ORDER DENYING BLUE COAT'S MOTION FOR JUDGMENT ON THE PLEADINGS

BETH LABSON FREEMAN, District Judge.

Defendant Blue Coat Systems, LLC ("Blue Coat") brings this motion for judgment on the pleadings that U.S. Patent No. 8,677,494 (the "`494 patent") is invalid for failure to claim patent-eligible subject matter under 35 U.S.C. § 101. ECF 104. For the reasons discussed below, the Court DENIES Blue Coat's motion.

I. BACKGROUND

A. The `494 Patent

Finjan owns the `494 patent, which is entitled "Malicious Mobile Code Runtime Monitoring System and Methods." The `494 patent was filed on November 7, 2011 and issued on March 18, 2014, but belongs to a long line of continuation and continuation-in-part applications which originated from patent applications filed in 1996. One of these parent applications resulted in U.S. Patent No. 6,092,194 (the "`194 patent"), which the `494 patent identifies in its specification and states is "incorporated by reference."` 494 patent, col. 1 ll. 33-38.

The `494 patent generally relates to systems and methods for protecting devices on an internal network from code, applications, and/or information downloaded from the Internet that perform malicious operations. Id., Abstract. According to the `494 patent, at the time of invention, virus protection strategies for networked computers "met with limited success at best" because virus scanning was localized and reactive: virus protection programs were installed on individual computers and only protected against known viruses. Id., col. 2 ll. 11-21. Because of this, these "program[s] [would] inevitably [be] surmounted by some new virus," at which point they would need to be updated or replaced and the cycle would begin again. Id. In addition, certain types of viruses were "not well recognized or understood, let alone protected against." Id., col. 2 ll. 22-24. This included viruses that were hidden in executable programs such as "Downloadables."1 Id., col. 2 ll. 23-30. "Accordingly, there remains a need for efficient, accurate, and flexible protection of computers and other network connectable devices from malicious Downloadables." Id., col. 2 ll. 45-48.

The `494 patent purports to address this problem by detecting whether downloadable content contains potentially malicious code before it is allowed to be run on the destination computer. See id., col. 5 l. 60-col. 6 l. 6. At a high level, the disclosed embodiments describe a protection engine that generally resides on a network server and inspects incoming downloads for executable code. See id., col. 2 l. 20-col. 3 l. 4; `194 patent, col. 3 ll. 10-21. The claims are directed to a narrow aspect of this, which involve a solution consisting of three basic steps that appear to be most closely detailed in the `194 patent:

First, an incoming Downloadable is intercepted. `494 patent, col. 21 l. 20, col. 22 l. 8. The `194 specification describes an "Internal Network Security System" which sits in between an external computer network and the internal computer network and "examines Downloadables received from external computer network 105, and prevents Downloadables deemed suspicious from reaching the internal computer network 115.'" 194 patent, col. 3 ll. 10-13.

Second, the Downloadable is scanned and "security profile data," which includes "a list of suspicious computer operations that may be attempted by the Downloadable," is derived. `494 patent, col. 21 ll. 21-23, col. 22 ll. 10-13. The `194 specification discloses a "code scanner" component that scans through a Downloadable and generates the "security profile data" (also referred to as "Downloadable Security Profile (DSP) data,"`194 patent, col. 4 ll. 17-18). `194 patent, col. 5 ll. 41-42. Figure 7 of the `194 specification illustrates this process:

Id., Fig. 7. At the beginning of the process, the code scanner "disassemble[s] the machine code of the Downloadable." Id., col. 9 ll. 23-24. Next, the code scanner iterates through the machine code, (1) resolving the next command in the machine code, (2) "determin[ing] whether the resolved command is suspicious," and, if so, (3) "decod[ing] and register[ing] the suspicious command and its command parameters as DSP data." Id., col. 9 ll. 20-42. The format of the DSP data is "based on command class (e.g., file operations, network operations, registry operations, operating system operations, resource usage thresholds)." Id., col. 9 ll. 38-42. Examples of operations deemed potentially hostile include:

Id., col. 5 l. 59-col. 6 l. 4.

Third, the "security profile data" is stored in a database. `494 patent, col. 21 ll. 24-25, col. 22 ll. 14-16. The'194 specification discloses that, after DSP data is generated, it is stored in a "DSP data" data object according to the Downloadable's ID. `194 patent, col. 6 ll. 9-10 ("[t]he code scanner 325 then stores the DSP data into DSP data 310 (corresponding to its Downloadable ID)"). The DSP data is then stored in "security database 240," along with other data such as security policies, a list of known Downloadables, and a list of known Certificates. See id., col. 3 ll. 47-50, col. 4 ll. 15-18.

The `194 specification discloses that DSP data stored in the database can be compared, along with other information, against a security policy to determine whether the Downloadable should be permitted to be run on the destination computer. See id., col. 6 ll. 13-20. However, the claims themselves do not recite this, nor any subsequent use of the security profile data, after it gets stored in the database. `494 patent, col. 21 ll. 22-23, col. 22 ll. 8-17.

