US 7882560

I'll search for authoritative information on this specific patent number and any 2026 litigation activity.

Let me check specifically for litigation and appellate activity, and confirm the claim text.

US 7,882,560 B2 — Analyst Summary

Bottom line on the search request: I found no CAFC 2026 docket activity, and no district-court or PTAB proceeding, asserting or challenging this specific patent. The only litigation hits that appear to involve a "'788 patent" are a different patent (see "False-positive warning" below). Treat the litigation answer as negative on the evidence searched, not as authoritative proof of no disputes.

Bibliographic data (source: USPTO/Google Patents full text in the working record)

Data note: some aggregators (e.g., Unified Patents) list priority as 2005-12-15, application date 2006-04-30, and grant as 2011-01-31 — one day earlier across the board. This looks like a time-zone/derivation artifact; the authoritative text in the record states Dec. 16, 2005 and May 1, 2006, so I use those. I have not independently re-verified the certificate of correction status or fee history.

Abstract (verbatim)

"A system defines at least one key event to be monitored by at least one agent, and creates a graphical model for the at least one key event. The system observes the at least one key event. The system infers a degree of attack on the computer system based on an observation of the at least one key event in conjunction with a result of an effect the at least one key event has on the graphical model. The system then adjusts a security policy based on an output of the graphical model."

Plain-language overview

The problem the patent addresses: Conventional security software (virus-definition based) can only catch attacks already fingerprinted by a vendor and pushed out in an update, so it lags novel or morphing attacks. Cisco's approach in this family is to have host-resident security agents detect, correlate and remember behaviour, and then adjust the enforcement posture of the machine.

The claimed mechanism: Rather than a hard-coded rule mapping a single signature to "blocked," the system defines a set of key events (system call, buffer overflow, process exception, high CPU/memory, new software or service installation, root-kit detection, transaction failure, loss of service, etc. — enumerated in claim 2), builds a graphical model (expressly a Bayesian network in claim 4 and the spec) over those events, and uses the model's output — a probability of attack — to drive an automatic tightening or relaxing of the security policy. This "re-posturing" is the title feature: the policy itself is probabilistic and moves in response to evidence.

Independent claims

• Claim 1 (method): Steps, all framed as "controlling a computer to": (i) define at least one key event monitored by at least one agent; (ii) create a graphical model for it; (iii) observe the key event; (iv) infer a degree of attack from the automated observation of the event plus the effect the event has on the model — this inferring step is further defined as modifying a probability of attack; (v) monitor the model's output, which indicates whether that probability exceeds a threshold; and (vi) automatically adjust the security policy based on that output, without user intervention, where adjusting includes re-posturing the probabilistic security policy to correspond to the degree of attack. The claim also requires the model to have a plurality of nodes, creation of at least one initial probability per node, adjustment of a node's initial probability as a function of at least one statistical datum associated with a previous security attack, and that the initial probability be defined according to the probabilistic security policy. (Note: the granted claim text reads "the graphical mode" — a literal typo in the patent — where the model is plainly intended.)

• Claim 15 (apparatus): A computer apparatus with memory, processor, communications interface and interconnecting mechanism. The memory stores an application providing probabilistic security policy re-posturing that controls the processor to provide an event correlation engine in communication with an application file interceptor; that engine defines the key event, creates the graphical model, observes, infers the degree of attack, and adjusts the security policy — adjusting again including re-posturing a probabilistic security policy to correspond to the degree of attack. This claim ties the invention to the specific agent architecture in FIG. 2 (interceptors 200-1…200-7 feeding event correlation engine 210).

• Claim 16 (computer-readable medium): Recited as "[a] computer readable medium storing computer executable instructions that when executed by a computer cause the computer to perfor[m]…" — the claim text in the record is truncated mid-word. I cannot authoritatively state its full scope. The patent has 29 claims total, and only claims 1–15 plus the opening of claim 16 are present in the provided text. I therefore cannot rule out additional independent claims among 16–29 (a further system or CRM claim is plausible given that related family member US 8,255,995 and the sibling application follow that pattern), but I am flagging this as uncertainty rather than guessing.

Notable dependent claims: Claim 2 (the fifteen enumerated key-event types); claim 3 (weight each event and account for the step in the process at which it occurred); claim 4 (Bayesian network implementation); claim 5 (selectively deny an operation based on the adjusted initial probability); claims 6/10/11/12 (single event associated with a set of events, related vs. not related, and the order of events); claims 7/13/14 (correlating the degree of attack to a configurable limit, initializing it, or defining it as a range); claims 8 and 9 (re-posturing when likelihood exceeds threshold; Bayesian inference).

Disclosure highlights: Re-posturing example from the spec: on detecting an attack with model output above 70% probability, "deny all new network connections." Spec also describes a self-healing network where identified disallowed event sequences are disseminated to other agents in real time, and a management center (115) acting as central event-log repository and cross-host correlator. Example weights: new software install = 5%; high CPU = 15%; both = 50%; new install + process exception = 25% only.

False-positive warning on the identifiers

Search results contain several near-misses I did not treat as this patent:

• Centripetal Networks v. Cisco (E.D. Va., and the 2022 Supreme Court petition) concerns the "'806 patent" and "'205 patent" — unrelated numbers.
• The Yondr pouch infringement complaint's "'788 Patent" is a different patent directed to a phone case.
• 2019 WL 7882560 is a Westlaw citation, not a patent.
• US 9,195,805 B1 merely cites US 7,882,560 as prior art (and vice versa in the citation listing); that is a citation relationship, not litigation over '560.
• The IPR2025-01588 (Intelligent Protection Management v. Cisco) and IPR2026-00255 (Cisco v. Vusura) hits involve other patents entirely.

Confidence

High confidence on bibliographic data, abstract, and claims 1–15 (taken from the granted full text in the record). Low/unverified on: (a) the complete text of claim 16 and any independent claims among 17–29; (b) whether the patent has ever been asserted in litigation or challenged at the PTAB/Central Reexamination Unit — I found no such record, but absence of a hit in these searches is not affirmative evidence of non-assertion; and (c) current maintenance-fee / lapsed status, which I could not confirm.

I'll research litigation involving US patent 7882560. Let me run several targeted searches.

Let me dig deeper into litigation-specific databases.

Let me check the litigation-specific portals directly.

