US 10313385

US patent 10313385, titled "Systems and methods for data driven game theoretic cyber threat mitigation," was filed on November 28, 2016, and issued on June 4, 2019. The current assignee is Skysong Innovations LLC. The inventors are Paulo Shakarian, John Robertson, Jana Shakarian, Vivin Paliath, and Amanda Thart.

The patent's abstract describes a data-driven security game framework that models an attacker using exploit market data actively mined from the "darknet" to develop defense strategies for a defender.

A plain-language overview of the independent claims is as follows:

• Independent Claim 1 (System): This claim describes a computer system designed to protect against cyberattacks. It uses a network connection to access darknet information about exploits. The system obtains a set of exploits from this data and uses an "exploit function" to identify the vulnerabilities they target. It then creates a "constraint set" of essential vulnerabilities for the computer system's operation. By virtually applying the exploits to this constraint set, the system detects specific vulnerabilities and, in response, alters the computer system's configuration to reduce potential damage from a cyberattack.

• Independent Claim 8 (Method): This claim details a method for improving a computing device. It involves accessing darknet information related to a computer system to obtain exploits that can bypass security features. An exploit function is used to identify vulnerabilities from these exploits. A constraint set of vulnerabilities, representing minimum operational dependencies, is created. The method analyzes the effect of the exploits on this constraint set to detect particular vulnerabilities and subsequently alters the computer system's configuration to mitigate cyberattack damage.

• Independent Claim 15 (Computer-Readable Medium): This claim covers a non-transitory computer-readable storage medium storing instructions that, when executed, perform a process. This process includes obtaining exploits from darknet information to bypass a computer system's security features, applying an exploit function to identify vulnerabilities, and creating a constraint set of vulnerabilities essential for the computer system's operation. The process then applies the exploits to this constraint set, analyzes the results to detect specific vulnerabilities, and alters the computer system's configuration to reduce potential damage from a cyberattack.

CAFC 2026 Dockets:
A search for CAFC dockets specifically referencing US10313385 in 2026 did not yield any direct results. The patent record indicates current litigation in the Texas Western District Court (case 7:25-cv-00040) and Texas Eastern District Court (case 2:25-cv-00098), as well as a PTAB case (IPR2025-01397 filed by Crowdstrike, Inc., though its status is "Not Instituted - Procedural"). However, as of April 26, 2026, there is no authoritative information available indicating that any of these cases have proceeded to the Court of Appeals for the Federal Circuit within the 2026 timeframe.

US Patent 10313385, titled "Systems and methods for data driven game theoretic cyber threat mitigation," is involved in the following litigation:

District Court Cases:

• Plaintiff(s): Skysong Innovations, LLC

• Defendant(s): CrowdStrike, Inc. and CrowdStrike Holdings, Inc.

• Jurisdiction: United States District Court for the Western District of Texas

• Case Number: 7:25-cv-00040

• Filing Date: January 31, 2025

• Outcome/Current Status: Ongoing. Skysong Innovations, LLC filed a complaint for patent infringement. A scheduling order was issued in Dkt. No. 55.

• Plaintiff(s): Skysong Innovations, LLC

• Defendant(s): Fortinet, Inc.

• Jurisdiction: United States District Court for the Eastern District of Texas

• Case Number: 2:25-cv-00098

• Filing Date: January 31, 2025

• Outcome/Current Status: Ongoing. Skysong Innovations, LLC filed a complaint for patent infringement. A notice of attorney appearance and a demand for trial by jury have been filed by Fortinet, Inc.

Patent Trial and Appeal Board (PTAB) Cases:

• Petitioner: CrowdStrike, Inc.
• Patent Owner: Skysong Innovations, LLC
• Jurisdiction: Patent Trial and Appeal Board (PTAB)
• Case Number: IPR2025-01397
• Filing Date: August 15, 2025
• Outcome/Current Status: Terminated on December 11, 2025. This case was an Inter Partes Review (IPR) proceeding. The status is noted as "Not Instituted - Procedural" on Google Patents. CrowdStrike, Inc. had filed a "Notice of Sotera Plus Stipulation" in September 2025, stating they would not pursue certain grounds in parallel litigation if the IPR was instituted.

