{"id":"W4402957849","doi":"10.1145/3678890.3678921","title":"Extending C2 Traffic Detection Methodologies: From TLS 1.2 to TLS 1.3-enabled Malware","year":2024,"lang":"en","type":"article","venue":"","topic":"Network Security and Intrusion Detection","field":"Computer Science","cited_by":14,"is_retracted":false,"has_abstract":true,"ca_institutions":"University of Waterloo","funders":"","keywords":"Malware; Computer science; Computer security; Operating system; Embedded system","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.00284572,0.001347253,0.0006231489,0.005265556,0.0009852983,0.003622014,0.001267436,0.001448605,0.0009808252],"category_scores_gemma":[0.008877344,0.0004261128,0.0008499164,0.002084304,0.001053208,0.003743,0.001859204,0.00208638,0.00120122],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.001477378,"about_ca_system_score_gemma":0.002091818,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.003908774,"about_ca_topic_score_gemma":0.003827608,"domain_scores_codex":[0.9973737,0.0004926363,0.0001660671,0.0004689149,0.001150169,0.0003484942],"domain_scores_gemma":[0.991876,0.001982016,0.001210948,0.001381069,0.003235988,0.0003139984],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"design_other","study_design_gemma":"bench_or_experimental","study_design_scores_codex":[0.0004683751,0.0007645046,0.0850658,0.0005162898,0.0001658901,0.001065921,0.001603469,0.05357993,0.07081778,0.03663618,0.01071388,0.738602],"study_design_scores_gemma":[0.00002150489,0.0005424895,0.01997198,0.000276485,0.0001007912,0.001963966,0.0007125111,0.8146999,0.09866008,0.02986936,0.03299592,0.0001850168],"study_design_candidate":"bench_or_experimental","study_design_consensus":null,"genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.2552963,0.001640671,0.7143408,0.001914162,0.0003625304,0.0007771629,0.0006377453,0.007608985,0.01742159],"genre_scores_gemma":[0.7635335,0.001237788,0.2288723,0.0008003601,0.000236045,0.0002047845,0.0008292887,0.0003385696,0.003947312],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.005265556,"threshold_uncertainty_score":0.01504976,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.04491667366303918,"score_gpt":0.3033650481543261,"score_spread":0.2584483744912869,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}