{"id":"W2170899024","doi":"10.1109/icics.2009.5397551","title":"An approach towards anomaly based detection and profiling covert TCP/IP channels","year":2009,"lang":"en","type":"article","venue":"","topic":"Internet Traffic Analysis and Secure E-voting","field":"Computer Science","cited_by":9,"is_retracted":false,"has_abstract":true,"ca_institutions":"Concordia University","funders":"","keywords":"Computer science; Covert channel; Anomaly detection; Covert; Profiling (computer programming); Payload (computing); Computer network; Protocol (science); Computer security; Intrusion detection system; Data mining","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.001777959,0.0007752059,0.001122381,0.003789525,0.001000733,0.002127056,0.001818703,0.001734498,0.0005702738],"category_scores_gemma":[0.009288312,0.0004945433,0.000763949,0.001965658,0.001739164,0.003204821,0.002149938,0.002226245,0.0003228028],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0007871028,"about_ca_system_score_gemma":0.0009825719,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.000774009,"about_ca_topic_score_gemma":0.0007957041,"domain_scores_codex":[0.9958955,0.000910309,0.0001948996,0.000738993,0.001984557,0.000275777],"domain_scores_gemma":[0.9914595,0.002671977,0.001131604,0.002671314,0.00182959,0.0002360378],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0003393769,0.0005288441,0.02575304,0.0001936898,0.0002070636,0.0008932279,0.001394226,0.1157436,0.1198102,0.1212731,0.002464682,0.611399],"study_design_scores_gemma":[0.00001743621,0.000155762,0.002461364,0.00002418924,0.00004217074,0.001062481,0.0001554978,0.884143,0.05162852,0.05503354,0.005214916,0.00006115279],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.01433474,0.00004822565,0.9840389,0.0001507156,0.00001685873,0.0000535944,0.00003286574,0.0006760738,0.0006480833],"genre_scores_gemma":[0.3290713,0.0001375565,0.6689966,0.0001120769,0.00005806469,0.0001250488,0.0001132412,0.00007661865,0.001309532],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.003789525,"threshold_uncertainty_score":0.009402871,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.01496435199485713,"score_gpt":0.2350610528850244,"score_spread":0.2200967008901673,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}