Finjan currently asserts claims 1, 10, 14, 15, and 18. Mot. 2, ECF 104. Independent claims 1 and 10 recite:

Id., col. 21 ll. 22-23, col. 22 ll. 8-17. Claim 14 additionally requires that the Downloadable include a program script. Id., col. 22 ll. 26-27. Claim 15 specifically names suspicious computer operations. Id., col. 22 ll. 28-30. Claim 18 requires that the Downloadable scanner comprise a disassembler. Id., col. 22 ll. 37-39.

B. Procedural History

The parties' dispute predates the instant case. On August 28, 2013, Finjan initiated a first patent infringement action, Case No. 5:13-CV-03999-BLF ("Finjan I"), against Blue Coat, alleging that Blue Coat infringed U.S. Patent Nos. 6,154,844 (the "`844 patent"), 6,965,968 (the "`968 patent"), 7,418,731 (the "`731 patent"), 6,804,780 (the "`780 patent"), 7,058,822 (the "`822 patent"), and 7,647,633 (the "`663 patent"). The parties tried all six patents before a jury who, on August 4, 2015, found that Blue Coat infringed the `844, `968,'731,'780, and `633 patents. Finjan I, ECF 438 at 2-3. The Court upheld these findings in its post-trial rulings. Finjan I, ECF 543. In addition, the Court held a bench trial where it decided, among other things, that the `844 patent was not patent-ineligible under 35 U.S.C. § 101. Finjan I, ECF 486 at 13-18. The Court entered final judgment on July 18, 2016. Finjan I, ECF 556.

On July 7, 2015, five days before the beginning of trial in Finjan I, Finjan initiated the instant suit. ECF 1. Here it asserts three patents from Finjan I (the `844 patent, the `968 patent, and the `731 patent), the `494 patent, and six others (U.S. Patent Nos. 8,566,580 (the "`580 patent"); 8,079,086 (the "`086 patent"); 8,225,408 (the "`408 patent"); 9,141,786 (the "`786 patent"); 9,189,621 (the "`621 patent"); and 9,219,755 (the "`755 patent")). On September 16, 2016, Blue Coat filed a motion for judgment on the pleadings that the asserted claims of the `494 patent are invalid for failure to claim patent-eligible subject matter under 35 U.S.C. § 101. ECF 104.

II. LEGAL STANDARD

A. Motion for Judgment on the Pleadings Under Fed. R. Civ. P. 12(c)

Rule 12(c) provides that "[a]fter the pleadings are closed—but early enough not to delay trial—a party may move for judgment on the pleadings." Fed. R. Civ. P. 12(c). "A judgment on the pleadings is properly granted when, taking all allegations in the pleadings as true, the moving party is entitled to judgment as a matter of law." Enron Oil Trading & Transp. Co. v. Walbrook Ins. Co., 132 F.3d 526, 528 (9th Cir. 1997) (citing McGann v. Ernst & Young, 102 F.3d 390, 392 (9th Cir. 1996)). When ruling on a Rule 12(c) motion, the Court must "accept factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party." Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). Any existing ambiguities must be resolved in favor of the pleading. Walling v. Beverly Enters., 476 F.2d 393, 396 (9th Cir. 1973).

"If, on a motion under Rule 12(b)(6) or 12(c), matters outside the pleadings are presented to and not excluded by the court, the motion must be treated as one for summary judgment under Rule 56." Fed. R. Civ. P. 12(d). A court, however, may "consider certain materials—documents attached to the complaint, documents incorporated by reference in the complaint, or matters of judicial notice—without converting the motion to dismiss into a motion for summary judgment." United States v. Ritchie, 342 F.3d 903, 908 (9th Cir. 2003).

B. Patent Validity Challenges Under 35 U.S.C. § 101

35 U.S.C. § 101 provides that "[w]hoever invents or discovers any new and useful process, machine, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title." However, the Supreme Court has recognized that these broad categories contain an implicit exception: "[l]aws of nature, natural phenomena, and abstract ideas are not patentable." Ass'n for Molecular Pathology v. Myriad Genetics, Inc., 133 S.Ct. 2107, 2116, 186 L. Ed. 2d 124 (2013) (internal quotation marks and citation omitted).

To determine whether a claim falls outside this exception, the Supreme Court has established a two-step framework: First, the court must "determine whether the claims at issue are directed to a patent-ineligible concept." Alice Corp. Pty. Ltd. v. CLS Bank Int'l, ___ U.S. ____, 134 S.Ct. 2347, 189 L.Ed.2d 296 (2014). Second, if the claims are directed to patent-ineligible subject matter, the Court must "consider the elements of each claim both individually and `as an ordered combination' to determine whether the additional elements `transform the nature of the claim' into a patent-eligible application." Id. (quoting Mayo Collaborative Servs. v. Prometheus Laboratories, Inc., 132 S.Ct. 1289, 1298, 1297, 182 L. Ed. 2d 321 (2012)). The Supreme Court has described this as a "search for an `inventive concept'—i.e., an element or combination of elements that is `sufficient to ensure that the patent in practice amounts to significantly more than a patent upon the [ineligible concept] itself.'" Id.

