{"id":"W2739052910","doi":"10.23919/inm.2017.7987417","title":"Exploring a service-based normal behaviour profiling system for botnet detection","year":2017,"lang":"en","type":"article","venue":"","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":21,"is_retracted":false,"has_abstract":true,"ca_institutions":"Dalhousie University","funders":"","keywords":"Botnet; Computer science; Anomaly detection; Profiling (computer programming); Payload (computing); Constant false alarm rate; Encryption; Network packet; Data mining; Intrusion detection system; Deep packet inspection; Outlier; False alarm; Computer network; Real-time computing; Computer security; Artificial intelligence; The Internet; Operating system","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.001207902,0.0006215433,0.0007782525,0.001747451,0.0004326812,0.0007835381,0.0008790817,0.0005896082,0.0004132852],"category_scores_gemma":[0.003910267,0.0001855232,0.0003136954,0.001048012,0.0004308427,0.001681586,0.0009026719,0.0007777328,0.0005154779],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0007342111,"about_ca_system_score_gemma":0.00085764,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.003140589,"about_ca_topic_score_gemma":0.002947712,"domain_scores_codex":[0.9990189,0.0001820758,0.00007058679,0.0002586551,0.0003658621,0.0001039254],"domain_scores_gemma":[0.9976422,0.0005074084,0.0003598284,0.0003347131,0.0009823676,0.0001734334],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0008620149,0.001112142,0.1225031,0.0001774886,0.0001862754,0.0004235355,0.0006416045,0.1146971,0.09270451,0.005733789,0.005039507,0.6559188],"study_design_scores_gemma":[0.000006497236,0.0001091381,0.005848497,0.000004883424,0.00001252406,0.0001615898,0.00003753452,0.9777448,0.01361834,0.001538158,0.0008959433,0.00002210996],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.2211707,0.0001256721,0.7621617,0.000243446,0.00005057104,0.0001228324,0.0002273082,0.01491713,0.0009806186],"genre_scores_gemma":[0.8843231,0.00005855138,0.1142923,0.00007025984,0.00002949581,0.00005354326,0.0003949536,0.0001092126,0.0006685512],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.003140589,"threshold_uncertainty_score":0.006388068,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.08980855718034453,"score_gpt":0.2599114011773079,"score_spread":0.1701028439969633,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}