Findings: Litigation Involving U.S. Patent No. 7,882,560

Bottom line: I found no evidence of any known litigation — district court, ITC, or PTAB — involving U.S. Patent No. 7,882,560. Based on the searches available to me, the patent appears to be unasserted.

Patent identification (for the record)

• Patent: U.S. 7,882,560 B2 — "Methods and apparatus providing computer and network security utilizing probabilistic policy reposturing"
• Application: 11/415,022; filed May 1, 2006; granted February 1, 2011; priority Dec. 16, 2005 (prov. 60/751,439)
• Inventors: Jeffrey A. Kraemer; Andrew Zawadowskiy
• Assignee: Cisco Technology, Inc. (current/parent: Cisco)
• Related family members (per the Unified Patents portal): includes US 2007/0143850 A1, US 8,255,995, US 9,286,469, WO 2007/130332 A2, EP 2013738 A4

Searches performed and results

I searched for the patent number in combination with litigation-specific terms (litigation, lawsuit, infringement, complaint, defendant, PTAB/IPR, Cisco, Unified Patents portal, Docket Alarm). Results returned:

Per the strict instruction, I have not auto-corrected these identifiers: the "7882560" strings above are what appeared in the sources, and they are not the patent at issue.

Litigation table

Assessment and caveats

• No district court litigation, ITC Section 337 investigation, or PTAB (IPR/PGR/CBM) proceeding involving U.S. 7,882,560 was found.
• This is consistent with the patent's profile: it is owned by Cisco, a large operating company that is overwhelmingly a defendant in patent suits rather than a plaintiff; the patent also does not appear in the NPE/assertion data surfaced by the Unified Patents portal.
• Confidence: Moderate-to-high that no significant, reported litigation exists. My ability to query PACER, the Unified Patents litigation caselist, Docket Alarm, and RPX/Insight was limited — my searches on those litigation portals returned no matching case records rather than a definitive "zero results" confirmation. Unreported or recently filed complaints (e.g., a newly docketed case not yet indexed) could exist.
• Recommended verification before relying on this: (1) Unified Patents litigation caselist filtered on the patent number — https://portal.unifiedpatents.com/litigation/caselist; (2) PACER/RECAP full-text docket search for "7,882,560"; (3) USPTO Patent Trial and Appeal Board (PTAB) API/case list; (4) Westlaw/Lexis "Patents in Suit" and Docket Navigator.

If you want, I can outline the exact query strings to run against Docket Navigator and the PACER docket search to close out the residual uncertainty.

I'll verify the ODP's "no proceedings" result against public sources before finalizing.

Let me run more targeted checks on the patent family and any litigation/appeal activity.

Proceedings overview

Total AIA trial proceedings on file for US 7,882,560: 0. The structured PTAB-proceedings block sourced from the USPTO Open Data Portal returns no IPR, PGR, or CBM proceeding for this patent, and independent web verification on 2026-09-29 surfaced no petition, institution decision, Final Written Decision, settlement, or Federal Circuit appeal tied to the '560 patent or its sole continuation, US 8,255,995. The breakdown is therefore 0 active / 0 claims invalidated / 0 claims sustained / 0 settled / 0 institution-denied — which means the patent enters any dispute today un-narrowed and un-tested at the PTAB. Claims 1–29 stand exactly as issued on 2011-02-01. For a defendant, that is a double-edged signal: there is no free "claim 1 is already dead" argument to inherit, but there is also no prior petitioner whose estoppel or adverse FWD constrains you, and no panel findings that have already been litigated and hardened the patent owner's record.

Because there are no proceedings to walk through, the per-proceeding template is empty by necessity. I will not manufacture proceeding numbers, panels, or dispositions. Below is what the absence itself establishes.

---

Verification performed (and its limits)

• Canonical source: The "PTAB proceedings on file" block in this prompt (USPTO ODP ingest) reports no AIA trial proceedings for US 7,882,560. Treated as authoritative.
• Corroborating searches run 2026-09-29: targeted queries for "7882560" / "7,882,560" combined with IPR, PTAB, petition; a family check on continuation US 8,255,995; and an assertion/contentions check. All returned only prosecution-side and bibliographic material (Google Patents, uspto.report, RPX Insight, Unified Patents' patent page) plus unrelated PTAB matters involving other Cisco patents and other Cisco-as-petitioner campaigns (e.g., Cisco's IPRs against ChriMar and MeshDynamics — none of which involve the '560 patent).
• Family checked: The '560 patent's only related child is US 8,255,995 B2 (Kraemer et al., filed 2010-05-27 as a continuation of App. 11/415,022, granted 2012-08-28, Cisco Technology, Inc.). No PTAB activity found on it either. The WO/EP counterparts (WO2007130332A2; EP2013738A4) are prosecution artifacts, not trial records.
• Limit on the negative finding: Search indexes can lag. This is a negative finding from two independent sources, not a certification. I did not locate any specific proceeding number, and per the operating rules I am not inventing one.

Why the absence is structurally explicable here (this matters for strategy):

• PGR is unavailable. Post-Grant Review applies only to patents with an effective filing date on or after 2019-03-16... I should be precise: PGR applies to patents subject to first-inventor-to-file, i.e., effective filing dates on or after 2013-03-16. The '560 patent claims priority to 2005-12-16 (provisional 60/751,439) and was filed 2006-05-01. It is a pre-AIA patent, so PGR is off the table entirely.
• CBM is unavailable (twice over). CBM review required claims directed to a "covered business method" (financial product or service), and the CBM program sunset for new petitions on 2020-09-16. A host-based intrusion-detection/security-policy patent does not plausibly read on a financial product or service, and the sunset closes the door regardless.
• IPR was and is the only live AIA pathway — and IPRs are petitioner-driven. That this patent drew 15 years of potential exposure without one suggests a combination of (a) Cisco's own ownership (it is an operating-company portfolio asset, not an assertion vehicle), (b) no high-value assertion campaign that made an IPR economically rational, and (c) a § 315(b) one-year clock that only starts on service of a complaint alleging infringement.