Proceedings overview

There is one AIA trial proceeding on file for US Patent 10,313,385. This proceeding, IPR2025-01397, was denied institution, meaning no claims were challenged on the merits. This status indicates the patent has not been subjected to a full PTAB trial and its claims remain unadjudicated in an AIA proceeding, leaving the defensive posture relatively strong against an IPR-based invalidity challenge.

IPR2025-01397 — CrowdStrike, Inc. v. Skysong Innovations LLC

• Type: Inter Partes Review
• Filed: 2025-08-15
• Status: Discretionary Denial. The petition was not instituted by the PTAB.
• Judge panel: I do not have information on the specific judge panel for this proceeding.
• Petition grounds: I do not have specific details on the claims challenged, prior art cited, or statutory bases (§ 102 / § 103 / § 112) from the provided information or readily available public search results at this time.
• Institution decision: The petition was denied institution. The date of the "last modified" entry is 2026-02-19, which likely indicates the date of the institution decision or a related procedural update. A "Discretionary Denial" typically means the PTAB chose not to institute the trial, often based on factors like parallel district court litigation (e.g., Fintiv factors), efficient administration of justice, or insufficient grounds for institution. Without access to the decision itself, the exact reasoning is not available.
• Final Written Decision (if issued): Not applicable, as the petition was denied institution.
• Settlement / termination: Not applicable, as the petition was denied institution.
• Appeal: Not applicable, as the petition was denied institution.
• Defensive value: The discretionary denial of IPR2025-01397 means that the patent owner, Skysong Innovations LLC, successfully prevented a PTAB trial from commencing. For a defendant facing assertion of this patent, this outcome means that the validity of the patent's claims has not been formally tested and invalidated in this IPR. Any future IPR challenging the same claims with the same or substantially similar prior art might face estoppel under 35 U.S.C. § 315(e)(1), though the grounds for the denial would need to be considered.

Strategic summary

All claims of US Patent 10,313,385 are currently UNTESTED in AIA trial proceedings. IPR2025-01397 was denied institution, so there has been no adjudication on the merits of any claim, and therefore no claims have been canceled or sustained by the PTAB.

Regarding the estoppel landscape, since IPR2025-01397 was denied institution (not institued to a trial), 35 U.S.C. § 315(e)(2) inter partes estoppel does not apply to the petitioner (CrowdStrike, Inc.) or its privies for any grounds that were or reasonably could have been raised in the petition. This means the prior-art grounds presented in the petition remain theoretically available for future challenges, either in district court litigation or potentially in a new IPR by a different party, depending on the specific reasoning for the discretionary denial. However, the Board's reasoning for the discretionary denial could still influence future petitions. The denial also indicates that the patent owner successfully defended against this particular challenge without having to litigate the merits of the claims.

There is a pattern signal that Unified Patents has filed litigation in the Texas Western and Eastern District Courts, which indicates active assertion of the patent. The IPR was filed by CrowdStrike, Inc. The current assignee is Skysong Innovations LLC, having been assigned the patent on 2025-01-30.

Recommended next steps

The single IPR (IPR2025-01397) was denied institution. While the specific reasoning for the discretionary denial is not publicly available here, it indicates that the PTAB declined to proceed with a full trial. This means that, for a defendant, the validity of the patent's claims has not been challenged and invalidated at the PTAB.

For a potential defendant, obtaining the institution decision for IPR2025-01397 would be critical to understand the precise basis for the discretionary denial. This decision could reveal specific weaknesses in the petition or procedural considerations that led to the denial, which would inform any future validity challenges. Without this, it's difficult to assess the full impact on the patent's robustness.

Since there are no active PTAB proceedings on the merits, the patent has not been narrowed or found unpatentable by the PTAB. This could mean a higher bar for future PTAB challenges, especially if the discretionary denial was based on merits-adjacent reasons or Fintiv considerations related to overlapping litigation.

