DFS measures whether available security evidence is strong, stable, and robust enough to support a sensitive decision.
DFS is a confidence model for evidence. It does not ask whether an action is interesting or whether a user is authorized. It asks whether the evidence is good enough to support a security-sensitive decision.
A weak dimension pulls the whole decision down.
Unknown evidence is treated as uncertainty, not strength.
Runtime policy can make the outcome stricter, but not magically safer.
Measures how directly and unambiguously the observed evidence supports the detection hypothesis.
Signal Strength is not signal availability. It represents the discriminatory value of evidence that is actually observed.
Unknown evidence is not strong evidence.
Measures whether the underlying evidence can survive realistic telemetry loss, distortion, and pipeline degradation.
Telemetry Stability evaluates whether the telemetry substrate is reliable enough to support the security decision.
Fragile telemetry should reduce stability instead of being treated as trustworthy evidence.
Measures whether the detection logic keeps working as an adversary changes implementation details.
Behavioral Robustness measures durability under adversarial adaptation, not whether an execution looks normal right now.
Runtime anomalies must not silently redefine Behavioral Robustness.
Gather the evidence available for the action, including signals, telemetry quality, and behavior context.
Evaluate Signal Strength, Telemetry Stability, and Behavioral Robustness as separate dimensions.
Combine the dimensions into a decision fidelity score that can support allow, escalate, or block.
Keep the weak dimension visible so the reason for the decision is auditable instead of hidden.