---

Strategic summary

Claim status: every claim is UNTESTED. Claims 1–14 are the method claims (claim 1 independent; 2–14 depend from 1, 4, 6, or 7); claim 15 is an independent apparatus claim (with 18–21 depending from it); claim 16 is an independent computer-readable-medium claim (with 22–25 depending from it); claim 17 is an independent "computerized device" means-plus-function claim (with 26–29 depending from it). No claim of US 7,882,560 has been canceled, confirmed, or construed by the PTAB. There is no FWD to link to and no claim-level disposition to quote. Anyone representing otherwise — in a demand letter, an invalidity contentions chart, or an internal risk memo — is fabricating.

Note also the un-narrowed posture of the independent claims. Claim 1's final "where" clauses were added during prosecution and carry genuine limitations: (i) modifying a probability of attack based on observation of the key event in conjunction with the effect on the graphical model; (ii) monitoring output indicating whether the probability exceeds a threshold; (iii) automatic security-policy adjustment without user intervention; and (iv) creating at least one initial probability per node and adjusting it as a function of at least one statistical datum associated with a previous security attack. That fourth clause is a real § 103 hook — it ties the claim to using actual historical attack statistics to tune the model, which is a narrower and more attackable proposition than the abstract "Bayesian model for intrusion detection" concept an infringer might assume. Conversely, the "without user intervention" and threshold-monitoring clauses are the kind of limitations that can support a strong non-infringement position for systems that merely score events and alert an analyst.

Estoppel landscape: clean, and therefore wide open. Under 35 U.S.C. § 315(e)(2), estoppel attaches only to a petitioner that obtains a final written decision, and bars that petitioner (and its RPPs and privies) from raising in later civil litigation any ground raised or that reasonably could have been raised before the Board. Because no FWD has ever issued on this patent, no estoppel exists against anyone. Every prior-art ground is available to a defendant today, including grounds that would have been foreclosed to a prior petitioner. Two related consequences:

• There is no § 325(d) "same or substantially the same art already presented to the Office" baggage beyond the examination record itself. The examiner (Zia, Syed A., Art Unit TC 2100-family) cited a modest set of references and prosecuted the case to allowance with the "where" clauses added. That prosecution history — not any PTAB record — is the § 325(d) terrain you will actually be fighting on.
• There is no § 315(a)/(b) trap created by a prior trial, but your own § 315(b) clock is the live risk: it runs one year from service of a complaint alleging infringement of the '560 patent. See Click-to-Call Techs., LP v. Ingenio, Inc., 899 F.3d 1321 (Fed. Cir. 2018) (en banc in relevant part), rev'd on other grounds sub nom. Thryv, Inc. v. Click-to-Call Techs., LP, 140 S. Ct. 1367 (2020), on service triggering the bar even where the complaint was later voluntarily dismissed. If you have already been served, calendar the deadline immediately.

Pattern signals: none of the usual ones.

• No repeat petitioner — there has never been a first petitioner, so the General Plastic serial-petition factors (IPR2016-01357, Paper 19, precedential) are inapplicable.
• No patent-owner appeal posture — Cisco has never had to defend this patent at the Board, so there is no record of aggressive PTAB appellate practice on this asset. (Cisco is, of course, a very heavy PTAB petitioner in its own litigation campaigns, e.g., IPR2023-00401 on U.S. 7,545,740 — but that is irrelevant to your side of the v.)
• No defensive aggregator in the chain. Unified Patents maintains a public patent page for US-7882560-B2 (portal.unifiedpatents.com/patents/patent/US-7882560-B2), but a portal page is a monitoring artifact, not a filing; no Unified-style IPR exists.
• Ownership context. Original and current assignee is Cisco Technology, Inc. (San Jose, CA). This is an operating-company portfolio patent from the Cisco Security Agent / host-based endpoint-security lineage, not an NPE-owned patent. If you received a demand citing the '560 patent, identify the actual current owner of record via USPTO Patent Center before assuming the "troll" framing applies — the prompt's hypothetical does not match the public record.

---

Recommended next steps

1. Do not look for an FWD; there isn't one. There is no Final Written Decision, no institution decision, no panel, and no CAFC docket number to cite for this patent. If an adversary represents that claims of the '560 patent were canceled or confirmed at the PTAB, demand the proceeding number and paper citation — none exists.

2. If you are a defendant already served with a complaint alleging infringement of the '560 patent: calculate your § 315(b) one-year bar date from the date of service today. That is your only hard IPR deadline, and it is running. There is no estoppel risk from a prior petitioner, so you can file on any § 102/§ 103 ground without worrying about previously-presented art.

3. If you are evaluating an IPR filing: the highest-value targets are claim 1's node-probability-adjustment clause ("adjust the at least one initial probability... as a function of at least one statistical datum associated with a previous security attack") and claim 3's process-step weighting. Attack the statistical-data-driven tuning as the point of novelty, and pair it with pre-2005 Bayesian-network intrusion-detection literature. Claim 17's means-plus-function format is also worth a § 112 ¶ 6 written-description/enablement look — that is a PGR-only ground, however, and since PGR is unavailable for this pre-AIA patent, § 112 must be raised in district court or the ITC, not the Board. Note also the practical realities of the current regime: the February 2025 bifurcated institution process and the Director's personal control over institution decisions mean discretionary denial is elevated, and a patent this old will likely draw a "settled expectations" discretionary-denial argument from the patent owner. Build the § 314(a) rebuttal and, if parallel litigation exists, a Sotera stipulation into the petition strategy from day one — but understand that under the current guidance a Sotera stipulation is highly relevant yet not dispositive.

4. Check the parallel-art channels the AIA trials don't cover. With no PTAB record, look for (a) ex parte reexamination — not an AIA trial and therefore not captured in the ODP proceedings block; (b) district court or ITC invalidity findings on the '560 patent or its continuation '995; and (c) prosecution-history estoppel from the amendments that produced claim 1's "where" clauses. None of these are PTAB proceedings, and none appeared in my searches, but they are the realistic sources of any existing validity adjudication.

5. Treat the negative finding as information, not assurance. The absence of any IPR in ~15 years of enforceability, against a family that Cisco actively cited against third parties, suggests this patent has not been the tip of the spear in an assertion campaign. That is a reason to press a strong invalidity or non-infringement position and a reason to consider whether the real exposure sits with the sibling claims of US 8,255,995, which recites a visibly different claim 1 (initializing probability settings, applying first rules to compute event result values, and modifying the probability settings when thresholds expressed as "respective percentages of probabilities" are exceeded). Check both patents before scoping your defense.

