Equivalence of the Otsu Method Threshold to the Decision Rule of the MAP Classifier in the Task of Information Security Event Detection

Abstract

The relationship between the empirical threshold of the classical Otsu method and the decision rule of the Bayesian maximum a posteriori (MAP) classifier is investigated. It is established that strict equivalence of the two thresholds holds under two conditions: equal class variances and equal prior probabilities. When the equal-priors condition is relaxed (with homoscedasticity preserved), the thresholds diverge by an analytically expressed quantity proportional to the logarithm of the ratio of prior probabilities. In the general heteroscedastic case, the MAP classifier defines a quadratic boundary that cannot be represented by a single scalar threshold, and the Otsu method remains its linear approximation. Thus, the thresholds coincide only in the special case; outside of it, an analytical expression for the magnitude of the deviation has been obtained. The obtained result allows the application of the Otsu method to the task of information security event detection to be considered a theoretically grounded procedure rather than a heuristic, and establishes the connection between the empirical criterion and the probabilistic model of the observed features.