Skysong Innovations Inc v. Fortinet Inc

I. Executive Summary and Procedural Information

• Parties & Counsel:
  • Plaintiff: Skysong Innovations, LLC (Arizona)
  • Defendant: Fortinet, Inc. (Delaware)
  • Plaintiff's Counsel: Key Kesan Dallmann PLLC; Cahill Gordon & Reindel LLP
• Case Identification: 2:25-cv-00098, E.D. Tex., 06/09/2025
• Venue Allegations: Venue is alleged to be proper based on Defendant Fortinet, Inc. having a regular and established place of business in the Eastern District of Texas, specifically an office in Frisco, Texas, where it employs hundreds of individuals and conducts business.
• Core Dispute: Plaintiff, the technology transfer organization for Arizona State University, alleges that Defendant's integrated cybersecurity platform, the Fortinet Security Fabric, infringes five U.S. patents related to data-driven threat mitigation, secure web browsing, and automated vulnerability analysis.
• Technical Context: The lawsuit operates in the high-stakes cybersecurity sector, where enterprises deploy integrated security platforms to defend against a constantly evolving landscape of digital threats, including those originating from the dark web.
• Key Procedural History: The complaint is a First Amended Complaint, indicating it follows an initial complaint and adds or refines allegations. Notably, the willfulness allegation for U.S. Patent No. 10,574,721 is based on knowledge from the filing of the amended complaint, suggesting this patent may have been added subsequent to the initial filing.

Case Timeline

Date	Event
2013-12-06	'721 Patent Priority Date
2015-11-30	'385 Patent Priority Date
2016-09-26	'831 Patent Priority Date
2017-11-03	'897 Patent Priority Date
2018-05-09	'900 Patent Priority Date
2019-06-04	'385 Patent Issue Date
2020-02-25	'721 Patent Issue Date
2022-03-15	'900 Patent Issue Date
2023-10-03	'831 Patent Issue Date
2024-02-06	'897 Patent Issue Date
2025-06-09	Complaint Filing Date

II. Technology and Patent(s)-in-Suit Analysis

U.S. Patent No. 10,313,385 - Systems and methods for data driven game theoretic cyber threat mitigation (Issued Jun. 4, 2019)

The Invention Explained

• Problem Addressed: The patent identifies a lack of a "game theoretic approach to host-based defense" where the defender's strategy is informed by unconventional sources, specifically "information from darknet markets" '385 Patent, col. 2:26-31
• The Patented Solution: The invention proposes a security framework that models the strategic interaction between an attacker and a defender Compl. ¶22 This framework uses real-world exploit market data, mined from the darknet, to develop near-optimal defensive strategies '385 Patent, col. 3:4-15 It analyzes an attacker with access to these markets and a defender of an IT infrastructure to find ways to mitigate threats '385 Patent, col. 3:8-12
• Technical Importance: The invention provided a method to integrate real-world, emerging threat intelligence from darknet exploit markets into formal, game-theoretic cybersecurity defense models Compl. ¶22

Key Claims at a Glance

• The complaint asserts independent method claim 8 Compl. ¶51
• The essential elements of Claim 8 include:
  • accessing data comprising dark net information associated with a computer system;
  • obtaining a set of exploits from the dark net information configured to bypass a security feature;
  • applying an exploit function which takes the exploits as input and returns a set of vulnerabilities;
  • creating a constraint set of vulnerabilities and determining the effect of the exploits on that constraint set;
  • analyzing an application associated with the exploits to detect a particular vulnerability; and
  • altering a configuration of the computer system in response to the analysis to reduce potential damage.

