

source of the data, not ho w or where the data is analyzed.

. . . The fact that the data may be stored before analysis is performed on the data does not detract from its lineage.” Summary Judgment Op

. , 179 F. Supp. 3d at 363. The district court explicitly rejec ted the opinion of Cisco’s expert, Dr. Clark

, that the court’s claim construction should re quire that the analysis of data obtained from network packets take place without any further manipulation whatsoever

. Id.
On appeal, Cisco offers a more nuanced construction, asserting that term should instead be construed as “d etecti ng suspicious network activity based on ‘ direct e xamination of network packets

, ’ where such ‘ direct examination ’ does not include merely examining data that has been obtained, generat ed, or gleaned from network packets. ” Appellant Br. 42. According to Cisco, based on SRI’s express prosecution disclaimer during reexamination, the claimsrequire detecting suspicious activity based on “direct examination” of network packets, not data “g ener ated” or “gleaned” from packets. Cisco would thus construe the term to exclude a process that decodes the network packet.

We conclude that Cisco’s proposed construction goes too far in limit ing the amount of pre processing encompassed by the claim

. Th e specification shows that preprocessing is a contemplated and expected part of the claimed invention. Indeed, the specification specifically mentions different forms of preprocessing network packets prior to examination

, including decryption (’ 615 pate nt col. 3 ll. 61

– 63 ), parsing ( id. at col. 8 ll. 10

– 12 ), and decoding ( id.
at col. 8 ll. 7

– 9 ).
Cisco’s argument that SRI disclaimed preprocessing during reexamination of its patent s is also not persuasive. To invoke argument

- based estoppel, “the prosecutionSRI INT ’ L , INC

. v. CISCO SYS ., INC

. 13

history must evince a ‘ clear and unmistakable surrender ’ ” of this kind of preprocessing. Deering Precision Instruments v. Vector Distrib

. Sys. , 347 F.3d 1314, 1326 (Fed. Cir. 2003) (quoting Eagle Comtron ics, Inc. v. Arrow Commc’n Labs., Inc.

, 305 F.3d 1303, 1316 (Fed. Cir. 2002)) ; see also Krippelz v. Ford Motor Co. , 667 F.3d 1261, 1267 (Fed. Cir. 2012) (applying prosecution history disclaimer from reexamination proceedings)

. Here, SRI’s statements durin g reexamination reflect that SRI drew the line between what does and does not comprise “direct examination” by excluding information derived from network packet data ( for example, network traffic measures a nd network traffic statistics )

. At the same time, SRI explained that “direct examination” include s the data from which the network traffic measures and network traffic statistics are derived ( that is, the data in the network packets). For example

, SRI explained that the specification:
[D] emonstrates tha t the term “network traffic data” requires information obtained by directpacket examination by using the distinctly different terms “network traffic measures” and “network traffic statistics” when discussing information derived from network traffic observ ation, as compared to the data from which the measures and statistics are derived.

Brief for the Patentee on Appeal at 7, In re Porras

, Reexam No. 90/008,125 ( B.P.A.I. Jan. 14, 2010 ) (citing ’203 patent col. 4 ll. 55

– 60 (discussing “network traffic statis tics”) and col. 5 ll. 28

– 30 (discussing “network traffic measures”) )

. We read SRI ’s statements during reexamination as simply explaining that “network traffic statistics,” such as number of packets and number of kilobytes transferred,

are statistics derived from the network packet data

— not the underlying data itself . SRI did not argue that the actual data underlying the measures and statistics

— the data in the network packets

— could not be subject to directSRI INT ’ L , INC

. v. CISCO SYS ., INC

. 14

examination. Nor did SRI take the position t hat “direct examination” must take place before any or all processing. SRI did not mention processing at all during reexamination

. Moreover, as the specification make s clear, the system may need to decrypt, parse, or decode the data packets

— all forms of preprocessing

— in order to directly examine the network packet data underlying the network traffic statistics

. We hold that SRI’s statements in the prosecution history do not invoke a clear and unmistakable surrender of all preprocessing

, including decryp tion, decoding, and parsing

. Accordingly, w e agree with the district court’s construction of “network traffic data” to mean “data obtained from direct examination of network packets.”

