{"id":"W2035541386","doi":"10.1145/1368506.1368511","title":"Reconstructing system state for intrusion analysis","year":2008,"lang":"en","type":"article","venue":"ACM SIGOPS Operating Systems Review","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":16,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of Toronto","funders":"","keywords":"Computer science; Preprocessor; Audit; Audit trail; State (computer science); Intrusion detection system; Task (project management); Data mining; Real-time computing; Programming language","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.001165237,0.0009860538,0.0007336799,0.002662661,0.0006542444,0.001512971,0.0008556291,0.0006624167,0.004040366],"category_scores_gemma":[0.008796944,0.0005878931,0.0007212987,0.001486676,0.0006718161,0.002905089,0.001018019,0.001525539,0.001567725],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0008585075,"about_ca_system_score_gemma":0.001396518,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.002106809,"about_ca_topic_score_gemma":0.002539758,"domain_scores_codex":[0.9989572,0.0002387272,0.00006994144,0.0001915552,0.0004541207,0.00008853155],"domain_scores_gemma":[0.995876,0.001150688,0.0003853939,0.00189935,0.0005974899,0.0000910985],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0005512963,0.0002609811,0.01847793,0.0004472889,0.0001402625,0.0006242381,0.0007931028,0.1309806,0.07105034,0.03369954,0.01106282,0.7319117],"study_design_scores_gemma":[0.00002066813,0.0001499379,0.003755912,0.00005723375,0.0000501414,0.0003421664,0.0002000987,0.9030974,0.04619921,0.03294396,0.01313463,0.00004860678],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.04828124,0.0005942592,0.9338411,0.0003905403,0.00008960145,0.0001605665,0.0009404703,0.01271492,0.002987215],"genre_scores_gemma":[0.4889807,0.000757675,0.5048796,0.00006991705,0.00005658018,0.0001882794,0.00222932,0.0005783765,0.002259508],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.004040366,"threshold_uncertainty_score":0.01351637,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.03297405863305988,"score_gpt":0.2685270866011555,"score_spread":0.2355530279680957,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}