{"id":"W2035541386","doi":"10.1145/1368506.1368511","title":"Reconstructing system state for intrusion analysis","year":2008,"lang":"en","type":"article","venue":"ACM SIGOPS Operating Systems Review","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":16,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of Toronto","funders":"","keywords":"Computer science; Preprocessor; Audit; Audit trail; State (computer science); Intrusion detection system; Task (project management); Data mining; Real-time computing; Programming language","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.001811588,0.000243113,0.0008356438,0.0001801014,0.000905054,0.0002266247,0.001018672,0.00007879115,0.000009345022],"category_scores_gemma":[0.0006461018,0.0002040296,0.0002965353,0.001681724,0.00003115793,0.000608591,0.0003116847,0.0001841866,0.00004383353],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0001263606,"about_ca_system_score_gemma":0.0000809094,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.0001669242,"about_ca_topic_score_gemma":0.00001007776,"domain_scores_codex":[0.9971588,0.0004359321,0.001069362,0.0006283719,0.000339278,0.0003683194],"domain_scores_gemma":[0.9974287,0.0003674353,0.000479715,0.001234093,0.0003702204,0.0001198759],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.00003960359,0.0002634434,0.01452419,0.07050493,0.004075131,0.0002873786,0.007472515,0.03118827,0.004638933,0.06323665,0.0320898,0.7716792],"study_design_scores_gemma":[0.0005222225,0.000230113,0.0001225389,0.01203604,0.0003948837,0.001301862,0.0001514214,0.9513245,0.0005521574,0.00006250123,0.03242835,0.0008734014],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.07977211,0.1205414,0.7893985,0.0006415396,0.003756337,0.003818913,0.00001930163,0.001105046,0.0009468349],"genre_scores_gemma":[0.9141529,0.01668287,0.06692605,0.0006057222,0.0005867478,0.0005709614,0.00002527574,0.00004014839,0.0004093774],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.9201362,"threshold_uncertainty_score":0.8320085,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.03297405863305988,"score_gpt":0.2685270866011555,"score_spread":0.2355530279680957,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}