II I

We also hold that the district court did not err in granting summary judgment that the asserted claims are not anticipated by SRI’s own EMERALD 1997 reference. We review the district court’s summary judgment of no anticipation under regional circuit law. See MAG Aerospace Indus., Inc. v. B/E Aerospace, Inc. , 816 F .3d 1374, 1376 (Fed. Cir. 2016). The Third Circuit reviews a grant of summary judgment de novo , applying the same standard as the district court

. See Gonzalez v. Sec’y of Dep’t of Homeland Sec. , 678 F.3d 254, 257 (3d Cir. 2012). Summary judgment is appr opriate when, drawing all justifiable inferences in the nonmovant ’ s favor, there exists no genuine issue of material fact and the movant is entitled to judgment as a matter of law. Fed. R. Civ. P. 56( a ); see also Anderson v. Liberty Lobby, Inc. , 477 U.S. 242, 255 (1986). Anticipation requires that a single prior art reference disclose each and every limitation of the claimed invention, either expressly or inherently. See Verdegaal Bros. v. Union Oil Co. of Cal.

, 814 F.2d 628, 631 (Fed. Cir. 1987)

. EMERALD 1997 discloses a tool for tracking malicious activity across large networks. The question before us isSRI INT ’ L , INC

. v. CISCO SYS ., INC

. 15

whether the district court erred in concluding on summary judgment that EMERALD 1997 does not disclose detection of any of the network traffic d ata categories listed in claim 1 of the ’203 and ’615 patents

. The Patent Office considered EMERALD 1997 during the original examination of the ’615 patent, and the patentability of the claims over the reference was confirmed in multiple reexamination and litigation proceedings. Indeed, during reexamination, the Patent Office accepted SRI’s argument that the claim limitation requires detecting suspicious activity based on “direct examination” of network packets to distinguish EMERALD 1997. J.A. 26402 (“[ T]he closest prior art of record, Emerald 1997, fails to teach direct examination of packet data.”) ; J.A. 27101 (same)

. EMER ALD 1997 describes detecting a DNS/NFS attack in “real

- time

. ” J.A. 5004

. To achieve this, EMERALD 1997 explains : The subscriptio n list field is an important facility for gaining visibility into malicious or anomalous activity outside the immediate environment of an EMERALD monitor. The most obvious exampleswhere relationships are important involve interdependencies among network services that make local policy decisions. Consider, for example, theinterdependencies between access checks performed during network file system [ “ NFS ” ] mounting and the IP mapping of the DNS service. An unexpected mount monitored by the network file

s ystem service may be responded to differently if the DNS monitor informs the network file system monitor of suspicious updat es to the mount requester’ s DNS mapping.

J.A. 5008

. EMERALD 1997 further explains that :
A

bove the service layer, signature engines scan theaggregate of intrusion reports from service monitors in an attempt to detect more globalSRI INT ’ L , INC

. v. CISCO SYS ., INC

. 16

coordinated attack scenarios or scenarios that exploit interdependencies among network services. The DNS/NFS attack discussed [above] is one such example of an aggregate attack scenario.

J.A. 5 0 10.
Cisco’s expert submitted a report concluding that a person of ordinary skill in the art would understand from this disclosure that “monitoring specific network services, such as HTTP, FTP, network file systems, finger, Kerberos, and SNMP would require detecting and analyzing packets indicative of those we ll

- known network service protocols, one of the enumerated categories in claim 1 of the ’615 patent.” J. A

. 30347 (emphasis added)

. During deposition, however, Cisco’s expert retreated from this position, admitt ing that a person of ordinary skill reading E MERAL D 19 97 would have understood that it was not necessary to directly examine the packe ts
, although that would be “ one very good

way ” to prevent attacks. J.A. 50040 at 159:12

– 21.
On this record, we conclude that summary judgment was appropriate. EMERALD 1997 does not expressly disclose directly examining network packets as required by the claims

— especially not to obtain data about network connection requests. Nor does Cisco’s expert testimony create a genuine issue of fact on this issue. Rather

, we agree with the district court that Cisco’s expert’s testimony is both inconsistent and “based on [] multiple layers of supposition.” Summary Judgment Op. , 179 F. Supp. 3d at 358. Because the evidence does not support express or inherent disclosure of direct examination of packet data, we conclude that t he district court did not err in holding that there was no genuine issue of fact regarding whether EMERALD 1997 disclosed analyzing the specific enumerated types of network traffic data recited in the c laims.