The absence of an instituted IPR means the patent remains "hardened" against this specific type of challenge. However, the existence of litigation activity filed in Texas Western District Court (case 7:25-cv-00040) and Texas Eastern District Court (case 2:25-cv-00098) suggests the patent is being actively asserted. Any defensive strategy should consider these ongoing assertions in addition to the PTAB history.

Inventors

• Paulo Shakarian (Arizona State University Downtown Phoenix campus)
• John Robertson (Arizona State University Downtown Phoenix campus)
• Jana Shakarian (Arizona State University Downtown Phoenix campus)
• Vivin Paliath (Arizona State University Downtown Phoenix campus)
• Amanda Thart (Arizona State University Downtown Phoenix campus)

All inventors were affiliated with Arizona State University Downtown Phoenix campus at the time of filing.

Original assignee

The original assignee named on the issued patent is Arizona State University Downtown Phoenix campus. It is a public research university and is not primarily in the business of shipping commercial products embodying patent claims, but rather research and education. Its current status is operating.

Assignment timeline

• 2016-11-29 (executed) / recorded 2016-12-21 — Reel 041165/0676

  • Conveyance: ASSIGNMENT OF ASSIGNORS INTEREST
  • Assignor: PALIATH, VIVIN; THART, AMANDA; ROBERTSON, JOHN; SHAKARIAN, JANA; SHAKARIAN, PAULO
  • Assignee: ARIZONA BOARD OF REGENTS ON BEHALF OF ARIZONA STATE UNIVERSITY
  • Correspondent: GREGORY J. JAFFE, THE CASEY GROUP, P.C., 1133 WEST NORTHERN AVENUE, SUITE 210, CASA GRANDE, AZ 85122
  • Context: Internal reorg/transfer from inventors to university board.

• 2025-01-29 (executed) / recorded 2025-01-30 — Reel 070067/0096

  • Conveyance: ASSIGNMENT OF ASSIGNORS INTEREST
  • Assignor: ARIZONA BOARD OF REGENTS ON BEHALF OF ARIZONA STATE UNIVERSITY
  • Assignee: SKYSONG INNOVATIONS, LLC
  • Correspondent: GREGORY J. JAFFE, THE CASEY GROUP PC, 1133 WEST NORTHERN AVE, STE 210, CASA GRANDE, AZ 85122. This correspondent recurs in this chain.
  • Context: Internal transfer to a technology transfer organization.

Timeline diagram

timeline
    title Ownership of US 10313385
    2016 : Inventors assign to ASU Board of Regents
    2019 : Patent issued
    2025 : ASU Board of Regents to Skysong Innovations LLC

NPE / troll-pattern signals

1. Shell-entity transfer — unclear. While Skysong Innovations, LLC is a technology transfer organization associated with Arizona State University and is involved in commercializing university intellectual property, it is not definitively a shell entity in the typical NPE sense of having no products in commerce. It acts on behalf of the university.

2. Known asserter in the chain — not present. Skysong Innovations, LLC is not on common public NPE lists.

3. Repeat correspondent across the chain — present. Gregory J. Jaffe of The Casey Group, P.C. is listed as the correspondent for both the 2016-12-21 assignment (Reel 041165/0676) and the 2025-01-30 assignment (Reel 070067/0096).

4. Cascading transfers — not present. There are only two assignments recorded, nine years apart.

5. Pre-litigation transfer — present. The assignment to Skysong Innovations, LLC was executed on January 29, 2025, and recorded on January 30, 2025 (Reel 070067/0096). The first infringement suits (7:25-cv-00040 and 2:25-cv-00098) were filed on January 31, 2025. This transfer occurred just one or two days before the lawsuits.

6. Bankruptcy fire-sale — not present. No indication that Arizona State University or its Board of Regents filed for bankruptcy.