U.S. Patent No. 10,574,721 - Systems and methods for an automatic fresh browser instance for accessing Internet content (Issued Feb. 25, 2020)

The Invention Explained

• Problem Addressed: The patent notes that accessing many different websites in a single browser creates usability challenges and, more importantly, exposes the user to security risks such as information leakage (privacy) and active attacks like cross-site request forgery '721 Patent, col. 1:45-49 '721 Patent, col. 3:1-5
• The Patented Solution: The patent describes an "automatic fresh browser instance" (FBI) system that segregates web content into different, independent browser instances based on predefined categories or "Conflict of Interest" (COI) classes '721 Patent, col. 1:61-63 '721 Patent, col. 3:7-11 The system architecture involves a daemon that tracks active browser instances and a browser extension that communicates with the daemon to intercept requests and launch new, isolated browser instances for sensitive content '721 Patent, claim 1
• Technical Importance: The invention aimed to automate the security best practice of browser compartmentalization, making robust protection against certain web-based attacks more accessible to both novice and expert users Compl. ¶27

Key Claims at a Glance

• The complaint asserts independent system claim 1 Compl. ¶74
• The essential elements of Claim 1 include a processor operable to:
  • receive data defining first and second web content classes, with the second class associated with a security risk;
  • generate a first browser instance for the first class;
  • intercept a request from the first browser instance to access content from the second class;
  • confirm the URL is not being accessed by another instance by implementing a specific multi-part architecture:
    • a daemon outside the first browser instance tracks active browser instances;
    • the daemon receives the request via a browser extension;
    • the extension forwards the request to the daemon via a native application;
    • the daemon confirms the content is not associated with the first class and no other instance is available; and
  • launch a new browser to provide access to the content from the second class.

Multi-Patent Capsule: U.S. Patent No. 11,275,900

• Patent Identification: U.S. Patent No. 11,275,900, "Systems and methods for automatically assigning one or more labels to discussion topics shown in online forums on the dark web," Issued Mar. 15, 2022.
• Technology Synopsis: The patent addresses the inefficiency of manually labeling and classifying discussion topics on the deep and dark web, which is hindered by labeled data scarcity and imbalanced data classes '900 Patent, col. 2:10-15 Compl. ¶32 The invention proposes a computer-implemented system that uses machine learning classifiers and techniques like Doc2vec to automatically assign hierarchical tags to these discussion topics '900 Patent, col. 3:10-14 Compl. ¶32 A screenshot in the complaint shows a darknet marketplace listing for a "Zeus Bot Botnet," illustrating the type of content the patent aims to classify Compl. p. 43
• Asserted Claims: Independent method claim 12 is asserted Compl. ¶100
• Accused Features: The complaint alleges that Fortinet's FortiGuard Labs Threat Intelligence service, which uses machine learning and AI to classify information from deep web and "Hacker Sites/Forums," infringes the '900 Patent Compl. ¶¶102, ¶104, ¶106

Multi-Patent Capsule: U.S. Patent No. 11,775,831

• Patent Identification: U.S. Patent No. 11,775,831, "Cascaded computing for convolutional neural networks," Issued Oct. 3, 2023.
• Technology Synopsis: The patent targets the high computational and memory intensity of Convolutional Neural Networks (CNNs), which makes real-time classification difficult on low-power systems '831 Patent, col. 1:22-29 Compl. ¶37 The proposed solution is a "cascaded" computing method where an initial, low-precision computation is performed using only the most significant bits (MSBs) of data to efficiently find a maximum value. A full-precision computation is then performed only for the data set that exhibited the maximum, thereby reducing the overall computational load '831 Patent, col. 1:37-50 Compl. ¶37
• Asserted Claims: Independent claim 1, directed to a non-transitory computer-readable storage medium, is asserted Compl. ¶121
• Accused Features: The complaint accuses Fortinet's AI-powered security services, including FortiGuard AI, which allegedly use machine learning (including CNNs) and specialized processors (SPUs/vSPUs) to perform efficient, scaled threat detection Compl. ¶¶122-123, ¶125-126