Cisco next argues that the district court erred by granting summary judgment for SRI sua sponte despite SRI’s failure to move for such relief . We disagree. Under T hirdSRI INT ’ L , INC

. v. CISCO SYS ., INC

. 17

C ircuit law, a district court may properly enter summary judgment sua sponte “ so long as the losing party was onnotice that she had to come forward with all of her evidence.” Gibson v. Mayor & Council of City of Wilmington

, 355 F.3d 215, 222 (3d Cir. 2004) ( quoting Celotex Corp. v. Catrett , 477 U.S. 317, 326 (1986 ))

. By filing its own motion for summary judgment, Cisco was on notice that anticipation was before the court, and Cisco had the opportunity to put forth its best evidence

. Additionally, SRI did argue, in opposition to Cisco’s summary judgment motion , that th e district court should outright reject Cisco’s assertion of invalidity. J.A. 31650 ( “Cisco’s assertion of invalidity should be rejected

. . . . ” ). Indeed, SRI expressly took the position that EMERALD 1997 “does not anticipate any claim of the ’203 or ’6 15 patents

. ” J.A. 31678. Thus, any notice requirement was satisfied because Cisco itself indicated that the issue was ripe for summary adjudication and SRI took the position that the claims were not anticipated

. Accordingly,

w e see no error in the sua s ponte nature of the district court’s order and we affirm the summary judgment of no anticipation

. IV

Cisco also appeals the district court’s denial of JMOL that it did not willfully infringe the asserted patents because the ju ry’s willfulness finding is not supported by substantial evidence. We agree that the jury’s finding that Cisco willfully infringed the patents

- in

- suit prior to receiving notice thereof is not supported by substantial evidence and therefore vacate and rema nd.

We review decisions on motions for JMOL under the law of the regional circuit. Energy Transp. Grp. Inc. v. William Demant Holding A/S , 697 F.3d 1342, 1350 (Fed. Cir. 2012). T he Third Circuit reviews district court decisions on such motions de novo. Acumed LLC v. Adv. Surgical Servs., Inc. , 561 F.3d 199, 211 (3d Cir. 2009) (citing Monteiro v. City of Elizabeth , 436 F.3d 397, 404 (3d Cir. 2006) )

.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 18

In the Third Circuit, a “court may grant a judgment as a matter of law contrary to the verdict only if ‘th e record is critically deficient of the minimum quantum of evidence’ to sustain the verdict.” Id. (citing Gomez v. Allegheny Health Servs., Inc. , 71 F.3d 1079, 1083 (3d Cir. 1995) ) . The court should grant JMOL “sparingly” and “only if, viewing the evidence in the light most favorable to the no n movant andgiving it the advantage of every fair and reasonable inference, there is insufficient evidence from which a jury reasonably could find liability.” Marra v. Ph ila

. Hous. Auth.

, 497 F.3d 286, 300 (3d Cir. 2007) (quoting Moyer v. United Dominion Indus., Inc. , 473 F.3d 532, 545 n.8 (3d Cir. 2007) )

. As the Supreme Court stated in Halo

, “[t]he sort of conduct warranting enhanced damages has been variously described in our cases as willful, wanton, malicious, bad

faith, deliberate, consciously wrongful, flagrant, or

— indeed

— characteristic of a pirate.” Halo Elecs., Inc. v. Pulse Elecs., Inc. , 136 S. Ct. 1923, 1932 (2016). While district courts have discretion in dec iding whether or not behaviorrises to that standard, such findings “are generally reserved for egregious cases of culpable behavior.” Id. Indeed, as Justice Breyer emphasized in his concurrence, it is the circumstances that transform simple “intentional orknowing” infringement into egregious, sanctionable behavior, and that makes all the difference. Id. at 1936 (Breyer, J., concurring). A patentee need only show by a preponderance of the evidence the facts that support a finding of willful infringemen t. Id. at 1934. In denying Cisco’s motion for JMOL on willfulness, the district court concluded that the jury’s willfulness determination was supported by two evidentiary bases. First, the court identified evidence that “ k ey Cisco employees did not

rea d the patents

- in

- suit until their depositions

. ” Post

- Trial Motions Op. , 254 F. Supp. 3d at 717

. Second, the court identified evidence that Cisco designed the products and services in an infringing manner and that Cisco instructedSRI INT ’ L , INC

