Multi-Source Weighted Threat Composite Scoring

1. Definition

Multi-Source Weighted Threat Composite Scoring governs the computation of aggregate threat scores from multiple independent detection sources. In any sufficiently complex autonomous agent deployment, threat assessment relies not on a single detector but on an ensemble of detection mechanisms: anomaly detectors, behavioural monitors, rate limiters, integrity verifiers, external threat intelligence feeds, and federated peer signals. Each source provides a partial view of the threat landscape with its own confidence level, latency characteristics, and false-positive rate. AG-790 defines how these partial views are combined into a single composite score that feeds into the escalation function (AG-784).

The composite scoring function applies configurable weights to each detection source, reflecting its reliability, relevance, and timeliness. A source with a proven track record of accurate detection and low false-positive rates receives a higher weight than a newly deployed or historically unreliable source. Weights are not static; they can be adjusted based on empirical performance data, source health status, and the current threat context. During a known phishing campaign, for example, the weight assigned to email security detectors may be temporarily increased while the weight of network anomaly detectors remains unchanged.

The output of the composite scoring function is a normalised threat score (0.0 to 1.0) accompanied by a confidence interval and a source attribution vector indicating which sources contributed to the score and by how much. This rich output enables the escalation function to make nuanced decisions: a high composite score driven primarily by a single high-confidence source may warrant immediate escalation, while the same score driven by many low-confidence sources may warrant investigation before escalation. The composite score transforms raw detection signals into actionable threat intelligence that the governance framework can consume.

2. Scope

This protocol applies to all systems that aggregate detection outputs for threat assessment within the Agent Governing framework. Specifically:

• Detection Sources: All systems that generate threat indicators, including anomaly detection engines (AG-003), action rate monitors (AG-004), instruction integrity verifiers (AG-005), credential verification systems (AG-029), external threat intelligence feeds, and federated peer threat signals (AG-788).
• Composite Scoring Engine: The subsystem responsible for receiving source inputs, applying weights, computing the composite score, and publishing the result to the escalation function (AG-784).
• Weight Configuration Interface: The administrative interface through which authorised personnel configure and adjust source weights. Changes to weights are governance configuration changes governed by AG-007.
• Escalation Function: The consumer of composite scores, which uses them as a primary input for threat level transitions (AG-784 R8).
• Audit and Monitoring Systems: Systems that record composite score computations for traceability and performance analysis.
• Exclusions: This protocol does not govern individual detection source behaviour or the escalation/decay logic that consumes the composite score.

3. Why This Matters

Single-source threat assessment is inherently fragile. A detector may be evaded, may experience degraded performance, or may generate false positives that desensitise operators. Composite scoring provides defence-in-depth at the assessment layer: even if one source is evaded or compromised, the remaining sources can still drive the composite score above the escalation threshold. Conversely, composite scoring reduces false positives by requiring corroboration across multiple sources before generating a high-confidence threat assessment.

Concrete Failure Scenario: A financial trading agent is monitored by three detection sources: a transaction pattern analyser, a network behaviour monitor, and a credential anomaly detector. An adversary has reverse-engineered the transaction pattern analyser's detection logic and structures their attack to evade it. Without composite scoring, the governance layer relies solely on the evaded detector and fails to escalate. With AG-790, the network behaviour monitor detects unusual API call patterns (weighted 0.35) and the credential anomaly detector flags a suspicious token refresh sequence (weighted 0.30). The composite score exceeds the Level 3 escalation threshold despite the transaction analyser reporting nominal conditions (weighted 0.35 but contributing 0.0 to the score). The system escalates to Level 3, triggering enhanced monitoring and preventing the adversary from executing their planned market manipulation. Without composite scoring, the attack succeeds, resulting in GBP 12 million in improper trades and a subsequent FCA investigation.