In evaluating step one, "the `directed to' inquiry applies a stage-one filter to claims, considered in light of the specification, based on whether `their character as a whole is directed to excluded subject matter.'" Enfish, LLC v. Microsoft Corp., 822 F.3d 1327, 1335 (Fed. Cir. 2016) (quoting Internet Patents Corp. v. Active Network, Inc., 790 F.3d 1343, 1346 (Fed. Cir. 2015)). In the software context, claims may fail step one because they are directed to an abstract idea. The Federal Circuit has found this to be true in a number of cases, and some commonalities have emerged. For example, fundamental economic activities and business practices, even if performed on a computer, are often abstract. OIP Techs., Inc. v. Amazon.com, Inc., 788 F.3d 1359, 1362 (Fed. Cir. 2015), cert. denied, 136 S.Ct. 701, 193 L. Ed. 2d 522 (2015) (collecting cases). In addition, "we have treated collecting information, including when limited to particular content (which does not change its character as information), as within the realm of abstract ideas." Elec. Power Grp., LLC v. Alstom S.A., 830 F.3d 1350, 1353 (Fed. Cir. 2016) (collecting cases); see also, e.g., In re TLI Commc'ns LLC Patent Litig., 823 F.3d 607, 611 (Fed. Cir. 2016); FairWarning IP, LLC v. Iatric Sys., Inc., 839 F.3d 1089, 1095 (Fed. Cir. 2016). Mental steps, including mathematical algorithms, are also generally considered abstract ideas. Elec. Power Grp., 830 F.3d at 1353 (collecting cases); see, e.g., Parker v. Flook, 437 U.S. 584, 589-90, 98 S.Ct. 2522, 57 L.Ed.2d 451 (1978); Gottschalk v. Benson, 409 U.S. 63, 67, 93 S.Ct. 253, 34 L.Ed.2d 273 (1972). However, the Federal Circuit has recognized that "precision has been elusive in defining an all-purpose boundary between the abstract and the concrete." Internet Patents, 790 F.3d at 1345. Courts must tow the fine line between assessing a claim's "character as a whole" and "describing the claims at such a high level of abstraction and untethered from the language of the claims [such that it] all but ensures that the exceptions to § 101 swallow the rule." Enfish, 822 F.3d at 1335, 1337.

To date, the Federal Circuit has provided two examples of software claims that are not directed to an abstract idea. First, in Enfish, the Federal Circuit determined that claims directed to a specific type of self-referential table constituted a specific "solution to a problem in the software arts" such that they were "non-abstract improvements to computer technology." 822 F.3d at 1339. The court noted that "[t]he Supreme Court has suggested that claims `purport[ing] to improve the functioning of the computer itself,' or `improv[ing] an existing technological process' might not succumb to the abstract idea exception." Id. at 1335. The court found that because the claims focused "on the specific asserted improvement in computer capabilities (i.e., the self-referential table for a computer database)" instead of "a process that qualifies as an `abstract idea' for which computers are invoked merely as a tool," they were not directed to an abstract idea. Id. at 1335-36, 1339.

Second, in McRO, Inc. v. Bandai Namco Games Am. Inc., the Federal Circuit found that patents that automated part of a preexisting method for 3-D facial expression animation were not abstract because they "focused on a specific asserted improvement in computer animation, i.e., the automatic use of rules of a particular type." 837 F.3d 1299, 1314 (Fed. Cir. 2016). Here too the court found that this was not the case of using a computer as a tool to implement an abstract idea; instead, the claims set forth a process of following a distinct set of rules, which was different from the process used by human animators, to improve animation technology. Id. at 1314 ("It is the incorporation of the claimed rules, not the use of the computer, that `improved [the] existing technological process' by allowing the automation of further tasks."). This moved the clams beyond the realm of the abstract. Id.

However, not all claims relating to computer technologies are not abstract. Where the focus of the claims is on "certain independently abstract ideas that use computers as tools" instead of "an improvement in computers as tools," claims may fail step one. See, e.g., Elec. Power Grp., 830 F.3d at 1354; see, e.g., Affinity Labs of Texas, LLC v. DIRECTV, LLC, 838 F.3d 1253, 1262 (Fed. Cir. 2016) (claims relating to "deliver[ing] content to a handheld wireless electronic device" were directed to an abstract idea because they claimed "the general concept of out-of-region delivery of broadcast content through the use of conventional devices, without offering any technological means of effecting that concept"); Synopsys, Inc. v. Mentor Graphics Corp., 839 F.3d 1138, 1140 (Fed. Cir. 2016) (claims related to logic circuit design in computer hardware were "drawn to the abstract idea of: translating a functional description of a logic circuit into a hardware component description of the logic circuit"); Tranxition, Inc. v. Lenovo (United States) Inc., No. 2015-1907, 2016 WL 6775967, at *3 (Fed. Cir. Nov. 16, 2016) (claims relating to migration of computer settings were directed to an abstract idea because "manual migration is an abstract idea" and the claims merely "automate[d] the migration of data between two computers"). This has proven true for patents in the computer security space. For example, in BASCOM Glob. Internet Servs., Inc. v. AT&T Mobility LLC, the Federal Circuit found that claims2 reciting an Internet content filtering system were directed to an abstract idea because "filtering content . . . is a longstanding, well-known method of organizing human behavior, similar to concepts previously found to be abstract." 827 F.3d 1341, 1348 (Fed. Cir. 2016). In Intellectual Ventures I LLC v. Symantec Corp., the Federal Circuit found claims3 related to filtering unwanted content from email were directed to an abstract idea because "it was long-prevalent practice for people receiving paper mail to look at an envelope and discard certain letters, without opening them, from sources from which they did not wish to receive mail based on characteristics of the mail" and "[c]haracterizing e-mail based on a known list of identifiers is no less abstract." 838 F.3d 1307, 1314 (Fed. Cir. 2016). The court found these claims distinguishable from those in Enfish and McRO because there was no "specific or limiting recitation of . . . improved computer technology;" instead, they merely "use[d] generic computers to perform generic computer functions." Id. at 1315, 1316. Thus, non-abstract claims that "improve the functioning of the computer itself," Alice, 134 S.Ct. at 2359, such as those in Enfish and McRO, remain a narrow class.

