{"id":"W3105780912","doi":"","title":"UNICORN:Runtime Provenance-Based Detector for Advanced Persistent Threats","year":2020,"lang":"en","type":"preprint","venue":"Bristol Research (University of Bristol)","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":75,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of British Columbia","funders":"","keywords":"Unicorn; Computer science; Graph; Anomaly detection; Computation; Detector; Theoretical computer science; Data mining; Algorithm","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":["metaepi_narrow"],"consensus_categories":[],"category_scores_codex":[0.001118541,0.0003604365,0.0007431993,0.0005513504,0.0008686488,0.0001697656,0.003627007,0.0004582218,0.00005817041],"category_scores_gemma":[0.000275102,0.0004776311,0.000685111,0.0009580021,0.0005431729,0.0003621395,0.002884661,0.001432322,0.00007090116],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0007821798,"about_ca_system_score_gemma":0.001326846,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.0007288799,"about_ca_topic_score_gemma":0.0003775668,"domain_scores_codex":[0.9956244,0.0004536954,0.0003464757,0.001511972,0.001280132,0.0007833635],"domain_scores_gemma":[0.9958534,0.0003899915,0.0004736988,0.001504599,0.001366131,0.000412219],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.005888573,0.001916076,0.0001674821,0.006688016,0.0008832171,0.0005744852,0.006681,0.0138626,0.01589266,0.01808827,0.119195,0.8101626],"study_design_scores_gemma":[0.004624078,0.004047018,0.0005588111,0.001387187,0.0001536184,0.00001963514,0.001137009,0.7292452,0.004111869,0.02432991,0.2288018,0.001583766],"study_design_candidate":"design_other","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.08633994,0.005797019,0.8779323,0.01527386,0.001686523,0.006523247,0.0004425244,0.0008284514,0.005176204],"genre_scores_gemma":[0.9458113,0.0004956792,0.05147222,0.00009894891,0.0001677617,0.00002373684,0.00007839264,0.00004779413,0.001804184],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.8594713,"threshold_uncertainty_score":0.9997675,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.09279258365515726,"score_gpt":0.3040890968178061,"score_spread":0.2112965131626489,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}