A Layered Classification Mechanism for Resource-Efficient Threat Detection

This deposit accompanies a work that formalizes and validates a layered classification mechanism designed to reconcile high detection effectiveness with strict operational constraints (cost, latency, throughput). The core idea is an adaptive two-stage decision pipeline: a very fast, low-cost classifier computes an initial risk score and resolves high-confidence benign or high-confidence malicious items immediately; only items whose fast score lies in an ambiguity band are escalated to a selective heavy analysis stage (for example a sandboxed behavioral analysis or a full-featured ensemble model). The mechanism is defined mathematically (scoring functions, calibrated combination rules and two thresholds) and embedded in an operational cost–latency model that enables principled threshold selection via empirical optimization. Key novelties and contributions: Resource-aware decision architecture: a formal separation between fast and heavy stages with explicit probabilistic modeling of the escalation rate p_monitor(t1,t2), enabling quantitative trade-offs between detection performance and operational cost. Threshold-based optimization under operational objectives: a practical TotalCost objective that combines per-request costs and false-negative penalties, together with a reproducible grid-search and surrogate optimization strategy for selecting the two operating thresholds. Calibrated score combination: a principled method to combine fast and heavy scores (weighted average or learned meta-classifier) with calibration steps (Platt/isotonic) to preserve probabilistic interpretation. Empirical demonstration and robustness checks: synthetic benchmark, threshold sweeps, adversarial perturbation scenarios and a comparison against single-stage baselines, showing that the layered policy attains near heavy-only detection performance while drastically reducing average cost and latency. Reproducible artifact: complete experiment code, data, and figures are included so that practitioners can reproduce threshold selection, sensitivity analyses, and adapt the pipeline to domain-specific cost models. This archive contains: experiment scripts (data generation, training, threshold sweep, adversarial tests), resulting CSV datasets, and high-resolution figures that document score distributions, ROC performance and operational comparisons. The materials enable both theoretical replication of the cost/latency analysis and practical adaptation of the pipeline to real telemetry by changing feature sets, cost parameters, and escalation policy.