In assessing step two, courts must "consider the elements of each claim both individually and `as an ordered combination'" and assess whether there are any "additional features" in the claims that constitute an "inventive concept." Alice, 134 S.Ct. at 2357. This inventive concept "must be significantly more than the abstract idea itself," BASCOM, 827 F.3d at 1349, "must be more than well-understood, routine, conventional activity," Affinity, 838 F.3d at 1262, "and cannot simply be an instruction to implement or apply the abstract idea on a computer." BASCOM, 827 F.3d at 1349. For example, it may be found in an "inventive set of components or methods," "inventive programming," or an inventive approach in "how the desired result is achieved." Elec. Power Grp., 830 F.3d at 1355.

To date, the Federal Circuit has found an inventive concept in three cases. First, in DDR Holdings, LLC v. Hotels.com, L.P., the Federal Circuit found that claims that addressed the "Internet-centric problem" of third-party merchant advertisements that would "lure . . . visitor traffic away" from a host website (because clicking on the advertisement would redirect the visitor to the merchant's website) amounted to an inventive concept. 773 F.3d 1245, 1248, 1259 (Fed. Cir. 2014). The claims solved this problem by generating composite websites that combined the visual elements of the host's webpage with the content of the third-party merchant. Id. at 1248. The Federal Circuit reasoned that the claims "specify how interactions with the Internet are manipulated to yield a desired result" such that the interactions are "not merely the routine or conventional use of the Internet." Id. at 1259. Accordingly, there was sufficient transformation for the claims to not be patent-ineligible. Id.

Second, in BASCOM, the Federal Circuit found that the claims directed to Internet content filtering recited the inventive concept of "install[ing] a filtering tool at a specific location, remote from the end-users, with customizable filtering features specific to each end user." 827 F.3d at 1350. The court reasoned that "an inventive concept can be found in the non-conventional and non-generic arrangement of known, conventional pieces." Id. The court found this to be the case there because the patents claimed a specific type of content filtering that took advantage of an ISP server's ability to associate internet requests with user accounts. Id. Thus, they "harnesse[d] [a] technical feature of the network" to claim a "specific method of filtering Internet content cannot be said, as a matter of law, to have been conventional or generic." Id.

Third, in Amdocs (Israel) Ltd. v. Openet Telecom, Inc., the Federal Circuit found that claims relating to solutions for managing accounting and billing data over large, disparate networks recited an inventive concept because they contained "specific enhancing limitation[s] that necessarily incorporates the invention's distributed architecture—an architecture providing a technological solution to a technological problem." No. 2015-1180, 2016 WL 6440387, at *11 (Fed. Cir. Nov. 1, 2016). Use of this "distributed architecture" transformed the claims into patentable subject matter. Id.

Nevertheless, not all technological aspects of how a patented invention is implemented supply a basis for finding an "inventive concept." A claim that simply takes an abstract idea and adds "the requirement to perform it on the Internet, or to perform it on a set of generic computer components . . . would not contain an inventive concept." BASCOM, 827 F.3d at 1350. For example, in Content Extraction & Transmission LLC v. Wells Fargo Bank, Nat. Ass'n, the Federal Circuit found that claims directed to the abstract ideas of extracting data and recognizing patterns did not recite an inventive concept because they simply recited "generic scanner and computer to perform well-understood, routine, and conventional activities commonly used in industry." 776 F.3d 1343, 1348 (Fed. Cir. 2014), cert. denied, 136 S.Ct. 119, 193 L. Ed. 2d 208 (2015). In Affinity Labs, the court found there was no inventive concept because "[t]he claim simply recites the use of generic features of cellular telephones, such as a storage medium and a graphical user interface, as well as routine functions, such as transmitting and receiving signals, to implement the underlying idea." 838 F.3d at 1262. In Intellectual Ventures I, the court found that the claimed email filtering methods and systems did not recite an inventive concept because "the asserted claims describe only generic computer elements" or "generic computers that use generic virus screening technology." 838 F.3d at 1316, 1320. Accordingly, the search for an inventive concept remains one that court must approach cautiously, "scrutiniz[ing] the claim elements more microscopically" than in step one. Elec. Power Grp., 830 F.3d at 1354.