Sources consulted: US 7,882,560 on Google Patents (authoritative text, claims, family, and adjusted expiration 2027-04-17); USPTO Patent Center and USPTO PTAB E2E / PTAB Decisions (proceeding search, no AIA trial records); Unified Patents patent page for US-7882560-B2; US 8,255,995 on RPX Insight.

I'll research the assignment record for US 7,882,560 from the USPTO Assignment Center and cross-reference sources.

Assignment Record Reconstruction — US 7,882,560

Scope note / confidence banner. Google Patents' legal-events feed for this patent (the authoritative record supplied in the patent text) shows exactly one assignment event: the original inventor→assignee conveyance recorded 2006-05-01. No post-issuance transfer appears. However, the specific reel/frame number and assignment correspondent were not surfaced by any source I could reach — I could not query assignmentcenter.uspto.gov directly, and secondary mirrors (Unified Patents, uspto.report, patents-review, patentsencyclopedia) do not reproduce the reel/frame for this patent. I am therefore not fabricating a reel/frame; it is marked "not surfaced" below. This is a genuine gap you should close via the Assignment Center search page before relying on the chain.

---

Inventors

Basis for the employer inference, not a bare naming assumption:

• The application and its continuation were filed by Cisco and assigned to Cisco (see below).
• The same two inventors are the sole inventors on the continuation US 8,255,995 (filed 2010-05-27, "Continuation of application No. 11/415,022 … now Pat. No. 7,882,560"), and appear together across a Cisco-assigned endpoint-security patent family (US 7,882,560; US 8,255,995; US 8,413,245; US 8,474,044; US 8,495,743; US 9,286,469; US 9,660,833). This is a continuous same-team, same-assignee pattern, not a one-off.
• The claimed subject matter (host-resident security agent, interceptor DLLs, event correlation engine) is the Cisco Security Agent / host-based IPS architecture — i.e., the line Cisco obtained via its 2003 acquisition of Okena, then sold under the Cisco Security Agent (CSA) brand.

Caveat: I did not retrieve a W-2, employment agreement, or the executed assignment recital for the '560 record itself. The employer attribution rests on the assignment plus the family pattern. Treat "Cisco employee" as inferred.

Unusual-pattern check — ★ not present. There is no evidence of the inventors departing the assignee within 12 months of filing. To the contrary, the same two inventors filed a direct continuation on 2010-05-27 (US 8,255,995), demonstrating continuity with Cisco for at least ~4 years post-filing. No fire-sale-precursor signal.

---

Original assignee

Cisco Technology, Inc., a California corporation, 170 West Tasman Drive, San Jose, CA 95134.

• Entity type / role: Cisco Technology, Inc. is Cisco Systems' R&D-and-IP-holding subsidiary; it appears as the named assignee on the issued patent and on the PCT (WO 2007/130332 A2, applicant "CISCO TECHNOLOGY, INC. [US/US], 170 West Tasman Drive, San Jose").
• Product embodying the claims: Yes. The claimed system (security agent on a host, multiple interceptors, event correlation engine, probabilistic policy re-posturing) maps to Cisco Security Agent (CSA) — Cisco's host-based intrusion-prevention endpoint product, descended from the Okena acquisition. The patent specification itself is written as a product implementation ("those manufactured by Cisco Systems, Inc. of San Jose, Calif.").
• Primary line of business: Networking hardware/software, network security.
• Current status: Operating, publicly traded (NASDAQ: CSCO). Not in bankruptcy, not dissolved. Cisco continues to hold the patent — Google Patents lists Current Assignee: Cisco Technology, Inc. and Unified Patents lists Parent Company: Cisco, with Current Assignee left blank (i.e., no change from the original).

---

Assignment timeline

One (1) recorded assignment exists for this patent — the original conveyance. There are no post-issuance assignments. That is itself the finding: the original assignee still owns the patent outright.

• 2006-05-01 (recorded) / execution date not surfaced — Reel not surfaced / not retrievable from available sources
  • Conveyance: Assignment — recorded as "ASSIGNMENT OF ASSIGNORS INTEREST (see document for details)"
  • Assignor: KRAEMER, Jeffrey A.; ZAWADOWSKIY, Andrew
  • Assignee: CISCO TECHNOLOGY, INC. (170 West Tasman Drive, San Jose, CA 95134)
  • Correspondent: not surfaced in any accessible index for this patent. (Flag: I could not confirm the recording attorney/firm. Do not treat any name here as evidence.)
  • Context: Original inventor-to-employer assignment, executed contemporaneously with filing; not an acquisition, not a fire-sale, not a securitization. Cisco's standard inventor assignment includes the "obligation of assignment to Assignee at the time the invention was made" recital (seen in sibling Cisco recordings), but I did not retrieve the '560 instrument itself.

No later links. Google Patents' event feed for the '560 shows nothing after issuance except status events (grant 2011-02-01; active; adjusted expiration 2027-04-17). No change-of-name, no merger, no security agreement, no nunc-pro-tunc, no license record, no release.

Related-family note (not an assignment to the '560): the priority/continuation links shown on the '560 record (US 11/499,460 → US 9,286,469; US 12/789,339 → US 8,255,995; PCT/US2007/010409; EP 07776475) are prosecution/priority relationships, not ownership transfers. They all remain Cisco-assigned.

Data-quality flag (contradiction between sources): Google Patents states priority 2005-12-16, filing 2006-05-01, grant 2011-02-01, expiry 2027-04-17. Unified Patents states priority 2005-12-15, application 2006-04-30, grant 2011-01-31, expiry 2027-04-16. These are consistent off-by-one artifacts (time-zone normalization); they do not affect ownership. The inventors, assignee, and single-assignment conclusion are identical across both.

---

Timeline diagram

timeline
    title Ownership of US 7882560
    2005 : Provisional patent application filed
    2006 : Non-provisional application filed
         : Inventors assign rights to Cisco Technology Inc
    2011 : Patent granted to Cisco Technology Inc
    2027 : Scheduled expiration

(No assignment events exist after 2006, so the chain terminates at the original assignee.)

---

NPE / troll-pattern signals

---

Verdict

Insufficient data (no records, or only the original assignment).

