{"id":"W2967385703","doi":"10.4018/978-1-5225-9742-1.ch007","title":"Threat Hunting in Windows Using Big Security Log Data","year":2019,"lang":"en","type":"book-chapter","venue":"Advances in information security, privacy, and ethics book series","topic":"Software System Performance and Reliability","field":"Computer Science","cited_by":6,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of New Brunswick","funders":"","keywords":"Intrusion detection system; Anomaly detection; Computer science; Host (biology); Data mining; Anomaly-based intrusion detection system; Anomaly (physics); Parsing; Volume (thermodynamics); Network security; Big data; Artificial intelligence; Computer security","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.0006281045,0.0006869193,0.0003723329,0.001975435,0.0003845536,0.002433174,0.0005441681,0.0004045364,0.002801019],"category_scores_gemma":[0.002336626,0.0003062799,0.0004251018,0.001514241,0.0002489855,0.003059253,0.0008492395,0.0009207952,0.001294124],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0004667733,"about_ca_system_score_gemma":0.0004137515,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.002437589,"about_ca_topic_score_gemma":0.004662115,"domain_scores_codex":[0.9996881,0.00004203947,0.00001702508,0.00005559317,0.000178463,0.00001868464],"domain_scores_gemma":[0.9988232,0.0007102819,0.0001157702,0.0001462491,0.0001405719,0.00006387117],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"not_applicable","study_design_scores_codex":[0.0003289582,0.000164286,0.02070244,0.0005978608,0.000103181,0.0009323259,0.00133556,0.0204627,0.01251739,0.01436164,0.05532105,0.8731726],"study_design_scores_gemma":[0.0000409558,0.0003722898,0.07471137,0.0007701978,0.0001266069,0.002635408,0.002482709,0.6366262,0.03338787,0.07919431,0.1694424,0.0002096906],"study_design_candidate":"not_applicable","study_design_consensus":null,"genre_codex":"empirical","genre_gemma":"empirical","genre_scores_codex":[0.4768782,0.01709414,0.3463149,0.004849455,0.001169022,0.0005564474,0.01277908,0.03560331,0.1047554],"genre_scores_gemma":[0.713239,0.01047624,0.2220813,0.0005279101,0.0003818223,0.0001905778,0.01335603,0.001827546,0.0379196],"genre_candidate":"empirical","genre_consensus":"empirical","teacher_disagreement_score":0.002801019,"threshold_uncertainty_score":0.009370387,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.04978101394802475,"score_gpt":0.3089980704573167,"score_spread":0.2592170565092919,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}