After over a decade of litigating, winning multiple appeals and inter partes review (IPR) proceedings, and finally earning a $185 million jury verdict against cybersecurity giant Gen Digital Inc. that operates the Norton antivirus brand, Columbia University saw a massive setback with last week’s Federal Circuit opinion. The opinion touched on several topics in modern patent litigation, including subject matter eligibility under § 101 and damages, and its lessons will be felt far beyond the parties of this case.
In the early 2000s, antivirus protection was primarily performed by comparing suspicious code to a database of known viruses; however, this technique had the obvious flaw that new viruses that didn’t match any known signature could remain undetected and cause damage (e.g., “zero-day” attacks). Instead of determining whether suspicious code matches known viruses, Columbia’s researchers developed a solution to this drawback by evaluating whether the suspicious code performed anomalously. Specifically, an emulator would execute suspicious code, and the function calls made during that emulation would be compared against a model of how those function calls were expected to behave; any sequence of anomalous function calls would be an early indication of previously-unidentified viruses. But the key to Columbia’s innovation was a “combined model,” which was built from data gathered across many computers simultaneously. Instead of requiring a single machine to run and observe a program for days or weeks before developing a behavioral baseline, the system would instead use thousands of interconnected computers to perform the observation function simultaneously. This yielded a faster, more robust model that was difficult for sophisticated attackers to undermine through mimicry attacks designed to fool a single standardized model. These techniques were the basis of Columbia’s U.S. Patents 8,074,115 and 8,601,322 at issue in this appeal.