Justification: The Assignment Center / Google Patents record for US 7,882,560 contains only the original inventor→Cisco Technology, Inc. assignment recorded 2006-05-01 (reel/frame and correspondent not surfaced), with no subsequent conveyance of any type. Every NPE signal in the checklist is not present on the evidence available: the patent never moved from its operating-company assignee, no shell/asserter entity appears, no cascading or pre-litigation transfer exists, and no bankruptcy or defensive-aggregator endpoint exists — so it lands in the "only the original assignment" bucket rather than any assert-prone category. Substantively this reads as an operating-company-held, currently Cisco-owned patent with zero NPE indicators; the residual uncertainty is the missing reel/frame and correspondent detail, not any hint of an NPE chain.

Verify / close the gaps here:

• USPTO Assignment Center (search by patent number 7882560): https://assignmentcenter.uspto.gov/
• Legacy assignment mirror: https://assignment.uspto.gov/patent/index.html
• Google Patents legal events (shows the single 2006-05-01 assignment): https://patents.google.com/patent/US7882560/en
• Unified Patents patent page (current assignee / parent company): https://portal.unifiedpatents.com/patents/patent/US-7882560-B2

What I could not confirm and you should not treat as established: (1) the reel/frame of the 2006-05-01 assignment; (2) the recording correspondent/attorney; (3) the execution date of the assignment instrument; (4) documentary proof of the inventors' employment status. None of these gaps, if filled, appear capable of changing the verdict — but they are open.

I'll research the prior-art citations for US 7,882,560 B2 specifically.

Let me pull the actual citation lists from patent databases.

I have the citation list. Now let me verify the identity and dates of the key references.

Prior-Art Analysis — U.S. Patent No. 7,882,560 B2

Methodological note / confidence caveat up front: My tool budget for this task was exhausted partway through reference-by-reference verification. Everything below is therefore split into (A) what I verified from search results in this session, and (B) what is my own recollection of the cited references, which I was not able to re-verify online and which should be treated as provisional. I will not fabricate filing dates or titles; where I do not have a verified value I say so.

---

1. Target patent — positive identification (verified)

Relevant legal frame: This is a pre-AIA case. The prior-art window is measured against (a) the 2005-12-16 priority date for §102(a)/(e)-type art, and (b) 2006-05-01 (filing) for one-year statutory-bar math under §102(b). Because the application was filed in 2006 and granted in 2011, references that issued after 2006 can still be §102(e) art if their effective filing dates precede the '560 filing date. I flag this below per reference.

---

2. False positives I must explicitly exclude (per the "do not auto-correct identifiers" rule)

• US 3,178,421 A — a bis-aryloxazolyl optical-brightener patent. Its Google Patents bibliographic block contains the strings "US78825A" (application number) and "US7882560A", which caused the number 7882560 to surface in the result. This is a database token-collision artifact and is NOT patent 7,882,560.
• 2019 WL 7882560 (Cal. Mut. Ins. Co. v. Hoverboardsegway) — a Westlaw citation, not a patent.
• Ato n.º 7882560 (Diário Oficial de Santa Catarina) — an administrative act number.
• Any "'788 Patent" hits (e.g. the Yondr phone-case litigation) are different patents.
• patents.google.com/patent/US3178421 is retained here only as a documented false positive.

Note also that the uspto.report page I used is an independent third-party mirror, not the USPTO's own site. I could not reach the USPTO PatentCenter/Patent Full-Text page for 7,882,560 within this session.

---

3. Citation inventory for 7,882,560

3A. The single most probative verified fact — the ISA/ISR citation set

The face of '560 carries the International Search Report and Written Opinion mailed 2008-07-08 in co-pending PCT/US07/10409, entitled "Methods and Apparatus Providing Computer and Network Security Utilizing Probablistic Policy Reposturing" (USPTO-reported "Other References," verified at uspto.report).

The corresponding ISR (WO 2007/130332 A3, PCT/US2007/010409) carries these examiner-assigned relevance categories, verified from the published ISR PDF:

Source: http://patentimages.storage.googleapis.com/e5/a0/a1/2e08ad3094bac3/WO2007130332A3.pdf

The Heimerdinger '128 reference is the only "X" reference and is therefore, by the examiner's own hand, the strongest single-reference (anticipation) candidate against the broad independent claims.

3B. The full "U.S. Patent Documents" cited list (verified as a list)

Verified from https://uspto.report/patent/grant/7882560 (section rendered as "References Cited [Referenced By]"):

Caveat on the list's provenance (material): the uspto.report heading merges "References Cited" and "[Referenced By]." Item 7 (US 7,516,476, Kraemer — a common inventor) and item 2 (rendered "7263718", which I believe is a transcription of 7,263,718) suggest the list may be a merged/derived set rather than a clean reproduction of the printed front page. Eleven (11) of the twenty entries have issue dates after the '560 filing, which is only consistent with them being §102(e) references (earlier effective filing, later issuance) or forward/"Referenced By" citations. I could not disambiguate this before my tool budget ran out. Do not treat 3B as equivalent to the certified front-page list.

Independent corroboration that the forward-citation volume is far larger than 20: Unified Patents reports "Referenced By (113)" for this patent (https://portal.unifiedpatents.com/patents/patent/US-7882560-B2).

---

4. Reference-by-reference: citation, dates, description, potential §102 claim(s)

Descriptions marked [recollection — unverified] are my own model knowledge and were not confirmed in this session. Dates marked [verified] are from the search results above. For post-2006-issued references, the effective filing date is the operative §102(e) date and I do not have it verified.

Tier 1 — the one verified "X" (anticipation) reference

1. US 2006/0070128 A1 — Heimerdinger et al., "…" [recollection — unverified as to title/assignee]

• Publication date: 30 March 2006 [verified from ISR]
• Filing/priority: [not verified] — must predate 2005-12-16/2006-05-01 for §102(a)/(e).
• Description: a computer-network security monitoring/system patent application. [recollection — unverified]
• §102 exposure: Highest of any reference. Cited category "X" against claims 1–20 of the co-pending PCT. If the printed reference discloses, in one document: (i) monitoring of defined events by an agent, (ii) a probabilistic/statistical model producing an attack-probability output, and (iii) adjustment of a security policy in response — it is a §102(a)/(b) anticipation candidate against granted claims 1–3, 5–8, 10–14, and 17–29 (the broad method/apparatus/CRM family), and against claims 15–16 to the extent they do not require the specific "application file interceptor" / "Bayesian" recitations.
• Residual doubt: the '560 claims that are hardest for any single reference to anticipate are claims 4 and 9 (express Bayesian network) and the claim-1 provisos requiring the node initial probability be "defined according to the probabilistic security policy" and adjusted "as a function of at least one statistical datum associated with a previous security attack." A generic "graphical model" disclosure does not reach these. I cannot confirm Heimerdinger discloses them.

