{"id":"W4385944529","doi":"10.48550/arxiv.2308.05034","title":"Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance","year":2023,"lang":"en","type":"preprint","venue":"arXiv (Cornell University)","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":5,"is_retracted":false,"has_abstract":true,"ca_institutions":"","funders":"National Research Council Canada; Natural Sciences and Engineering Research Council of Canada; National Science Foundation","keywords":"Computer science; Kairos; Intrusion detection system; Graph; Artificial intelligence; Data mining; Machine learning; Theoretical computer science","routes":{"ca_aff":false,"ca_fund":true,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":true},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":["metaepi_narrow"],"consensus_categories":[],"category_scores_codex":[0.0004821085,0.0002705868,0.0002659927,0.0003102651,0.0004169961,0.0002522672,0.0004251346,0.0004403226,0.000001849875],"category_scores_gemma":[0.00008511439,0.0003164826,0.00009255603,0.0008418837,0.0001233911,0.000950688,0.001652607,0.0007548087,0.00005030719],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0004059607,"about_ca_system_score_gemma":0.0001589111,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.0003058373,"about_ca_topic_score_gemma":0.0001190625,"domain_scores_codex":[0.9979026,0.0002755016,0.0002610834,0.00112562,0.0001421971,0.0002929773],"domain_scores_gemma":[0.9984783,0.0001075773,0.000400961,0.0006855085,0.0001596166,0.000168068],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"theoretical_or_conceptual","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0003956036,0.0002283676,0.003035259,0.002225485,0.0002932518,0.001314218,0.002932695,0.4571945,0.02333034,0.4841046,0.0007068391,0.02423884],"study_design_scores_gemma":[0.0002473136,0.00007350545,0.0007816541,0.0003330167,0.00004467327,0.00004316226,0.0000963749,0.970901,0.001336586,0.02542661,0.0003907431,0.0003253866],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.4562563,0.00002249496,0.5415078,0.000161943,0.001185043,0.0002990899,0.000003344404,0.000495954,0.0000680919],"genre_scores_gemma":[0.9962809,0.00009276148,0.00315439,0.0000467427,0.0002161594,0.000002231322,0.000005846646,0.00002189544,0.0001790581],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.5400246,"threshold_uncertainty_score":0.9999287,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.1054492947174858,"score_gpt":0.2093466979594161,"score_spread":0.1038974032419303,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}