SRI Int'l, Inc. v. Cisco Sys., Inc.

SRI Int'l, Inc. v. Cisco Sys., Inc., No. CV 13-1534-SLR, 2016 WL 1437655, at *1 (D. Del. Apr. 11, 2016)  

Patent(s):  

  • 6,711,615 | Entitled “Network Surveillance”
  • 6,484,203 | Entitled “Hierarchical Event Monitoring and Analysis”

Disposition:               

Motion for summary judgment of invalidity denied.

Abstract Idea:

No

Something More:

Yes

Technology:              

The patents teach a computer-automated method of hierarchical event monitoring and analysis within an enterprise network that allows for real-time detection of intruders. Upon detecting any suspicious activity, the network monitors generate reports of such activity. The claims of the '203 and '615 patents focus on methods and systems for deploying a hierarchy of network monitors that can generate and receive reports of suspicious network activity.

Summary:                 

The court applied the analytical framework of Alice.  The court first determined that the claims at issue were not directed to one of those patent-ineligible concepts. The court explained that the patents addressed the vulnerability of computer networks' interoperability and sophisticated integration of technology to attack.  The claims are therefore, more complex than “merely recit [ing] the performance of some business practice known from the pre-Internet world along with the requirement to perform it on the Internet,” and are better understood as being “necessarily rooted in computer technology in order to overcome a problem specifically arising in the realm of computer networks.”

The court then held that the patents also provided an inventive concept.  The patents explain that “[s]election of packets can be based on different criteria” and the claims identify “particular categories of network traffic data ... well suited for analysis in determining whether network traffic was suspicious when used in a hierarchical system.”  As to the hierarchical analysis, the patents explain that the “tiered collection and correlation of analysis results allows monitors 16a–16f to represent and profile global malicious or anomalous activity that is not visible locally.”  The claims as an ordered combination (in light of the specification) sufficiently delineate “how” the method is performed to “improve the functioning of the computer itself,” thereby providing an inventive concept.  The same specificity suffices to negate the “risk [of] disproportionately tying up the use of the underlying ideas.”