Tier 2 — examiner-categorized "A" references (weak on their own; §103 fodder)

2. US 2006/0184682 A1 — Suchowski et al.

• Publication: 17 Aug 2006 [verified from ISR]; category "A".
• §102 exposure: low. An "A" designation signals mere background. Realistic use is §103 combination against claim 1's detection/policy steps, not standalone anticipation.

3. US 7,263,718 B2 — O'Brien et al. (the uspto.report list renders this "7263718"; the ISR prints "7,263,718 B2 (O'BRIEN et al.) 28 August 2007," which I read as the same document — do not auto-correct; flagging the discrepancy)

• Publication: 28 Aug 2007 [verified from ISR]; category "A".
• §102 exposure: low-to-moderate. Malware/security subject matter, but examiner treated it as background. §102(e) candidate only if its filing predates 2006-05-01; likely §103 only.

4. US 2007/0136603 A1 — Kuecuekyan

• Publication: 14 Jun 2007 [verified from ISR]; category "A".
• §102 exposure: low. Post-filing publication; §102(e) only (requires earlier effective filing). §103 use against claims 1–3, 15, 17.

Tier 3 — the rest of the cited U.S. list (content unverified this session)

For the following I can supply the citation and date the database reports with confidence, but the descriptions are provisional [recollection — unverified] and the filing dates (which govern §102(e)) are unknown to me. Where a publication predates the priority date, §102(a)/(b) is the more natural statutory basis; where publication post-dates 2006-05-01, only §102(e) (or ultimately §103) is available.

5. US 2004/0205474 A1 — Eskin et al., October 2004 [list-verified]

• Description [recollection — unverified]: anomaly/statistical intrusion detection — a probabilistic-detection lineage (Eskin is a known anomaly-detection author).
• Potential §102(b) art (published >1 yr before 2006-05-01) against the probabilistic-detection concept in claim 1's "modifying a probability of attack," and against claims 7/13/14 (configurable limit / threshold). Unlikely to reach "re-posturing a probabilistic security policy."

6. US 2002/0166063 A1 — Lachman et al., November 2002 [list-verified]

• Earliest-published entry; §102(b) by date.
• Description [recollection — unverified]. §102 exposure limited to generic network-security architecture; cannot anticipate the probabilistic-model elements.

7. US 7,448,084 B2 — Apap et al., November 2008 [list-verified]

• Description [recollection — unverified]: behavior-based anomaly detection and response.
• §102(e) candidate against claims 6, 10, 11, 12 (event sequences / relatedness / ordering) and possibly claim 5 (deny operation); unlikely to reach claims 1's probabilistic-policy-re-posturing limitation.

8. US 7,401,360 B1 — Ravishankar et al., July 2008 [list-verified]

• Description [recollection — unverified]: intrusion detection/response.
• §102(e) candidate on the detect-and-respond steps; weak on the graphical-model limitation.

9. US 7,516,476 B1 — Kraemer et al., April 2009 [list-verified]

• Common inventor (Kraemer) and common assignee (Cisco) — a family relative. Description [recollection — unverified]: Cisco security-agent architecture.
• Because the disclosures overlap, this is §102(e) only if its effective filing precedes the '560 filing, and its citation here most likely reflects a co-pending-application IDS disclosure, not an examiner rejection. Treat as non-anticipatory in substance but flag as a double-patenting / §102(e) trap to check.

10–14. US 7,237,267 B2 (Rayes, Jun 2007); US 7,293,087 B1 (Styles, Nov 2007); US 7,380,267 B2 (Arai, May 2008); US 7,546,629 B2 (Albert, Jun 2009); US 7,555,776 B2 (Lymer, Jun 2009); US 7,565,426 B2 (Jones, Jul 2009); US 7,715,315 B1 (Ferguson, May 2010) [all list-verified]

• Descriptions [recollection — unverified]. All issue post-filing → §102(e)-or-nothing for anticipation; otherwise §103. None is a plausible single-reference anticipation of claim 1 as granted, because claim 1 now requires the node/initial-probability/statistical-datum/re-posturing combination.

15–19. US 2006/0064582 A1 (Teal, Mar 2006); US 2006/0272024 A1 (Huang, Nov 2006); US 2009/0235324 A1 (Griffin, Sep 2009); US 2010/0082513 A1 (Liu, Apr 2010) [all list-verified]

• Descriptions [recollection — unverified]. The two 2009–2010 entries post-date the filing and can only be §102(e) art (earlier effective filing) or, more likely, forward citations — i.e., not prior art at all. Teal (Mar 2006) is a borderline §102(a)/(e) reference.

20. "Other References" — PCT Search Report and Written Opinion, mailed 8 July 2008, PCT/US07/10409 [list-verified, and the only entry whose provenance is unambiguous]

• This is an applicant IDS document (the ISR of a co-pending family application). It is not itself prior art; it is the vehicle by which the Heimerdinger/Suchowski/O'Brien/Kuecuekyan references entered the file.

---

5. Bottom-line §102 assessment

1. The citation list is not a litigation-grade prior-art chart. It is the patent's own cited-reference set (plus an ISR), and my verification of individual reference contents was cut short. Any §102 conclusion below is preliminary.

2. Only one reference carries an examiner "X" (anticipation) rating: US 2006/0070128 A1 (Heimerdinger et al.), 30 Mar 2006, against claims 1–20 of the parallel PCT. This is the reference to read first, cover-to-cover, before anyone relies on the '560 claims for assertion or validity.

3. The granted claims are narrower than the spec and narrower than the '560 pre-grant publication. The granted claim 1 adds three limitations absent from the published claim 1:

   • inferring = "modifying a probability of attack";
   • "monitor the output … indicating whether the probability of attack is greater than a threshold value";
   • automatic, user-intervention-free re-posturing, plus the plural-node / initial-probability / prior-attack-statistical-datum proviso.
     The published claim 1 (verified at Justia, https://patents.justia.com/patent/20070143850) lacks all of these. So an "X" rating against the published claim 1 (Heimerdinger) does not automatically anticipate the granted claim 1 — the amendment narrowed into the cited art's teeth.