Multi-Patent Capsule: U.S. Patent No. 11,892,897

• Patent Identification: U.S. Patent No. 11,892,897, "Systems and methods for predicting which software vulnerabilities will be exploited by malicious hackers to prioritize for patching," Issued Feb. 6, 2024.
• Technology Synopsis: The patent addresses the shortcomings of prior methods for prioritizing vulnerability patching, which were often ineffective predictors of actual exploitation '897 Patent, col. 1:48-49 Compl. ¶42 The invention discloses machine learning models that predict "exploits in the wild" by leveraging features from diverse sources, including social network activity in darkweb/deepweb forums and data from the National Vulnerability Database '897 Patent, col. 3:55-56 '897 Patent, col. 4:20-23 Compl. ¶42
• Asserted Claims: Independent method claim 1 is asserted Compl. ¶140
• Accused Features: Fortinet's FortiRecon service is accused of infringement. The complaint alleges this service uses AI and machine learning to monitor vulnerabilities, provide "Adversary Centric Intelligence," and participate in the EPSS (Exploit Prediction Scoring System) to predict the likelihood of exploitation Compl. ¶¶142-143, ¶147, ¶149-150

III. The Accused Instrumentality

• Product Identification: The complaint identifies the "Fortinet Security Fabric" as the core accused instrumentality, describing it as an integrated platform that includes various products and tools such as FortiGuard, FortiRecon, FortiGate, FortiEDR, and FortiDLP Compl. ¶6 Compl. ¶45
• Functionality and Market Context: The Fortinet Security Fabric is alleged to be a comprehensive security platform that "spans secure networking, unified Secure Access Service Edge ('SASE') and AI-driven security operations ('SecOps')" Compl. ¶45 Its purpose is to link different security tools to "collect, coordinate, and respond to malicious behavior in real time" Compl. ¶45 The complaint highlights several specific functionalities as infringing: AI-powered threat intelligence that monitors the darknet Compl. ¶¶16, 53; endpoint protection with lightweight agents Compl. ¶46; browser isolation technology Compl. ¶76; and machine learning-driven vulnerability prediction (Compl. ¶¶142-143). A marketing diagram shows the Accused Products' functionality divided into pre-infection and post-infection phases, orchestrated through automation Compl. p. 13

IV. Analysis of Infringement Allegations

'385 Patent Infringement Allegations

Claim Element (from Independent Claim 8)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
accessing data comprising dark net information associated with a computer system;	Fortinet's FortiGuard Labs monitors the "worldwide attack surface," leveraging FortiRecon to actively monitor and collect data from dark web sources.	¶53; ¶55	col. 2:26-31
obtaining a set of exploits from the dark net information, the set of exploits configured to bypass a security feature of the computer system;	FortiRecon obtains information on hacking tools, cybercrime opportunities, and exploits by monitoring darknet activities as part of its counter-adversary operations.	¶56	col. 3:4-7
applying an exploit function which takes the set of exploits as input and returns a set of vulnerabilities;	FortiGuard Labs and FortiRecon provide "actionable external attack surface intelligence on exposed assets, threat actor activity, and their tools, and tactics," thereby linking exploits to vulnerabilities.	¶57	col. 13:42-44
creating a constraint set of vulnerabilities... wherein application of the set of exploits... comprises determining the effect of the set of exploits on the constraint set...;	FortiSandbox executes files and URLs in a controlled environment that mimics real-world scenarios to determine their effect on a system.	¶58	col. 13:48-56
analyzing an application associated with the set of exploits... to detect a particular vulnerability of the constraint set...;	Fortinet Security Fabric, through products like FortiSandbox, conducts detailed examinations of how exploits are applied to systems to identify specific vulnerabilities.	¶59	col. 13:57-61
altering a configuration of the computer system in response to the analysis... to reduce potential damage of a cyberattack.	The FortiGuard team recommends configuration changes, such as applying a vendor's fix, based on its analysis of observed attacks to protect systems.	¶60	col. 14:12-18

• Identified Points of Contention:
  • Scope Questions: The patent specification heavily emphasizes obtaining data from "darknet markets" specializing in "zero-day exploit kits" ('385 Patent, col. 2:35-37). The infringement allegations rely on Fortinet's more general monitoring of the "darknet" for "threat intelligence" (Compl. ¶¶53, 55). A dispute may arise over whether this general monitoring of forums and activity meets the claim limitation of "accessing data comprising dark net information" as contemplated by the patent, which focuses on specific economic data from exploit markets.
  • Technical Questions: Claim 8 requires "creating a constraint set of vulnerabilities... comprising a minimum set of dependencies to operate the computer system." The complaint alleges FortiSandbox's sandboxing feature meets this (Compl. ¶58). It raises the question of whether running a file in a sandbox constitutes creating a formal "constraint set" of system dependencies as required by the claim, or if it is simply a behavioral analysis environment.