In addition to these principles, several other considerations may be helpful in conducting a § 101 analysis: First, the Supreme Court has recognized that the "concern that undergirds [the] § 101 jurisprudence" is preemption. Alice, 134 S. Ct. at 2358. If a claim is so abstract so as to "pre-empt use of [the claimed] approach in all fields, and would effectively grant a monopoly over an abstract idea" is not patent-eligible. Bilski v. Kappos, 561 U.S. 593, 612, 130 S.Ct. 3218, 3231, 177 L. Ed. 2d 792 (2010). However, the inverse is not true: "[w]hile preemption may signal patent ineligible subject matter, the absence of complete preemption does not demonstrate patent eligibility." FairWarning, 839 F.3d at 1098 (internal quotation marks and citation omitted).

Second (and relatedly), "claims that are `so result-focused, so functional, as to effectively cover any solution to an identified problem' are frequently held ineligible under section 101." Affinity Labs, 838 F.3d at 1265. For example, in Elec. Power Grp., the Federal Circuit found that claims directed to "any way of effectively monitoring multiple sources on a power grid" instead of "some specific way of enabling a computer to monitor data from multiple sources across an electric power grid" did not contain an inventive concept. 830 F.3d at 1356. The Federal Circuit has noted that this framework "is one helpful way of double-checking the application of the Supreme Court's framework to particular claims—specifically, when determining whether the claims meet the requirement of an inventive concept in application." Id.

III. DISCUSSION

With these principles in mind, the Court turns to the claims at issue. As set forth below, the Court finds that the asserted claims of the `494 patent are not patent-ineligible because, although they are directed to an abstract idea, they recite an inventive concept. 134 S. Ct. at 2355.

A. Relevance of `194 Patent

Before turning to the merits, this case requires the Court to clarify the scope of materials relevant to its analysis. This case presents an interesting scenario where the claims themselves are basic and broad, but significant clarifying detail is provided in a specification that belongs not to the `494 patent itself, but to a parent patent (the `194 patent), which the `494 patent identifies and declares to be "hereby incorporated by reference." `494 patent, col. 1 ll. 37-38. Finjan, unsurprisingly, urges the Court to pay particular attention to these details and argues that the `494 patent successfully incorporates them by reference. Hrg. Tr. at 24:2-25:18, 50:6-53:4. Blue Coat responds that the focus must remain on the claims themselves and that, in any event, the `494 patent does not identify the `194 disclosure with sufficient particularity to incorporate it by reference. ECF 144 at 1-3. The Court addresses these issues in turn.

As with any matter involving the scope of the patent grant, "[t]he § 101 inquiry must focus on the language of the Asserted Claims themselves." Synopsys, 839 F.3d at 1142. Accordingly, "the complexity of the implementing software or the level of detail in the specification does not transform a claim reciting only an abstract concept into a patent-eligible system or method." Accenture Glob. Servs., GmbH v. Guidewire Software, Inc., 728 F.3d 1336, 1345 (Fed. Cir. 2013). Nevertheless, the specification, as a helpful tool in understanding claim scope, is not to be ignored entirely. See Enfish, 822 F.3d at 1335 ("The `directed to' inquiry applies a stage-one filter to claims, considered in light of the specification, based on whether their character as a whole is directed to excluded subject matter.") (internal quotation marks and citation omitted). The Court is not required to undertake a full claim construction process in order to do this. Content Extraction, 776 F.3d at 1349 ("Although the determination of patent eligibility requires a full understanding of the basic character of the claimed subject matter, claim construction is not an inviolable prerequisite to a validity determination under § 101."). Rather, the Court may interpret the claims in the light most favorable to the non-moving party, Finjan, bounded by what Federal Circuit law on claim construction allows. See Manzarek, 519 F.3d at 1031 (in ruling on a Rule 12(c) motion, a court must "construe the pleadings in the light most favorable to the nonmoving party"); cf. Ultramercial, Inc. v. Hulu, LLC, 722 F.3d 1335, 1339-40 (Fed. Cir. 2013), cert. granted, judgment vacated sub nom. WildTangent, Inc. v. Ultramercial, LLC, 134 S.Ct. 2870, 189 L. Ed. 2d 828 (2014) ("At summary judgment, the district court may choose to construe the claims in accordance with this court's precedent, or if not it may choose to give a construction most favorable to the patentee, and to apply the usual rules pertaining to summary judgment from there, and still require clear and convincing evidence of ineligible subject matter.").4

Accordingly, in assessing patent eligibility here, the Court must restrict itself to the language of the asserted claims of the `494 patent, which recite, in relatively broad terms, only three basic functions: receiving, deriving, and storing. Nevertheless, each of these functions should be read in light of the specification, including its detailed descriptions of how a "Downloadable" is "receiv[ed]" or how "security profile data" is "deriv[ed]." Because the Court must construe the pleadings in favor of Finjan, Manzarek, 519 F.3d at 1031, the Court must err on the side of incorporating more—not less—particularities from the specification into its understanding of the claims, while still refraining from importing limitations from the specification into the claim, Phillips v. AWH Corp., 415 F.3d 1303, 1323 (Fed. Cir. 2005). In addition, the Court will rely on the parties' agreed-upon construction of "Downloadable" as "an executable application program, which is downloaded from a source computer and run on the destination computer." ECF 79 at 1.