7. Privateering — unclear. There's no public information definitively indicating privateering.

8. Defensive aggregator (anti-NPE) — not present. The chain does not end at a defensive aggregator.

Verdict

Operating-company assertion The current assignee, Skysong Innovations, LLC, is the technology transfer organization for Arizona State University. While they are asserting the patent in litigation, the context indicates they are acting to commercialize the university's intellectual property, which aligns more closely with an operating-company assertion model than a traditional NPE. The pre-litigation transfer (Reel 070067/0096) just before the filing of infringement suits (on January 31, 2025) strongly suggests the transfer was made to enable assertion.

USPTO Assignment Center search for US10313385: https://assignmentcenter.uspto.gov/

The USPTO database confirms the details of US Patent 10313385, titled "Systems and methods for data driven game theoretic cyber threat mitigation." It was filed on November 28, 2016, and issued on June 4, 2019. The current assignee is Skysong Innovations LLC.

Here's an analysis of the most relevant prior art cited in US Patent 10313385:

Patent Citations:

1. US20040088565A1: "Method of identifying software vulnerabilities on a computer system"

   • Publication Date: May 6, 2004.
   • Brief Description: This patent application describes a method for identifying software vulnerabilities by monitoring messages exchanged between software components and comparing them to known vulnerability signatures.
   • Potential Anticipation (35 U.S.C. § 102): This reference potentially anticipates elements of claims 1, 8, and 15 related to "detect[ing] a particular vulnerability of the computer system" and "analyzing the application of the set of exploits on the computer system to detect a particular vulnerability." While US'385 focuses on darknet data and game theory, US'565A1 teaches the fundamental concept of identifying vulnerabilities within a computer system.

2. US8413238B1: "Monitoring darknet access to identify malicious activity"

   • Publication Date: April 2, 2013.
   • Brief Description: This patent describes systems and methods for identifying malicious activity by monitoring darknet access. It discusses darknets as unused IP addresses that typically receive traffic only due to accidents, backscatter, or malicious scanning. The system proactively scans addresses before notifying of malicious activity to reduce false positives.
   • Potential Anticipation (35 U.S.C. § 102): This reference is highly relevant to claims 1, 8, and 15, particularly the element of "accessing data through the network connection, the data comprising dark net information associated with exploits of a computer system" and "obtaining a set of exploits from the dark net information." US'238B1 explicitly teaches monitoring darknet access to identify malicious activity, which directly relates to obtaining information from the darknet about exploits.

3. US20130198848A1: "Remediation of computer security vulnerabilities"

   • Publication Date: August 1, 2013.
   • Brief Description: This patent application focuses on methods for remediating computer security vulnerabilities. It describes identifying vulnerabilities and then applying remediation techniques.
   • Potential Anticipation (35 U.S.C. § 102): This reference could potentially anticipate aspects of claims 1, 8, and 15 related to "altering a configuration of the computer system in response to the analysis of the application of the set of exploits to reduce potential damage of a cyberattack." While the mechanism of analysis in US'848A1 might differ, the core concept of identifying vulnerabilities and then altering system configuration for remediation is present.

4. US20140137257A1: "System, Method and Apparatus for Assessing a Risk of One or More Assets Within an Operational Technology Infrastructure"

   • Publication Date: May 15, 2014.
   • Brief Description: This patent application describes a system and method for assessing the risk of assets within an operational technology infrastructure. It involves identifying assets and their associated vulnerabilities, and then assessing the risk posed by those vulnerabilities.
   • Potential Anticipation (35 U.S.C. § 102): This reference might anticipate parts of claims 1, 8, and 15 concerning "quantifying a risk level posed to the computer system" (as mentioned in dependent claims 2, 9, and 16). The general concept of risk assessment based on vulnerabilities is a shared theme.

5. US8863293B2: "Predicting attacks based on probabilistic game-theory"

   • Publication Date: October 14, 2014.
   • Brief Description: This patent describes predicting attacks using probabilistic game theory. This involves modeling attacker and defender interactions as a game to anticipate attacker strategies.
   • Potential Anticipation (35 U.S.C. § 102): This is a highly relevant reference, particularly to the core "game theoretic" aspect of US'385. Claims 1, 8, and 15, which describe a system/method that models an attacker and a defender, and implicitly or explicitly uses this model to "alter[] a configuration of the computer system...to reduce potential damage of a cyberattack," could be anticipated. The fundamental idea of using game theory to predict and mitigate attacks is taught here.