. v. CISCO SYS ., INC

. 19

its customers to use the products and services in an infringing manner

. Based on these two facts, the district court denied Cisco’s renewed motion for JMOL on willfulness, stating that “ [v]iewing the record in the light most favorable to SRI, substan tial evidence supports the ju ry’ s subjective willfulness verdict.” Id.
On appeal, SRI identifies additional evidence that purportedly supports the jury’s willfulness verdict. Specifically, SRI presented evidence that Cisco expressed interest in the patented technology and met with SRI’s inventor in 2000 before developing its infringing products. J.A. 1484

– 86; J.A. 5027. Additionally, SRI submitted evidence that Cisco received a notice letter from SRI’s licensing consultant on May 8, 2012, informing Cisco of the asserted patents ( a year before SRI filed the complaint)

. Finally, l ike the district court , SRI makes much of the fact that “ key engineers ” did not look at SRI’s patents until SRI took their depositions during this litigation . In particular, Cisco engineer s Martin Roesch and James Kasper did not look at the patent until their deposition s in 2015

. Even accepting this evidence as true and weighing all inferences in SRI’s favor, we conclude that the record is insufficient to establish that Cisco’s conduct rose to the level of wanton, malicious, and bad

- faith behavior required for willful infringement

. First, it is undisputed that the Cisco employees who did not read the patents

- in

- suit until their depositions were engineers without legal training. G iven Cisco’s size and re sources, it was unremarkable that the engineers

— as opposed to Cisco’s in

- house or outside counsel

— did not analyze the patents

- in

- suit themselves. The other rationale offered by the district court

— that Cisco designed the products and services in an infring ing manner and that Cisco instructed its customers to use the products and services in an infringing manner

— is nothing more than proof that Cisco directly infringed and induced others to infringe the patents

- in

- suit.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 20

It is undisputed that Cisco did not kno w of SRI’s patent until May 8, 2012 , when SRI sent its notice letter to Cisco

. Oral Arg. at 23:46
, available at http://oralarguments.cafc. uscourts.gov/default.aspx?fl=2017

- 2223.mp3

. It is also undisputed that this notice letter was sent years after Cisco independently developed the accused system s and first sold them in 2005 (Cisco) and 2007 (Sourcefire)

. As SRI admits, the patent s had not issued when the parties met in May 2000

. Indeed, the patent appli cation for the parent ’203 patent was not eve n filed until several months after the parties met. Thus, Cisco could not have been aware of the patent application

. While the jury heard evidence that Cisco was aware of the patents in May 2012 , before filing of the lawsuit , we do not see how the recor d supports a willfulness finding going back to 2000. As the Supreme Court recently observed

, “culpability is generally measured against the knowledge of the actor at the time of the challenged conduct.” Halo

, 136 S. Ct. at 1933. Similarly , Cisco’s allegedly aggressivelitigation tactics cannot support a finding of willful infringe ment going back to 2000 , especially when the litigation did not start until 2012

. Finally , Cisco’s decision not to seek an advice

- of

- counsel defense is legally irrelevant under 35 U.S.C. § 298.
Viewing the record in the light most favorable to SRI, the jury’s verdict of willful infringement before May 8, 2012 is not supported by substantial evidence. Given the general verdict form, we presume the jury also found that Cis co willfully infringed after May 8, 2012. When reviewing a denial of JMOL

, “ where there is a black box jury verdict, as is the case here, we presume the jury resolved underlying fa c tual disputes in favor of the verdict winner and leave those presumed find ings undisturbed if supported by substantial evidence.” Arctic Cat Inc. v. Bombardier Recreational Prod s . Inc. , 876 F.3d 1350, 1358 (Fed. Cir. 2017), (citing WBIP, LLC v. Kohler Co. , 829 F.3d 1317, 1326 (Fed. Cir. 2016) )

, cert. denied , 139 S. Ct. 143SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 21

(2018)

. We leave it to the district court to decide in the first instance whether the jury’s presumed finding of willful infringement after May 8, 2012 is supported by substantial evidence

. 6 In so doing, the court should bear in mind the standard for wil lful infringement, as well as the above analysis regarding SRI’s evidence of willfulness. Accordingly , we vacate and remand the district court’s denial of Cisco’s renewed motion for JMOL of no willful infringement.