This leads to the question of what constitutes the specification in this case. The `494 patent identifies itself as an eventual "continuation of assignee's US. patent application Ser. No. 08/964,388, filed on Nov. 6, 1997 by inventor Shlomo Touboul, now US. Pat. No. 6,092,194, also entitled `System and Method for Protecting a Computer and a Network from Hostile Downloadables' and hereby incorporated by reference." `494 patent, col. 1 ll. 33-38. The Court finds that this language is sufficient to incorporate the entire `194 patent by reference. According to the Federal Circuit, "[t]o incorporate material by reference, the host document must identify with detailed particularity what specific material it incorporates and clearly indicate where that material is found in the various documents." Zenon Envtl., Inc. v. U.S. Filter Corp., 506 F.3d 1370, 1378 (Fed. Cir. 2007). Here, the `494 patent identifies the material it is incorporating with sufficient particularly: it indicates that it is incorporating the entire `194 patent, and provides enough information for the reader to locate this information. More detail, such as identification of specific subject matter, is not necessary, as holding otherwise would render any incorporation of a document in full a practical impossibility.

Blue Coat nevertheless contends that Federal Circuit precedent directs otherwise, citing two decisions which declined to incorporate the entirety of another patent's disclosure. However, these cases are inapposite, as they relate to instances where only discussion of a particular topic from another specification was being incorporated. See Zenon Envtl., Inc., 506 F.3d at 1379 (incorporating language stated that "[f]urther details relating to the construction and deployment of a most preferred skein are found in the parent U.S. Pat. No. 5,639,373, and in Ser. No. 08/690,045, the relevant disclosures of each of which are included by reference thereto as if fully set forth herein"); Cook Biotech Inc. v. Acell, Inc., 460 F.3d 1365, 1375 (Fed. Cir. 2006) (incorporating language stated that "[t]he preparation of UBS from a segment of urinary bladder is similar to the procedure for preparing intestinal submucosa detailed in U.S. Patent No. 4,902,508, the disclosure of which is expressly incorporated herein by reference"). In those cases, it would make sense that incorporation language would require more particularity. Here, it does not. Accordingly, the Court is persuaded that the `494 patent successfully incorporates the entirety of the `194 patent's disclosure by reference.

B. Patent Eligibility Under 35 U.S.C. § 101

i. Alice Step One: Whether the Claims are Directed to an Abstract Idea

Having clarified that the `194 patent is part of the `494 specification and that its disclosures are relevant to the Court's understanding of the claimed functions, the Court proceeds to assess whether the asserted claims are patent-eligible under § 101. In step one of the Alice framework, the Court must determine whether the "claims, considered in light of the specification, based on whether their character as a whole is directed to excluded subject matter." Enfish, 822 F.3d at 1335; Alice, 134 S. Ct. at 2355.

Blue Coat contends that the asserted claims pass step one because they are directed to the abstract idea of data gathering—i.e., "receiving information, identifying certain characteristics of that information, and storing those characteristics." Mot. 6, ECF 104. Blue Coat analogizes the claim elements to steps that could be performed by a mailroom clerk: the clerk receives a package in a mailroom, makes a list on a notepad of potentially hazardous materials in the package, and stores the notepad in a cabinet. Id. According to Blue Coat, this is the same type of data gathering that the Federal Circuit has found abstract in other cases, including Elec. Power Grp., 830 F.3d at 1354; OIP Techs., 788 F.3d at 1361; and Mayo, 132 S. Ct. at 1297-98. Mot. 7-8, ECF 104. Blue Coat also argues that this case is distinguishable from Enfish and McRO because the claims are broader and more abstract than those that were at issue in those cases: instead of reciting a specific type of security profiling technology, they claim the general concept of security profiling. Reply 2-3, ECF 115. According to Blue Coat, this is not enough for the claims at issue to be considered non-abstract improvements to computer technology. Id.

Finjan responds that the claims are not abstract because they are directed to a computer-specific solution to a computer-specific problem: malware on a computer network. Opp. 4-5, ECF 109. Finjan argues that Blue Coat's position relies on an overgeneralization: the claimed solution relies on a specific type of data security profile which must include a list of computer operations; to that, Finjan, argues, there is no non-computer equivalent. Opp. 5-6, 9-10, ECF 109. For this reason, Finjan presses, the asserted claims fall squarely within the Federal Circuit's ruling in Enfish because, by providing a better way to detect malware, they are "directed to a specific improvement to the way computers operate." Opp. 6-7, ECF 109.

