{"id":"W3124203340","doi":"10.1109/tnsm.2021.3054356","title":"Uncovering Lateral Movement Using Authentication Logs","year":2021,"lang":"en","type":"article","venue":"IEEE Transactions on Network and Service Management","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":37,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of Waterloo","funders":"Canadian Network for Research and Innovation in Machining Technology, Natural Sciences and Engineering Research Council of Canada; Royal Bank of Canada","keywords":"Computer science; Leverage (statistics); Artificial intelligence; Machine learning; Network security; Overhead (engineering); Feature extraction; Data mining; Computer security","routes":{"ca_aff":true,"ca_fund":true,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.0005640801,0.0007282631,0.0004397788,0.00273131,0.0003468359,0.0007720737,0.0005455618,0.000601003,0.0007844162],"category_scores_gemma":[0.003115386,0.000169346,0.00029722,0.001123833,0.0003294076,0.001364409,0.000698714,0.0006608639,0.0008823103],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0003741143,"about_ca_system_score_gemma":0.0003967546,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.003598511,"about_ca_topic_score_gemma":0.005683048,"domain_scores_codex":[0.9995155,0.0001120384,0.00004175283,0.0001053512,0.0001418669,0.00008344257],"domain_scores_gemma":[0.9974298,0.0007937946,0.000711542,0.0004150317,0.0004620472,0.0001877606],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"observational","study_design_gemma":"not_applicable","study_design_scores_codex":[0.0009591913,0.00102524,0.4923201,0.0002895629,0.0001731017,0.001334271,0.0004901179,0.1283162,0.03135091,0.00309178,0.01340027,0.3272493],"study_design_scores_gemma":[0.00001911116,0.0002060082,0.04944805,0.00002943526,0.00003164114,0.0002966422,0.0003506721,0.9371976,0.007827364,0.002004129,0.002561897,0.00002745972],"study_design_candidate":"not_applicable","study_design_consensus":null,"genre_codex":"empirical","genre_gemma":"methods","genre_scores_codex":[0.9394318,0.0003653137,0.04994373,0.0005142825,0.0001180095,0.0001393433,0.002864426,0.00294226,0.003680764],"genre_scores_gemma":[0.9901823,0.0001004817,0.007005765,0.00003556014,0.00003172294,0.00002452509,0.001788196,0.00002306646,0.0008081874],"genre_candidate":"methods","genre_consensus":null,"teacher_disagreement_score":0.003598511,"threshold_uncertainty_score":0.00715512,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.01478014325989933,"score_gpt":0.2230510060428088,"score_spread":0.2082708627829095,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}