4. Claim-by-claim exposure, on the record I have:

   • Genuine anticipation risk (single-reference): claims 2 (enumerated key events — a laundry list that almost any behavior-monitoring reference will hit), and possibly 3, 5, 6, 10, 11, 12.
   • Real but unproven risk: claims 1, 7, 8, 13, 14 via Heimerdinger.
   • Lowest risk (likely not anticipated by anything cited): claims 4, 9, 16 (express Bayesian network), and claim 1/16's "re-posturing a probabilistic security policy" and "statistical datum associated with a previous security attack" elements. These are the features that give the patent its title and are the natural defense against the cited art.
   • §102(e) traps to check: US 7,516,476 (Kraemer, Cisco) for same-family/late-claiming issues.

5. The cited set is far more useful as a §103 combination (e.g., Heimerdinger '128 + Eskin '474 or Apap '084 for the probabilistic model; + a policy-enforcement reference for re-posturing) than as pure §102 anticipation.

---

6. Contradictions with the previously generated sections (flagged as instructed)

• RESOLVED: the earlier "Patent summary" said claims 16–29 were unavailable and that an additional independent claim was "plausible … but I am flagging this as uncertainty." The current session's search surfaced the full claims 1–29 (uspto.report). Claim 16 is an independent computer-readable-medium claim (expressly reciting a "Bayesian network model"), and claim 17 is a further independent, means-plus-function "computerized device" claim. So the '560 patent has three statutory-class independent claims: 1 (method), 15 (apparatus), 16 (CRM), 17 (device) — four independent claims in total. This removes a previously open uncertainty and adds prior-art surface for claims 16 and 17.
• CONFIRMED, not contradicted: the earlier one-day-earlier aggregator artifact (Unified Patents: priority 2005-12-15, app. 2006-04-30, grant 2011-01-31) reproduced identically in this session's Unified Patents result. The Google Patents full text (2005-12-16 / 2006-05-01 / 2011-02-01) remains authoritative.
• NEW discrepancy to record (do not auto-correct): the examiner's ISR prints the O'Brien reference as "US 7,263,718 B2"; the uspto.report list prints "7263718." Same inventor surname and same month, so I treat them as one document — but the two identifiers are printed differently in the sources, and I am flagging rather than harmonizing them.
• CONSISTENT: the earlier summary identified the pre-grant publication as US 2007/0143850 A1, and the ISR reference as the co-pending PCT/US07/10409 / WO 2007/130332 — both reproduced this session.

---

7. Residual uncertainty / what I would verify next

• Exact front-page "References Cited" vs. "Cited By" split for 7,882,560 (the uspto.report heading is ambiguous; 11 of 20 entries post-date the filing).
• Complete bibliographic data (title, effective filing date, assignee) for all 20 references — I verified only the four ISR-categorized ones plus the list itself.
• Whether Heimerdinger US 2006/0070128 A1 actually discloses (a) a graphical/Bayesian probabilistic model and (b) automatic security-policy re-posturing. This single question determines whether the "X" rejection survives against the granted claims.
• The '560 file history (Office actions, claim amendments) to see which references the examiner actually applied and against which claims.
• The earlier litigation section's negative finding is unchanged: I saw no new district-court/ITC/PTAB record naming 7,882,560 in this session's searches.

Primary sources used: https://uspto.report/patent/grant/7882560; https://patents.google.com/patent/US7882560; https://portal.unifiedpatents.com/patents/patent/US-7882560-B2; http://patentimages.storage.googleapis.com/e5/a0/a1/2e08ad3094bac3/WO2007130332A3.pdf (ISR); https://patents.justia.com/patent/20070143850 (published claim 1).

I'll gather the prior-art references associated with this patent before running the § 103 analysis.

I have a lead on a Bayesian-network security reference. Let me pull the actual cited prior art list for this patent.

Strong references emerging. Let me pin down the actual citation list and the host-agent/adaptive-policy prior art.

Obviousness Analysis — U.S. Patent No. 7,882,560 B2 under 35 U.S.C. § 103

Scope note. This is a hypothetical invalidity assessment grounded in the prior-art references surfaced in this session. As established in the previously generated sections, no IPR/PGR, district-court case, or CAFC appeal involving this patent was found, so there is no institution decision or claim-construction order to anchor the analysis. Nothing in this section contradicts the earlier summary sections; the only interaction is that the earlier-flagged truncation of claim 16 (and the unread claims 17–29) limits the completeness of this analysis.

---

1. Governing standard and critical date

The application (11/415,022) was filed May 1, 2006, so pre-AIA § 103(a) governs. The effective filing date is the provisional priority date, December 16, 2005 (prov. 60/751,439) — with the caveat already noted that some aggregators show Dec. 15; every reference below predates either date, so the discrepancy is immaterial to this analysis.

Framework: Graham v. John Deere; KSR Int'l v. Teleflex (a combination of known elements is obvious where there is an articulated reason with a rational underpinning, including "design incentives," "market forces," and "obvious to try" in predictable fields); MPEP 2143 (rationales) and 2144 (design choice, aesthetic, "obvious to try"). Any IPR-style challenge would be limited to patents and printed publications.

A point conceded by the patent itself: the specification states "A Bayesian Network is a technique from the field of artificial intelligence that calculates probability based on a group of related or influential signs." The patent thus admits the modeling technique is conventional. Under KSR, the question collapses largely to whether applying that known technique to a known host/network security event stream, and wiring its output to automatic policy adjustment, was obvious.

---

2. The prior-art set relied upon

Consequences of the set: the references are all § 102(b)/§ 102(e)-dated well before December 2005; the SRI material must be cited as its 2002 pre-grant publication and the 2000/2001 RAID papers, not as the 2011-granted US 7,917,393 (which is not § 102(b) art as of grant).