'721 Patent Infringement Allegations

Claim Element (from Independent Claim 1)	Alleged Infringing Functionality	Complaint Citation	Patent Citation
a system, comprising: a processor, operable to:	The Fortinet Security Fabric platform is unified under FortiOS, an operating system that runs on a processor.	¶75	col. 13:3-4
receive data defining a first web content class and a second web content class... the second... being associated with sensitive information presenting a security risk;	FortiIsolator, a browser isolation platform, distinguishes between safe (first class) and potentially malicious (second class) web content, with the second class presenting a security risk.	¶76; ¶78	col. 13:45-53
generate a first browser instance, the first browser instance defining a browser instance type predetermined to be associated with the first web content class;	Fortinet's browser isolation provides "zero-trust web browsing," where each session starts in a "known clean state," which is alleged to be the generation of a first browser instance for safe content.	¶79	col. 13:54-58
intercept a request to access web content from the first browser instance, the request defining a URL of the second plurality of URLs...;	FortiIsolator and FortiProxy implement browser isolation by intercepting requests to access malicious URLs to protect users.	¶80	col. 13:59-64
confirm that the URL is not being accessed by another separate already-running browser instance... by implementing a daemon outside the first browser instance...;	FortiIsolator uses a background process (a "daemon") to maintain an "air-gap" between the user's browser and malicious content, which is disposed of after the session.	¶81; ¶82	col. 14:1-12
receiving the request via a browser extension associated with the first browser instance,	FortiProxy uses a browser extension that "monitors each browser tab, and reports every new tab invocation to FortiProxy."	¶83	col. 14:3-6
forwarding the request from the browser extension to the daemon using a native application,	The FortiProxy browser extension reports tab invocations to FortiProxy, which acts as a secure web gateway (the alleged "daemon").	¶84	col. 14:7-9
confirming, via the daemon that the web content is not associated with the first web content class and that another browser instance is not already launched...; and	FortiIsolator's clientless solution allows access to potentially malicious content without compromising the user's primary browser, allegedly confirming the content is handled separately.	¶85	col. 14:9-12
launch a new browser for accessing the web content associated with the second web content class to provide access to the URL... via the new browser.	FortiIsolator accesses malicious content in a "trusted execution container that is disposed of at the end of the browser session," which the complaint equates with launching a new browser.	¶86	col. 14:13-18

• Identified Points of Contention:
  • Scope Questions: The term "launch a new browser" is central. The complaint alleges that creating a "trusted execution container" that is disposed of after the session (Compl. ¶86) satisfies this element. A court may need to determine if this technical implementation, which may be invisible to the end-user, meets the plain and ordinary meaning of "launching a new browser," which could imply a separate, user-facing application window.
  • Technical Questions: Claim 1 recites a highly specific, multi-step communication protocol (extension -> native application -> daemon). The complaint maps features from different Fortinet products (FortiIsolator, FortiProxy) to these steps (Compl. ¶¶80-84). This raises the evidentiary question of whether these products are sold and operate together in a way that actually performs this precise sequence of operations, or if the allegation is an impermissible stitching of disparate product features to meet the claim language. The FortiDLP dashboard visual shows monitoring, but not the specific browser-launching mechanism claimed (Compl. p. 14).

