TITANIUM-4: A Low-Latency Four-Layer Intrusion Detection Pipeline and the Limits of Benchmark-Trained Thresholds under Domain Shift

Abstract

Firewalls enforce access rules within tight latency budgets but give no behavioral visibility; deep classifiers name attack families at a cost that inline placement cannot absorb. TITANIUM-4 addresses both with a four-layer pipeline: a calibrated LightGBM gatekeeper forwards only attack candidate flows to eight-class forensics, while benign flows bypass it and are processed by a One-Class SVM sentinel trained on normal traffic alone. On the cleaned CSE-CIC-IDS2018 benchmark, the gatekeeper attains F1 = 0.99987 and AUC = 0.99997 with zero false positives, routing 82.5% of test flows around the forensic classifier, which reaches macro F1 = 0.99 over eight families; the sentinel flags 45.06% of held-out Botnet and Infiltration flows at 5% FPR. Weighted end-to-end latency is 6.32 ms per flow, against 7.280 ms without early exit. Two findings qualify these results. The cleaned CSV carries no flow identifiers, so duplicates across splits cannot be excluded and the scores are a best-case estimate. Live DoS Hulk captures then expose domain shift: calibrated probabilities reach a maximum of 0.0138 against an operating point of τ_B = 1.0, so nothing is labeled until τ_B is lowered by hand. Two captures processed at manually chosen thresholds of 1 × 10⁻⁸ and 1 × 10⁻⁴ label 87.3% and 52.2% of an identical attack, so the reported fraction is governed by an unconstrained parameter rather than by the traffic. The sentinel flags nothing in either run, its 95th-percentile rule having been computed over the flows it was applied to, though its live scores stay sharply bimodal, locating that failure in the thresholding rule rather than the model. Benchmark-derived thresholds do not transfer to CICFlowMeter output