The EU AI Act (Article 9(2)(b)) requires that risk management include the estimation of risks using appropriate methods. SOX Section 404 mandates that internal controls provide reasonable assurance through multiple assessment mechanisms. The FCA's SYSC 6.1.2 requires risk management to be supported by adequate and effective information systems. AG-790 operationalises these requirements by ensuring threat assessment is multi-sourced, weighted, and empirically calibrated.

4. Requirements

• R1: The system MUST accept threat indicators from at least three independent detection sources and compute a composite score using configurable, per-source weights.
• R2: The composite score MUST be a normalised value between 0.0 and 1.0, where 0.0 represents no detected threat and 1.0 represents maximum detected threat across all sources.
• R3: Each composite score computation MUST produce a source attribution vector identifying which sources contributed to the score and the individual weighted contribution of each source.
• R4: The system MUST publish the composite score, confidence interval, and source attribution vector to the escalation function (AG-784) within 200 milliseconds of receiving a qualifying input from any source.
• R5: Weight configuration changes MUST be treated as governance configuration changes per AG-007, requiring authorised approval and tamper-evident logging (AG-006).
• R6: The system MUST detect and flag when a detection source becomes unresponsive or reports degraded health, adjusting the composite calculation to exclude the unhealthy source and recalibrating remaining weights to maintain a valid composite range.
• R7: The system SHOULD maintain a rolling performance baseline for each source, tracking false-positive rates, detection latency, and correlation with confirmed incidents, and SHOULD use this data to inform weight adjustments.
• R8: The system SHOULD apply temporal decay to source inputs, reducing the influence of stale detections on the composite score. Inputs older than a configurable threshold (default: 5 minutes) SHOULD be discounted.
• R9: The system MAY support dynamic weight adjustment through machine learning models that optimise weights based on historical detection accuracy, subject to human approval of weight changes (AG-019).
• R10: The system MUST log every composite score computation with full inputs, weights, intermediate calculations, and output for audit traceability.

5. Maturity Model

Basic

At the Basic level, the system accepts inputs from multiple detection sources and computes a weighted average. Weights are statically configured and rarely updated. Source attribution is available but may not include individual contribution breakdowns. Unhealthy source detection is manual or based on simple heartbeat checks. Temporal decay is not implemented; stale inputs may influence the composite score. Computation logs exist but may lack intermediate calculation details.

Intermediate

At the Intermediate level, automated health monitoring detects unresponsive or degraded sources and adjusts the composite calculation dynamically. Temporal decay is implemented with configurable thresholds. Source attribution includes detailed per-source contribution breakdowns. Weight changes are governed by AG-007 with tamper-evident logging. Rolling performance baselines track false-positive rates and correlation with confirmed incidents. The composite score is published within the 200ms latency requirement. Full computation logs with intermediate calculations are maintained for audit.

Advanced

At the Advanced level, dynamic weight adjustment informed by machine learning models is operational, subject to human approval. The composite scoring engine has been validated through independent adversarial testing, including source evasion scenarios, source poisoning attacks (where an adversary feeds false data to a detection source), and temporal manipulation attempts. Cross-validation with federated peer composite scores (via AG-788) is supported. The system can demonstrate, through historical analysis, that composite scoring reduces false-positive rates by a measurable margin compared to single-source assessment, and this evidence is maintained for regulatory review.

6. Test Criteria

• TC1: Provide inputs from three independent detection sources and verify that a normalised composite score between 0.0 and 1.0 is produced. (Maps to R1, R2)
• TC2: Inspect the output of a composite score computation and verify that a source attribution vector is present with per-source weighted contributions that sum correctly. (Maps to R3)
• TC3: Measure the time from source input receipt to composite score publication and verify it is within 200 milliseconds. (Maps to R4)
• TC4: Modify a source weight and verify that the change is logged as a governance configuration change with authorised approval. (Maps to R5)
• TC5: Disable a detection source and verify that the composite engine detects the absence, excludes the source, and recalibrates remaining weights. (Maps to R6)
• TC6: Submit a detection input, wait beyond the temporal decay threshold, and verify that the input's contribution to subsequent composite scores is reduced or eliminated. (Maps to R8)
• TC7: Verify that every composite score computation is logged with full inputs, weights, intermediate calculations, and output. (Maps to R10)
• TC8: Submit inputs where only two of three sources report threat indicators and verify that the composite score reflects the partial detection with appropriate weighting. (Maps to R1, R3)
• TC9: Inject false-positive inputs from one source over a sustained period and verify that the rolling performance baseline reflects the degraded accuracy. (Maps to R7)