The Court agrees with Blue Coat that the asserted claims are directed to an abstract idea. Although they are deployed in the context of malware detection, the asserted claims merely recite the familiar concepts of gathering data, analyzing that data for certain characteristics, and storing the results of that analysis. These are fundamental concepts germane to any type of content analysis. See Intellectual Ventures I, 838 F.3d at 1314 (quoting Alice, 134 S.Ct. at 2356) ("The Supreme Court has held that `fundamental . . . practice[s] long prevalent' are abstract ideas."). This is true even when the asserted claims are given the full benefit of the technical details disclosed in the `194 patent. At their heart, they claim nothing more than a solution that scans through data (e.g., the disassembled code from the code scanner, `194 patent, col. 5 ll. 41-45, col. 9 ll. 20-42), identifies certain characteristics (e.g., the operations that match its pre-existing list of operations, `194 patent, col. 5 l. 45-col. 6 l. 4), and stores the results of the analysis (e.g., the list of suspicious operations encountered, stored as formatted DSP data, `194 patent, col. 6 ll. 9-10). This is not inherently different from how a human would perform a classification process with pencil and paper. This observation is true of both independent claims (claims 1 and 10) and dependent claims (claims 14, 15, and 18), as the additional limitations in the dependent claims simply restrict the context in which this process is performed. The focus, however, remains the same. Accordingly, the "character as a whole" of the claims is directed to data collection and analysis, an abstract idea.

This finding is consistent with conclusions that the Federal Circuit has reached in similar cases. In a number of cases, the court has found that claims directed to data collection and analysis recited an abstract idea. See Elec. Power Grp., 830 F.3d at 1353 (collecting cases); see also, e.g., In re TLI Commc'ns LLC Patent Litig., 823 F.3d at 611; FairWarning, 839 F.3d at 1098. This has held true even where the data collection and analysis was used to solve computer-related problems, such as malware. See, e.g., BASCOM, 827 F.3d at 1348 (claims directed to content filtering on the Internet recited an abstract idea); Intellectual Ventures I, 838 F.3d at 1314 (claims directed to filtering email for spam and viruses recited an abstract idea). The claims at issue here are no less abstract than those at issue in BASCOM and Intellectual Ventures I. If anything, they are more so, as they recite fewer steps and less technical detail. Compare U.S. Patent No. 5,987,606 at col. 6 l. 62-col. 7 l. 10 and U.S. Patent No. 6,460,050 at col. 8, ll. 13-26, with `494 patent at col. 21 ll. 18-25, col. 22 ll. 7-17, 26-30, 37-39.

Finjan nevertheless contends that the claims are not abstract because they provide a better way to solve the computer-specific problem of malware on a computer network, and are thus, as in Enfish, "directed to a specific improvement to the way computers operate." Op. 4-7. The Court disagrees. Simply because claims recite a computer technology does not mean that they are not directed to an abstract idea. See, e.g., Affinity Labs, 838 F.3d at 1262; Synopsys, 839 F.3d at 1140; Tranxition, No. 2015-1907, 2016 WL 6775967, at *3. Instead, in order to be non-abstract under Enfish/McRO, claims must focus on an "improvement in computers as tools" rather than "uses of existing computers as tools in aid of processes focused on `abstract ideas.'" Elec. Power Grp., 830 F.3d at 1354. The asserted claims here focus on the latter. They recite use of generic computer components to perform data collection and analysis generally. They do not recite an improvement to a particular computer technology used in malware detection —they do not, for example, claim an improvement to a specific, preexisting malware detection algorithm or recite special data structures that fundamentally improve the process of detecting malware. Although the Court appreciates that "deriving security profile data" may, if construed narrowly, involve a certain process of extracting code and identifying certain suspicious operations, the "character as a whole" of this process remains focused on the abstract idea of data collection and analysis, not on a fundamental improvement to computer operation. Enfish, 822 F.3d at 1335. Accordingly, for these reasons, the claims are directed to an abstract idea under step one of Alice, 134 S. Ct. at 2355.

The Court notes that this conclusion differs from the result it reached Finjan I, where it determined that the asserted claims (claims 1, 7, 11, 15, and 41) of the `844 patent were not directed to an abstract idea. Finjan I, ECF 486 at 13-18. This determination predated many of the Federal Circuit decisions that now guide the Court's step one analysis, including Enfish, 822 F.3d at 1339, McRO, 837 F.3d at 1314, Elec. Power Grp., 830 F.3d at 1353, BASCOM, 827 F.3d at 1348, and Intellectual Ventures I, 838 F.3d at 1314. If, to any extent, the Court's reasoning in Finjan I conflicts with Federal Circuit precedent, Federal Circuit precedent controls. Further, in Finjan I, the Court found the Patent Office's guidance persuasive. See "2014 Interim Guidance on Patent Subject Matter Eligibility (Interim Eligibility Guidance) for USPTO personnel to use when determining subject matter eligibility under 35 U.S.C. § 101 in view of recent decisions by the U.S. Supreme Court, including Alice Corp., Myriad, and Mayo," available at www.uspto.gov/patent/laws-and-regulations/examination-policy (last visited November 9, 2015) (hereinafter "Patent Office's Guidance"). The example claim given in the Patent Office's Guidance is distinguishable from the asserted claims of the `494 patent because the example claim is directed to creating a sanitized version of a suspicious file, not merely collecting and analyzing information from that file. The asserted claims of the `494 patent are also more different from the example claim than the asserted claims of the `844 patent because the `844 claims recite taking a protective step (specifically, "linking by the inspector the first Downloadable security profile to the Downloadable before a web server makes the Downloadable available to web clients"), whereas the `494 claims stop at collecting and storing data.

ii. Alice Step Two: Whether the Asserted Claims Contain an "Inventive Concept" Sufficient to Confer Patent Eligibility

Because the claims are directed to an abstract idea, the Court turns to step two, which requires that it "consider the elements of each claim both individually and `as an ordered combination'" to identify whether they recite an "inventive concept" which "`transform[s] the nature of the claim' into a patent-eligible application." Alice, 134 S.Ct. at 2355. (quoting Mayo, 132 S.Ct. at 1298, 1297).