Cisco also argues that the district cour t abused its discretion by doubling damages. Enhanced damages under § 284 are predic a ted on a finding of willful infringement. Because we conclude that the jury’s finding of willfulness before 2012 was not supported by substantial evidence, we do not rea ch the propriety of the district court’s award of

en hanced damages. Instead, we vacate the award of enhanced damages and remand for further consideration along with willfulness.

V

We next turn to the district court’s award of attorney s’ fees under § 285, which we vacate and remand for further consideration . Under § 285, a “court in exceptional cases may award reasonable attorney fees to the prevailing

6 W e recognize that, ideally, it should not fall to thedistrict court to determine when, if ever, willful infringement began through the mechanism of JMOL. Rather, the question of when willful infringement began is a fact issue that would have been best presented to the jury in a special verdict form with appropriate jury instructions . Better yet, perhaps SRI could have recognized the shortcomings in its case and presented a more limited case of willful infringement from 2012 onwards. Or perhaps Cisco could havefiled a motion for summary judgment of no willful infringement prior to May 8, 2012.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 22

party.” An “exceptional” case under § 285 is “one that stands out from others with re spect to the substantive strength of a party’ s litigating position (considering boththe governing law and the facts of the case) or the unreasonable manner in which the case was litigated.” Octane Fitness, LLC v. ICON Health & Fitness, Inc.

, 572 U.S. 545

, 554 (2014). The party seeking fees must prove that the case is exceptional by a preponderance of the evidence, and the district court makes the exceptional case determination

on a case

- by

- case basis considering the totality of the circumstances. See id

. at 554, 557

. We review a district court’s grant or denial of attorneys’ fees for an abuse of discretion, which is a highly deferential standard of review. Highmark Inc. v. Allcare Health Mgmt. Sys., Inc.

, 572 U.S. 559, 56 4 (2014); Bayer CropScience AG

v . Dow AgroSciences LLC , 851 F.3d 1302, 1306 (Fed. Cir. 2017) (citing Mentor Graphics Corp. v. Quickturn Design Sys., Inc. , 150 F.3d 1374, 1377 (Fed. Cir. 1998)). To meet the abuse

- of

- discretion standard, the appellant must show that the district court mad e “a clear error of judgment inweighing relevant factors or in basing its decision on an error of law or on clearly erroneous factual findings.” Bayer

, 851 F.3d at 1306 (quoting Mentor Graphics , 150 F.3d
at 1377); see also Highmark

, 572 U.S. at 563 n.2.

We see no such error in the district court’s determination that this was an exceptional case

. The district court found:
There can be no doubt from even a cursory review of the record that Cisco pursued litigation about as aggressively as the court has s een in its judicial experience. While defending a client aggressively is understandable, if not laudable, in the case at bar, Cisco crossed the line in several regards.

Post

- Trial Motions Op. , 254 F. Supp. 3d at 722.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 23

The district court further explained that “ Cisco’ s litigation strategies in the case at bar created a substantial amount of work for both SRI and the court, much of which work was needlessly repeti tive or irrelevant or frivolous. ” Id. at 723 (footnotes omitted)

. Indeed, t he district court inventoried Cisco’s aggressive tactics, including maintaining nineteen invalidity theories until the eve of trial but only presenting two at trial and pursuing defenses at trial that were contrary to the court’s rulings or Cisco’s interna l documents. Id. at 722. Nevertheless, t he district court relied in part on the fact that the jury found that Cisco’s infringement was willful in its determination to exercise its discretion pursuant to § 285 to award SRI its attorneys’ fees and
costs. Id. at 723

. Accordingly, we vacate the district court’saward of attorneys’ fees and remand for further consideration along with willfulness.

