{"id":"W4402288718","doi":"10.1109/sp54263.2024.00005","title":"Kairos: Practical Intrusion Detection and Investigation using Whole-system Provenance","year":2024,"lang":"en","type":"article","venue":"","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":98,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of British Columbia","funders":"National Science Foundation","keywords":"Intrusion detection system; Kairos; Provenance; Computer science; Intrusion; Data mining; Geology; Philosophy; Geochemistry","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.002391965,0.001557363,0.00069695,0.003526768,0.0006768387,0.001762613,0.002108896,0.0009498472,0.001711506],"category_scores_gemma":[0.01462466,0.0006039421,0.001121167,0.001950472,0.0008226681,0.004197715,0.002360322,0.001567121,0.001166953],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.001221694,"about_ca_system_score_gemma":0.002693395,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.009150144,"about_ca_topic_score_gemma":0.01860107,"domain_scores_codex":[0.9978507,0.0004671422,0.0002218983,0.0005093157,0.0008323486,0.0001187811],"domain_scores_gemma":[0.9937363,0.002013117,0.0007132078,0.002471181,0.0008979425,0.000168203],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"bench_or_experimental","study_design_scores_codex":[0.0007372973,0.0005634808,0.05301434,0.001635361,0.0004542023,0.0007089417,0.0007805352,0.1867073,0.02261325,0.0251726,0.06277076,0.644842],"study_design_scores_gemma":[0.00005753077,0.0001074669,0.003539039,0.00006369242,0.00004765849,0.0002908806,0.0001457323,0.9374395,0.0126748,0.02760766,0.01798502,0.00004097573],"study_design_candidate":"bench_or_experimental","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.07309256,0.002192708,0.7417799,0.001375709,0.0003163854,0.0009096492,0.01710928,0.1567107,0.006512994],"genre_scores_gemma":[0.4521579,0.001010432,0.5135367,0.0003431344,0.00007172304,0.0003544827,0.02776277,0.001562305,0.003200562],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.009150144,"threshold_uncertainty_score":0.01819378,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.02442720393523871,"score_gpt":0.2605793242642427,"score_spread":0.236152120329004,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}