V. Key Claim Terms for Construction

For U.S. Patent No. 10,313,385 (Claim 8)

• The Term: "dark net information"
• Context and Importance: The patent's novelty is described as using "exploit market data, mined from the darknet" ('385 Patent, col. 3:5-7). Fortinet is accused of infringing by monitoring the "worldwide attack surface" and "criminal forums" (Compl. ¶¶53, 55). The dispute will likely center on whether the claimed "dark net information" is limited to the specific "exploit market data" emphasized in the patent's specification or if it can be read more broadly to cover general threat intelligence gathered from the dark web.
• Intrinsic Evidence for Interpretation:
  • Evidence for a Broader Interpretation: The claim itself uses the general term "dark net information" without the "market" qualifier Compl. ¶51 The abstract also refers more broadly to data "actively mined from the 'darknet' or other overlay communication networks" '385 Patent, abstract
  • Evidence for a Narrower Interpretation: The background section explicitly distinguishes the invention from prior art by noting the lack of approaches using "information from darknet markets in this case" ('385 Patent, col. 2:30-31). The "Detailed Description" also describes modeling an attacker with "access to exploit markets" ('385 Patent, col. 3:9-10).

For U.S. Patent No. 10,574,721 (Claim 1)

• The Term: "launch a new browser"
• Context and Importance: The infringement allegation hinges on equating the accused product's use of a "trusted execution container" with the claimed step of "launching a new browser" (Compl. ¶86). Practitioners may focus on this term because the technical reality of a backend container may not align with the plain meaning of "launching" a user-facing "browser."
• Intrinsic Evidence for Interpretation:
  • Evidence for a Broader Interpretation: The patent's title and abstract refer to an "automatic fresh browser instance," which could be interpreted functionally as any new, clean, isolated environment for rendering web content, not necessarily a distinct application process '721 Patent, title '721 Patent, abstract The goal is to provide "secure access to sensitive content," a purpose that could be served by a containerized approach Compl. ¶27
  • Evidence for a Narrower Interpretation: The claim language recites "browser instance" multiple times, and the specification discusses displaying content in "different independent browser instances" ('721 Patent, col. 1:62-63). This language, combined with the common understanding of launching a browser, may support an interpretation requiring the creation of a separate, independent application process (e.g., a new instance of Chrome.exe).

VI. Other Allegations

• Indirect Infringement: The complaint alleges that Fortinet induces infringement of all five asserted patents. The allegations are based on Fortinet providing the Accused Products and encouraging their use in an infringing manner through marketing, sales, user manuals, technical support, and instructions for installation and operation Compl. ¶¶63-65 Compl. ¶¶89-91 Compl. ¶¶110-112 Compl. ¶¶129-131 Compl. ¶¶155-157
• Willful Infringement: Willfulness is alleged for all asserted patents. For the '385, '900, '831, and '897 patents, the allegation is based on Fortinet's knowledge of the patents since at least the filing of the initial complaint Compl. ¶70 Compl. ¶117 Compl. ¶136 Compl. ¶162 For the '721 patent, knowledge is alleged since the filing of the First Amended Complaint Compl. ¶87, suggesting it was added in the amendment. All willfulness claims are based on post-suit knowledge.

VII. Analyst's Conclusion: Key Questions for the Case

This case presents a broad challenge to Fortinet's core security platform, alleging infringement across a range of advanced cybersecurity technologies developed at Arizona State University. The resolution will likely depend on the court's interpretation of several key technical and legal issues:

1. A question of definitional scope: Can terms with specific technical context in the patents, such as "dark net information" (linked to "exploit markets" in the '385 Patent) and "launch a new browser" ('721 Patent), be construed broadly enough to cover the more general threat intelligence and container-based isolation functionalities of Fortinet's products?

2. An evidentiary question of integration: The complaint constructs its infringement theories by mapping features from a wide array of products within the "Fortinet Security Fabric" to the elements of the asserted claims. A central issue for trial will be whether Skysong can provide sufficient evidence that these disparate functionalities operate together as a single, cohesive system that practices the precise methods and systems claimed in any one patent.

3. A question of technological equivalence: Across the asserted patents, which claim specific computational methods (e.g., game-theoretic modeling, cascaded CNN processing, ML-based classification), a key point of contention will be whether Fortinet's AI and machine learning-driven security services perform functions that are merely in the same technological field or if they operate in a manner that is structurally and functionally equivalent to the specific, detailed steps required by the patent claims.