We take no issue with the district court’s award of attorneys’ fees at the attorneys’ billing rates without adjusting them to Delaware rates. At the same time, however, the district court erred in granting all of SRI’s fees. Section 285 permits a prevailing party to recover reasonable attorney s’ fees, but not fees for hours expended by counselthat were “excessive, redundant, or otherwise unnecessary.” Hensley v. Eckerhart , 461 U.S. 424, 434 (1983). W e accordingly conclude that the district court should have reduced SRI’s total hours to eliminate clear mistakes

. For

examp le, one billing entry reads “DON’T RELEASE, CLIENT MATTER NEEDS TO BE CHANGED

. ” J. A

. 32384

. Accordingly, should the district court award attorneys’ fees on remand , it must remov e attorney hours clearly included by mistake in its calculation of reasonable attorneys’ fees.

V I

We review for abuse of discretion a district court’s grant of an ongoing royalty. Whitserve, LLC v. Comput

. Packages, Inc. , 694 F.3d 10, 35 (Fed. Cir. 2012). Here, t heSRI INT ’ L , INC

. v. CISCO SYS ., INC

. 24

district court did not abuse its discretion in awarding “a 3.5% compulsory license for all post

- verdict sales.” Post

Trial Motions Op. , 254 F. Supp. 3d at 724

. The district court’s ongoing royalty rate equals the rate found by the jury and the base is limited to the “accused products and services.” J.A. 182.
On ap peal, Cisco argues that the district court abused its discretion in awarding the 3.5% ongoing royalty on “all post

- verdict sales” without considering Cisco’s design

arounds. According to Cisco, the court was obligated to assess whether Cisco’s redesigned products and services weremore than colorably different from those products and services adjudicated at trial, and if not, whether those redesigned products and services infr inge. To this end, Cisco moved to supplement its post

- trial briefing with declarations describing its redesign efforts . Cisco argues that the district court abused its discretion by denying its motion to supplement

. 7 We disagree

. T he district court pro perly exercised its discretion in denying Cisco’s motion to supplement the record regarding alleged post

- verdict design

around activity. Cisco did not redesign its products until after trial, and Cisco did not file its motion to supplement until after com pletion of post

- trial briefing . Given the

7 Finally, Cisco argues that, in the same order in which the court stated that “[t]here are no post

- verdict royalti es,” the court awarded a post

- verdict royalty

— an internal inconsistency. J.A. 175. We do not ascribe weight to the apparent clerical error creating the inconsistency. The district court’s final judgment order is clear that “Cisco shall pay a 3.5% compul sory license on all post

- verdict sales of the accused products and services.” J.A. 182. To the extent that clear statement conflicts with the single sentence in the memorandum opinion, we think the court made its intentions clear in its final judgment an d we see no error by the district court.SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 25

stage of the proceedings and SRI’s opposition, the trial
court acted within its discretion when deny ing Cisco’s motion to supplement.

To the extent the district court’s order is unclear

— and we think it is not

— we reconfirm that the ongoing royalty on post

- verdict sales is limited to products that were actually found to infringe and products that are not colorably different. W e discern no error in the district court’s determination that Cisco’s submissions were un timely

. Nevertheless, we acknowledge that the district court has not yet determined whether products and services that were notaccused (that is, changed after the jury verdict) are colorably different for purposes of ongoing royalty calculations. Such an issue could be resolved in a future proceeding.

C ONCLUSION

For the reasons above , we affirm the district court’s denial of summary judgment that the asserted claims are patent

- ineligible . We also agree with the distric t court’s construction of “network traffic data” and affirm the district court’s grant of summary judgment of no anticipation. We vacate and remand the district court’s denial of Cisco’s renewed motion for judgment as a matter of law that Cisco did not willfully infringe the asserted clai ms. Accordingly,
we vacate and remand the district court’s award s of enhanced damages and attorneys’ fees

. Finally, w e affirm the district court’s orders granting enhanced damages and ongoing royalties.

AFFIRMED

- IN

- PART, VA CATED

- IN

- PART, AND REMANDED

C OSTS

No costs.

# United States Court of Appeals **for the Federal Circuit**

______________________ SRI INTERNATIONAL, I NC., Plaintiff

- Appellee

v.

CISCO SYSTEMS, INC., Defendant

- Appellant

______________________

2017

- 2223

______________________ Appeal from the United States District Court for the District of Delaware in No. 1:13

- cv

- 01534

- SLR

- SRF, Judge Sue L. Robinson.