6. US20150215332A1: "Cloud service usage risk assessment using darknet intelligence"

   • Publication Date: July 30, 2015.
   • Brief Description: This patent application details assessing cloud service usage risk by leveraging intelligence from the darknet. This involves collecting information from the darknet to understand potential threats to cloud services.
   • Potential Anticipation (35 U.S.C. § 102): This reference strengthens the prior art related to "accessing data through the network connection, the data comprising dark net information associated with exploits of a computer system" (claims 1, 8, 15). It explicitly teaches the use of "darknet intelligence" for risk assessment, which aligns with the data acquisition aspect of US'385, even if the application area (cloud services) differs.

The obviousness of US patent 10313385 under 35 U.S.C. § 103 can be established by combining multiple prior art references, as each element of the independent claims is taught or rendered obvious by existing art, and a person having ordinary skill in the art (POSA) would have been motivated to combine them. The patent's core innovation lies in integrating darknet exploit market data into a game-theoretic framework for cyber threat mitigation.

Independent Claims Overview

The independent claims (Claim 1, Claim 8, and Claim 15) generally cover a system, method, and computer-readable medium, respectively, for:

1. Accessing darknet information related to exploits.
2. Obtaining a set of exploits from this information.
3. Applying an exploit function to determine associated vulnerabilities.
4. Creating a "constraint set" of vulnerabilities representing minimum system dependencies.
5. Applying the exploits to this constraint set.
6. Analyzing the application to detect specific vulnerabilities.
7. Altering the computer system's configuration in response to reduce potential damage.

Combination of Prior Art References

A robust combination of prior art references that renders the independent claims obvious includes:

1. US20150215332A1 (Skyhigh Networks): Titled "Cloud service usage risk assessment using darknet intelligence." This reference teaches accessing and monitoring darknet information to gather intelligence on exploits and perform risk assessment.
2. US8863293B2 (International Business Machines Corporation): Titled "Predicting attacks based on probabilistic game-theory." This patent teaches the application of game theory to model and predict cyberattacks and develop defensive strategies.
3. US20140137257A1 (Board Of Regents, The University Of Texas System): Titled "System, Method and Apparatus for Assessing a Risk of One or More Assets Within an Operational Technology Infrastructure." This patent teaches identifying and assessing the risk of critical assets within an infrastructure, inherently involving the identification of their dependencies.
4. US20130198848A1 (Board Of Regents Of The University Of Texas System): Titled "Remediation of computer security vulnerabilities." This patent describes methods for identifying and remediating computer security vulnerabilities through various actions.
5. US20040088565A1 (Norman Andrew Patrick): Titled "Method of identifying software vulnerabilities on a computer system." This patent generally teaches the process of identifying software vulnerabilities.

Element-by-Element Analysis of Obviousness (using Claim 1 as representative)

Claim 1: A system for protecting a computer system from attack, the system comprising:

