{"id":"W2982441385","doi":"10.1109/lcn44214.2019.8990853","title":"A Machine Learning Approach for RDP-based Lateral Movement Detection","year":2019,"lang":"en","type":"article","venue":"","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":34,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of Waterloo","funders":"","keywords":"Credential; Computer science; Host (biology); Computer security; Event (particle physics); Anomaly detection; Protocol (science); State (computer science); Artificial intelligence; Machine learning","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.0002495417,0.00008661612,0.00008974758,0.00007600278,0.0001279495,0.00009953009,0.0001986533,0.0000517357,0.00006675973],"category_scores_gemma":[0.000006998252,0.00007445677,0.00006759181,0.000183374,0.000006095317,0.0002421792,0.00006016228,0.0001224521,0.00003734718],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.00003645556,"about_ca_system_score_gemma":0.00001152272,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.0000611928,"about_ca_topic_score_gemma":0.00001383296,"domain_scores_codex":[0.9992332,0.00003998954,0.0001281668,0.000276555,0.0001402493,0.0001817789],"domain_scores_gemma":[0.9996415,0.00003055502,0.00005102021,0.0001974541,0.0000402891,0.00003912133],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0003695757,0.0005529707,0.003611249,0.0002600873,0.00007912119,0.000001768183,0.0008173353,0.2789121,0.06080945,0.05833087,0.0005263811,0.5957291],"study_design_scores_gemma":[0.000514433,0.0003410603,0.0001345769,0.00000365043,0.000001861319,0.000001133036,0.000003521111,0.9680688,0.02061747,0.0007899261,0.009418158,0.0001053496],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.03455438,0.00002118116,0.9613076,0.0001145434,0.0003472705,0.0003540894,3.771308e-7,0.0002336426,0.003066868],"genre_scores_gemma":[0.9597865,0.000002414313,0.03784835,0.0006536854,0.00006634584,0.00004290173,0.000005963786,0.000006812196,0.001586977],"genre_candidate":"methods","genre_consensus":null,"teacher_disagreement_score":0.9252322,"threshold_uncertainty_score":0.3036259,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.01042493894283075,"score_gpt":0.2091234592178721,"score_spread":0.1986985202750413,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}