______________________

L OURIE , Circuit Judge , dissenting.
I respectful ly dissent from the majority’s decision upholding the eligibility of the claims. In my view, they are clearly abstract. In fact, they differ very little from the claims in Electric Power Group, LLC v. Alstom S.A. , 830 F.3d 1350, 1355 (Fed. Cir. 2016) , wh ere we found the claims to be abstract.
The majority opinion focuses on claim 1 of U.S. Patent 6,711,615 (“the ’615 patent ”) , which recites:
1. A computer

- automated method of hierarchical event monitoring and analysis within an enterprise network comprising:SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 2

deploying a plurality of network monitors in the enterprise network;
detecting, by the network monitors, suspicious network activity based on analysis of network traffic data selected from one or more of the following categories: {network pack et data transfer commands, network packet data transfer errors, network packet data volume, network connection requests, network connection denials, errorcodes included in a network packet, network connection acknowledgements, and network packets indicati ve of well

- known network

- service protocols};
generating, by the monitors, reports of said suspicious activity; and
automatically receiving and integrating the reports of suspicious activity, by one or more hierarchical monitors.
Similarly, t he claim we r eviewed in Electric Power G roup recited “[a] method of detecting events on an interconnected electric power grid in real time over a wide areaand automatically analyzing the events on the interconnected electric power grid,” with the method comprising eig ht steps , including “receiving data,” “detecting and analyzing events in real time,” “displaying the event analysis results and diagnoses of events,” “ accumulating and updating measurements,” and “deriving a composite indicator o f reliability.” 830 F.3d at 1351

– 52.

While th at claim was lengthy

, with eight steps , it

m erely describe d selecting information by content or source for collection, analysis

, and display. Id. at 1351. In finding the claim directed to an abstract idea , we reasoned that “collectin g information, including when limited to particular content (which does not change its character asSRI INT ’ L , INC

. v. CISCO SYS ., INC

. 3

information)” was an abstract idea. Id. at 1353. L imiting the claim to a particular technological environment

— power

- grid monitoring

— was insufficient to tr ansform it into a patent

- eligible application of the abstract idea at its

core. Id. at 1354. The claim was rooted in computer technology only to the extent that the broadly

- recited steps require d a computer. At step two, we noted that the claim did not require an “inventive set of components or methods

. . . that would generate new data,” and did not “invoke any assertedly inventive programming.” Id. at 1355. This case is hardly distinguishable from Electric Power Group. The claims in that case are said in the majority opinion to only be drawn to using computers as tools to solve a problem, rather than improving the functionality of computers and computer networks.
The claims here recite nothing more than deploying network monitors, detecting susp icious network activity, and generating and handling reports. The detecting of the suspicious activity is based on “ analysis ” of traffic data, but the claims add nothing concerning specific means for doing so. The claims only recite the moving of informa tion. Thecomputer is used as a tool, and no improvement in computer technology is shown or claimed. There is no specifictechnique described for improving computer network security.

I would find the claims directed to the abstract idea of monitoring n etwork security and proceed to step two of Alice

. As in Electric Power Group , however, “[n]othing in theclaims, understood in light of the specification, requires anything other than off

- the

- shelf, conventional computer, network , and display technology .

. . . ” 830 F.3d at 1355. The claims recite “types of information and information sources,” id. , but such selection of information by content or source does not provide an inventive concept. Id. The specification further makes clear that the claims onl y rely on generic computer components, including a computer,SRI INT ’ L , INC

. v. CISCO SYS ., INC

. 4

memory, processor, and mass storage device. See ’615 patent, col. 14 ll. 50

– 57. Indeed, the specification even deems the relevant memory bus and peripheral bus “customary components.” Id. col. 14 l. 55.
Finally, the majority opinion quotes from and paraphrases language from the specification that only recites results, not means for accomplishing them. See

, e.g., Majority Op. at 9

. The claims as written, however, do not recite a specific way o f enabling a computer to monitor network activity. As we noted in Electric Power Group , result

- focused, functional claims that effectively cover any solution to an identified problem, like those at issue here, frequently run afoul of Alice. 830 F.3d at 1356.
Thus, I would find the claims to be directed to an abstract idea at Alice step one
, without an inventive concept at step two
, and reverse the district court’s finding of eligibility

. Because I would find the claims at issue to be ine ligible, I would not reach the remaining issues in the case.