7. Scoring

8. Failure Scenarios

F1: Single Source Dominance Masking Threats (Maps to R1, R3)

Scenario: One detection source is assigned a weight of 0.70 out of 1.0, while two other sources share the remaining 0.30. The dominant source is evaded by an adversary. Despite the two remaining sources both reporting high-severity indicators, the composite score remains below the escalation threshold because the dominant source's 0.70 weight contributes 0.0 to the score.

Impact: HIGH. The composite scoring mechanism, intended to provide defence-in-depth, is undermined by over-reliance on a single source. The adversary effectively needs to evade only one detector.

Mitigation: R7 recommends rolling performance baselines that would detect the dominant source's failure to detect confirmed incidents. Weight governance (R5) should include periodic review of weight distributions to prevent excessive single-source dominance. Implement a minimum contribution threshold that triggers an alert when any single source's weight exceeds a configurable percentage (e.g., 50%).

F2: Stale Detection Input Inflating Composite Score (Maps to R8)

Scenario: A detection source reports a high-severity anomaly and then becomes unresponsive due to a software crash. The composite scoring engine continues to include the stale high-severity input in every computation because temporal decay is not implemented. The threat level remains elevated for hours based on a single stale reading, triggering unnecessary operational restrictions.

Impact: MEDIUM. Governance resources are consumed maintaining an elevated posture based on outdated information. Operators may develop alert fatigue and begin overriding threat levels manually, creating security risks.

Mitigation: R8 mandates temporal decay with configurable thresholds. R6 mandates detection of unresponsive sources. Together, these requirements ensure that stale inputs are discounted and unhealthy sources are excluded from the composite calculation.

F3: Source Poisoning Attack (Maps to R1, R5, R7)

Scenario: An adversary gains access to a detection source's output feed and injects a continuous stream of low-severity false indicators. Over time, the source's rolling performance baseline shows increasing false-positive rates, causing the system to reduce its weight. When the adversary later launches a genuine attack, the compromised source correctly detects it but its low weight means the detection has minimal impact on the composite score.

Impact: HIGH. The adversary manipulates the composite scoring system by deliberately degrading a source's credibility before launching the actual attack. This is a sophisticated, long-term attack against the threat assessment infrastructure itself.

Mitigation: Treat sudden changes in a source's false-positive rate as a potential indicator of source compromise, triggering a security review rather than automatic weight reduction. R9's ML-informed adjustment should include anomaly detection on the source performance metrics themselves.

F4: Composite Score Computation Latency Under Load (Maps to R4)

Scenario: During a complex multi-vector attack, all detection sources simultaneously report high-severity indicators. The composite scoring engine, designed for typical loads of 10-20 inputs per second, receives 500 inputs per second. Computation latency increases from 50ms to 3 seconds, delaying escalation by critical seconds during an active attack.

Impact: HIGH. The escalation function does not receive timely composite scores, resulting in delayed threat level transitions and a window of vulnerability during the most critical phase of an attack.

Mitigation: Implement input buffering with micro-batch computation (aggregate inputs over 50ms windows and compute once). Pre-allocate computational resources for peak loads. Implement a circuit-breaker that publishes a maximum-severity composite score if computation latency exceeds the 200ms threshold, defaulting to a safe (escalated) state.

9. Regulatory Mapping

10. Related Protocols

Document generated under Patent 7 governance framework. Classification: INTERNAL. Review cycle: Quarterly.