{"id":"W2982441385","doi":"10.1109/lcn44214.2019.8990853","title":"A Machine Learning Approach for RDP-based Lateral Movement Detection","year":2019,"lang":"en","type":"article","venue":"","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":34,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of Waterloo","funders":"","keywords":"Credential; Computer science; Host (biology); Computer security; Event (particle physics); Anomaly detection; Protocol (science); State (computer science); Artificial intelligence; Machine learning","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.00181639,0.001187773,0.001011792,0.00304708,0.0007253827,0.001240956,0.002241258,0.001576905,0.001089433],"category_scores_gemma":[0.00451297,0.0003010041,0.0008008906,0.001782039,0.0004643905,0.001757098,0.0008954232,0.002061928,0.001035102],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0009092924,"about_ca_system_score_gemma":0.001101475,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.004275973,"about_ca_topic_score_gemma":0.003930041,"domain_scores_codex":[0.9981439,0.0003882645,0.0002015077,0.0005739573,0.000524749,0.0001675605],"domain_scores_gemma":[0.9966993,0.001547294,0.0004234224,0.0003299794,0.0008809228,0.0001191241],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0002347623,0.001605757,0.02156878,0.0001695559,0.0002011652,0.0003709768,0.0001587881,0.1833816,0.01021776,0.003292682,0.008387563,0.7704107],"study_design_scores_gemma":[0.000004493717,0.00004796417,0.0009804541,0.000006248943,0.000009247871,0.00006570666,0.00002125699,0.9949068,0.001766723,0.001545098,0.0006364585,0.000009574491],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.05739003,0.0005556147,0.934318,0.0006088971,0.0001179519,0.0002546853,0.0006052873,0.004322193,0.00182735],"genre_scores_gemma":[0.6452633,0.0002517767,0.3482277,0.0003074963,0.0002092119,0.0003548471,0.001596646,0.0001046177,0.003684426],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.004275973,"threshold_uncertainty_score":0.009606123,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.01042493894283075,"score_gpt":0.2091234592178721,"score_spread":0.1986985202750413,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}