Preprint Open access
Where the Numbers Come From: Auditing Evaluation in Provenance-Based Intrusion Detection
Reproducing a provenance-based intrusion detector's score does not establish what that score says about its emitted alarms or the information its encoder uses. We audit nine released implementations, execute four detectors using their own code, and isolate three measurement effects. First, a fixed-alert comparison sepa …