{"id":"W4402288718","doi":"10.1109/sp54263.2024.00005","title":"Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance","year":2024,"lang":"en","type":"article","venue":"","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":98,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of British Columbia","funders":"National Science Foundation","keywords":"Intrusion detection system; Kairos; Provenance; Computer science; Intrusion; Data mining; Geology; Philosophy; Geochemistry","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.0003734992,0.000105561,0.00009029812,0.0001231662,0.000218408,0.0004972658,0.00009189082,0.0000995195,0.000004573159],"category_scores_gemma":[0.00003882467,0.00009001187,0.00002773138,0.00053189,0.00004409272,0.001597868,0.000145264,0.0002054782,0.0000385903],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0001099257,"about_ca_system_score_gemma":0.00005809466,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.00005952338,"about_ca_topic_score_gemma":0.00002414312,"domain_scores_codex":[0.9989526,0.00008769237,0.0002000358,0.0003960142,0.0002042723,0.0001593955],"domain_scores_gemma":[0.9995614,0.00006886949,0.00004771126,0.0001934293,0.00004746833,0.00008113033],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.00002377965,0.00002751559,0.0000579936,0.0003905367,0.00002219522,0.0000550107,0.001369339,0.000248797,0.2406047,0.3564111,0.0006732905,0.4001158],"study_design_scores_gemma":[0.00007266572,0.00008453314,0.0001300023,0.0001641976,0.000007126571,0.0003194585,0.00004570954,0.9611311,0.02465141,0.004100281,0.009172705,0.0001208],"study_design_candidate":"simulation_or_modeling","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.1819559,0.0002373077,0.8140452,0.001150812,0.001216314,0.0001846406,3.909765e-7,0.000656296,0.0005531468],"genre_scores_gemma":[0.9749358,0.00001769808,0.02457473,0.0001275234,0.0002372057,0.00001024572,5.543153e-7,0.000008169275,0.00008809176],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.9608823,"threshold_uncertainty_score":0.4795146,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.02442720393523871,"score_gpt":0.2605793242642427,"score_spread":0.236152120329004,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}