Blue Coat argues that the claims do not contain an "inventive concept" because they recite only routine, well-understood features (e.g., computer, database, scanner, manager) and activities (e.g., receiving, deriving, storing), none of which is inventive or transformative. Mot. 8-12, ECF 104. Finjan responds that the claims do contain an "inventive concept" because they recite a novel approach to malware detection that is based on deriving a profile of actual, suspicious operations that may be attempted by a file, which is a non-conventional and non-generic arrangement of computer elements. Opp. 13, ECF 109.

The Court agrees with Finjan that the claims, taken as an ordered combination, recite an inventive concept sufficient to render them patent-eligible. As the `494 patent explains, at the time of invention, virus protection was localized and reactive: virus protection programs were installed on individual, end-user computers and only checked to see if incoming files were known viruses. `494 patent, col. 2 ll. 11-21. The `494 patent claims both spatial and temporal alterations to this paradigm, the combination of which results in "non-conventional and non-generic arrangement of known, conventional pieces" that are sufficiently transformative to constitute an "inventive concept." BASCOM, 827 F.3d at 1350.

First, spatially, the `494 claims move malware profiling from its traditional location on end-user computers to an intermediate location on the network. Although not explicit in the claims, the specification makes clear that all of the asserted claims recite operations that are performed on a network server, not an end-user's computer. All embodiments of the protection engines disclosed in the `494 and `194 specifications reside on a network server. See `494 patent, col. 2 l. 20-col. 3 l. 4; `194 patent, col. 3 ll. 10-21. In addition, the `194 specification discloses that the code scanner, the particular component that performs the analysis to derive the data security profile, resides in the Internal Network Security System, which sits in between the external computer network and end-user computers. `194 patent, Fig. 1; col. 3 ll. 10-13. Accordingly, the claimed "receiving," viewed in a light most favorable to Finjan, refers to an operation that happens at an intermediate network location, not on an end-user computer. (And by extension, the "receiver" in claim 10 refers to a component at this network location.) As such, the `494 claims harness specific network architecture and use it in a "non-conventional and non-generic arrangement" to offer improved malware protection for an internal computer network as a whole. BASCOM, 827 F.3d at 1350. Accordingly, this is a "specific technical solution beyond simply using generic computer concepts in a conventional way" which helps transform the claims into patentable subject matter. Id. at 1352.

Second, temporally, the `494 claims shift malware profiling logic from something that must be applied to a single, complete file to something that must be applied to extracted aspects or components of a file (namely, operations) after it has been decomposed. Although this process is not laid out in the claims themselves, the Court finds that "deriving security profile data," if construed in a light most favorable to Finjan, at least requires a process of parsing through a Downloadable and creating a list of all potentially suspicious computer operations. The claims themselves recite that "security profile data" must include "a list of suspicious computer operations that may be attempted by the Downloadable." `494 patent, col. 21 ll. 22-23, col. 22 ll. 11-12. By necessity, then, "deriving" must include some means of extracting and identifying these operations. Only the `194 specification uses the phrase "downloadable security profile data," and the only embodiment of deriving security profile data that it discloses involves a precise process of decomposing code and extracting operations. `194 patent, col. 9 ll. 20-42, Fig. 7. Thus, a person of ordinary skill in the art would understand "deriving security profile data" to refer to this type of process. At the time, this move from profiling at the file level to profiling at the operation level was non-conventional rearrangement of the malware profiling process. See `494 patent, col. 2 ll. 11-21. This provided for better, more effective malware detection because even if a new virus was launched into the network, it could still be detected because it performed certain suspicious operations. See `494 patent, col. 2 ll. 56-64. This too constituted a "specific technical solution beyond simply using generic computer concepts in a conventional way," which helps transform the claims into patentable subject matter. BASCOM, 827 F.3d at 1352.

Taking these spatial and temporal shifts together, viewed in the light most favorable to Finjan, the Court concludes that the claims recite an inventive concept, rendering them not patent-ineligible even though they are directed to an abstract idea.

IV. CONCLUSION

For the foregoing reasons, the Court concludes that the asserted claims of the `494 patent are not patent-ineligible under 35 U.S.C. § 101 because, although they are directed to an abstract idea, they contain an inventive concept sufficient to transform these claims into patentable subject matter. Accordingly, the Court DENIES Blue Coat's motion for judgment on the pleadings.

IT IS SO ORDERED.