---

3. Claim 1 — element-by-element

---

4. Articulated motivations to combine (MPEP 2143 / KSR)

1. Same field of endeavor, same problem. All references are in computer/network intrusion detection and security enforcement. Both '430 and the RAID papers target exactly the deficiency the '560 specification recites in its Background — the lag and brittleness of signature/definition-based detection. That common problem statement supplies the reason to look to these references. MPEP 2143.01(III).
2. Known technique yields predictable, combined-advantage results. The RAID 2000 abstract explicitly teaches that Bayes-net detection supplies "model specificity, adaptability, and generalization potential" that signature analysis lacks. Bolting that known Bayesian assessment engine onto an IDS/firewall that already had an automated response path (EMERALD) is a combination of two known elements whose interaction is mechanical: a probability-weighted alert feeding a response action. KSR; MPEP 2143.01(IV).
3. Design incentive / market forces. Both references were driven by the operational need to reduce false positives and response latency. A POSITA seeking to avoid the false-positive blowback of binary IDS-triggered blocking (a well-recognized problem in the Valdes/Skinner corpus) would predictably gate the enforcement action behind a probability threshold rather than a hard signature.
4. Incremental/dynamic policy tightening is the natural use of an attack score. Valdes/Skinner already employ "a single configurable parameter" to govern the strength of the inference action; routing that parameter to a policy choice (rather than only to alert fusion) is the obvious exploitation of the existing output. KSR ("a finite number of identified, predictable solutions"); MPEP 2144.05 (threshold/parameter selection as design choice).
5. No teaching away. Valdes/Skinner's own departure from binary signature detection is a motivation toward probabilistic scoring; nothing in '430 or the RAID papers disparages coupling an assessment to a security control.
6. Applicant's own characterization. The '560 specification calls the Bayesian network a known AI technique and describes the interceptor/event-correlation-engine agent architecture (FIG. 2) as the pre-existing substrate. Where a reference and the specification agree that the toolkit is conventional, the § 103 burden shifts to showing the arrangement is non-obvious — and here the arrangement (event → probability → threshold → policy) is the standard control-loop structure of the art.

---

5. Claims 15 and 16

• Claim 15 (apparatus). Requires an event correlation engine in communication with an application file interceptor. The '430 interceptor-less data-source architecture and Valdes/Skinner's generic "sensors" do not plainly meet the "application file interceptor" limitation. This is the largest evidentiary gap in the set I was able to retrieve. A challenge to claim 15 would need a host-based interceptor/monitoring reference — e.g., host-sensor components of EMERALD, or the system-call-interposition and kernel-hook literature (Garfinkel's system-call-interposition work; the Forrest et al. "sense of self for Unix processes" line). I could not verify any such reference in this session, and I am not asserting it as present in the prior-art record. Note that this limitation is absent from claim 1, so claim 1 is materially more exposed than claim 15.
• Claim 16 (CRM). Text in the record is truncated mid-word ("cause the computer to perfor"). I cannot analyze it and cannot rule out further independent claims among 17–29. Consistent with the earlier summary's caution.

---

6. Dependent claims 2–14

---

7. Rebuttals the patent owner will raise, and an honest strength assessment

1. The threshold-monitoring limitation. Claim 1 requires the model output to indicate whether the probability is greater than a threshold. Valdes/Skinner teach a configurable parameter governing alert fusion — arguably a similarity threshold, not an attack-probability threshold against an enforcement trigger. This is the cleanest non-obviousness argument available. It is a fairly narrow distinction, however, and would likely be met by explicit threshold-comparator art. Confidence that claim 1 survives the exact combination above as I have mapped it: low-to-moderate.
2. The "re-posturing a probabilistic security policy" and "initial probability defined according to the probabilistic security policy" limitations are circular. The claim defines the node probabilities by reference to a "probabilistic security policy" that is itself defined by those probabilities. That term appears to be coined by this patent and lacks art-recognized content. To the extent the limitation is functional rather than structural, it adds little § 103 distance; to the extent it is treated as structural, it invites a § 112(b) challenge. Either way it weakens rather than strengthens the non-obviousness position. Flagged as an observation, not a holding.
3. "Without user intervention." EMERALD's response framework is the support; if a petitioner cannot show the response component operating automatically, the patent owner can argue the claim is confined to unattended re-posturing. This will be a factual dispute over the reference's disclosure, which I cannot resolve from title/snippet-level evidence.
4. "Statistical datum associated with a previous security attack" vs. '430's "historical data" used to set probabilities. The mapping is close but not literal; the patent owner can argue '430's historical data is model-calibration input rather than a datum about a previous attack. Reasonable, but likely unsuccessful, especially with Valdes/Skinner's adaptively reinforced hypotheses.

---

8. Verification gaps I could not close

• I could not retrieve the Google Patents "References Cited" list for US 7,882,560 itself; the prior art above comes from the family/citation neighborhood, not from the patent's own citation record. The task-directed "Prior Art section of this page" should be cross-checked directly at patents.google.com/patent/US7882560.
• US 7,216,119's title, assignee, and filing date are unverified; treat it as cumulative only.
• EMERALD's automated-response specifics are drawn from the reference title and its cited context in the RAID papers, not from a full-text read in this session. Verify before relying on it for the "automatically adjust" element.
• No host-agent/"application file interceptor" reference was confirmed — see §5.
• Claims 16–29 were not available in the record; a full § 103 opinion is impossible without them.

---

9. Bottom line

• A credible § 103 case exists against claim 1 on US 6,907,430 B2 in view of US 2002/0059078 A1 (or the WO 2002/019077 A2 / RAID 2000–2001 Valdes & Skinner material), further in view of the EMERALD automated-response framework. The first reference supplies the key-event set, the Bayesian graphical model with per-node probabilities seeded by expert opinion and historical data, and bottom-up posterior inference of an attack hypothesis; the second supplies multi-sensor belief updating, ordering/multi-step attack correlation, and the configurable probabilistic threshold; the third supplies the automated-response hook needed for the "automatically adjust … without user intervention" element.
• Claim 4 is the most clearly anticipated-by-disclosure dependent claim; claims 6, 10, 11, 12 and 3 are close behind.
• Claim 15 is the hardest to attack on this evidence because of the "application file interceptor" limitation, which nothing in the retrieved set plainly discloses. Claim 1, despite being the flagship independent claim, is weaker because it omits that architectural limitation and instead recites a standard detect→score→threshold→enforce control loop.
• Overall confidence: moderate-to-high that claim 1 is obvious over the combination; low for claims 15 and any interceptor-dependent claim; no opinion on claims 16–29.