• "a network connection; a processing device; and a non-transitory computer-readable medium connected to the processing device configured to store instructions that, when executed by the processing device, performs the operations of:"
  • These are generic computing components. A POSA would understand that any software-implemented method, including those described in the prior art references, requires such basic hardware.
• "accessing data through the network connection, the data comprising dark net information associated with exploits of a computer system, comprising: obtaining a set of exploits from the dark net information, the set of exploits configured to penetrate the computer system;"
  • This element is explicitly taught by US20150215332A1 (Skyhigh Networks), which describes monitoring darknet access to identify malicious activity and utilizing darknet intelligence for risk assessment.
• "applying an exploit function which takes the set of exploits as input and returns a set of vulnerabilities;"
  • This is implicitly taught by US20040088565A1 (Norman Andrew Patrick), which details identifying software vulnerabilities. A POSA would understand that exploits are designed to target specific vulnerabilities, and creating a logical mapping or function (e.g., a database lookup) to relate known exploits to the vulnerabilities they target is a fundamental and obvious step in vulnerability analysis.
• "creating a constraint set of the computer system from the set of vulnerabilities, the constraint set comprising a minimum set of dependencies to operate the computer system;"
  • This element is taught by US20140137257A1 (University of Texas System), which describes "assessing a risk of one or more assets within an operational technology infrastructure." This process inherently involves identifying critical assets and their underlying dependencies to ensure system functionality, directly corresponding to the patent's "constraint set" of minimum dependencies.
• "applying the set of exploits to the constraint set of the computer system;"
  • This is taught by the combination of US8863293B2 (IBM), which teaches using "probabilistic game-theory" to predict attacks, and the understanding that this game-theoretic model would be fed with real-world exploit data (from US20150215332A1) and evaluated against identified critical vulnerabilities/dependencies (from US20140137257A1). The "application" refers to the simulation or modeling within this game-theoretic framework.
• "analyzing the application of the set of exploits on the computer system to detect a particular vulnerability of the computer system; and"
  • This is the output of the game-theoretic modeling from US8863293B2 (IBM). By predicting attacks, the system would identify the most likely vulnerabilities to be exploited by an attacker given the intelligence and the system's critical dependencies.
• "altering a configuration of the computer system in response to the analysis of the application of the set of exploits to reduce potential damage of a cyberattack."
  • This element is taught by US20130198848A1 (University of Texas System), which focuses on "remediation of computer security vulnerabilities." This includes changing system configurations (e.g., patching, removing software components) to mitigate detected vulnerabilities.

Motivation for a POSA to Combine

A person having ordinary skill in the art (POSA) in cybersecurity, faced with the dynamic and evolving cyber threat landscape, particularly the documented rise of exploit markets on the darknet, would be strongly motivated to combine these known techniques for several reasons:

1. Enhanced Threat Intelligence for Proactive Defense: The background of US10313385 explicitly states that the "widespread availability of zero-day exploits in the darknet represents a potential game changer." [cite: "BACKGROUND" section] A POSA would recognize the critical need to move beyond reactive patching and incorporate real-world, current threat intelligence, such as that gathered from darknet markets (as taught by US20150215332A1), into their defensive strategies. This provides a more accurate understanding of actual attacker capabilities and intentions.
2. Strategic Optimization of Defense: Simply identifying vulnerabilities (US20040088565A1) or remediating them (US20130198848A1) without understanding attacker motivation and resource allocation is insufficient for optimal defense. Game theory (US8863293B2) offers a powerful framework for modeling strategic interactions between attackers and defenders. A POSA would be motivated to integrate the real-world exploit costs and effectiveness from darknet intelligence (US20150215332A1) into these game-theoretic models to predict attacker behavior more accurately and devise more effective, optimized defensive responses.
3. Focused Protection of Critical Assets: In complex IT environments, patching every vulnerability is often impractical due to operational constraints, legacy systems, and software dependencies, as acknowledged in US10313385. [cite: "DETAILED DESCRIPTION" section] A POSA would therefore be motivated to prioritize defense efforts. Identifying critical system assets and their minimum operational dependencies (US20140137257A1) provides a logical "constraint set" for the game-theoretic analysis, ensuring that resources are focused on protecting the most vital components against the most likely and impactful attacks.
4. Actionable Security Posture Improvement: The ultimate goal of any security analysis is to implement improvements. The outputs from a game-theoretic analysis informed by darknet intelligence and focused on critical assets would directly feed into known vulnerability remediation techniques (US20130198848A1). A POSA would naturally combine these steps to create a comprehensive system that translates threat intelligence and strategic analysis into concrete, actionable configuration changes to improve the overall security posture.

Therefore, the combination of these prior art references, driven by the desire to implement a more intelligent, strategic, and practical cybersecurity defense system, would have been obvious to a POSA at the time of the invention. The claims of US10313385 represent an expected integration and application of existing knowledge in the field.