{"id":"W4385944529","doi":"10.48550/arxiv.2308.05034","title":"Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance","year":2023,"lang":"en","type":"preprint","venue":"arXiv (Cornell University)","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":5,"is_retracted":false,"has_abstract":true,"ca_institutions":"","funders":"National Research Council Canada; Natural Sciences and Engineering Research Council of Canada; National Science Foundation","keywords":"Computer science; Kairos; Intrusion detection system; Graph; Artificial intelligence; Data mining; Machine learning; Theoretical computer science","routes":{"ca_aff":false,"ca_fund":true,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":true},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.002483811,0.001614145,0.0007340211,0.00341439,0.0007361202,0.001798509,0.002131801,0.001011816,0.001786583],"category_scores_gemma":[0.01446583,0.0006245075,0.001195889,0.002051986,0.0008582114,0.004434466,0.002521133,0.001591885,0.001324225],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.001326188,"about_ca_system_score_gemma":0.002747631,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.0104043,"about_ca_topic_score_gemma":0.02044417,"domain_scores_codex":[0.9976788,0.0005219014,0.0002383508,0.0005521361,0.0008832387,0.0001255788],"domain_scores_gemma":[0.9936454,0.001971366,0.0006732335,0.002596203,0.0009422805,0.0001714148],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0007956062,0.0005652863,0.05135362,0.00171079,0.0004494588,0.0007050432,0.0007948194,0.1788316,0.02103758,0.0248843,0.0817245,0.6371474],"study_design_scores_gemma":[0.00006919618,0.00011244,0.0039963,0.00006930608,0.00005173207,0.0002904156,0.0001592807,0.9273995,0.01204593,0.0332392,0.02252117,0.00004554442],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.07962235,0.002800164,0.6969795,0.001775775,0.0004028707,0.0009351101,0.02414087,0.186167,0.007176356],"genre_scores_gemma":[0.450213,0.001189285,0.501542,0.0003813749,0.00008610754,0.000349628,0.04083459,0.001862043,0.003542009],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.0104043,"threshold_uncertainty_score":0.02068746,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.1054492947174858,"score_gpt":0.2093466979594161,"score_spread":0.1038974032419303,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}