[3SidedSquare]

The key is that you do only enable the screening when an anomaly is detected, but the screening itself is not based upon if a particular request seems to be triggering the anomaly.

A separate process can be run to monitor the system's resources, screening can be triggered by resources exceeding some threshold value.

I've not encountered in any relatively low level language( I know Matlab has it, and so does R ) that have the tree type built-in. It tends to just be a re-declared array. You can maintain dynamically sized arrays by using pointers, but that's beside my point. Even if you only are using the number of bytes required by the size of the whitelist, that isn't scalable. In the worst-case, you need around 7 or 8 sub-trees per IP you want whitelisted. Assuming you use the smallest data type( in C ), that's still 7 or 8 bytes per ip. That's not the best to try to store in RAM. If you store them in a file, you can open the file once, declare it as a superglobal, and read it when needed, searching for the IP to test and returning true if it's present.

ArrayLists(dynamically realizable arrays) are also not arrays. As for built-in types, different problems often require different trees, and generally are re-coded per the requirements of the problem. You need exactly 12 subtrees per ip, but this isn't very much, let's do some math. Objects in python (because it's the easiest for me) cost 36 bytes per object[1], pointers cost 32 or 64 bytes, depending on the computer; let's assume 64. Finally, actually storing the "trust level" should cost 12 bytes (an int)[3]. Each new IP costs a MAXIMUM of 12 objects, 11 pointers, and 1 int; for a grand total of 1148 bytes. Let's pretend that the maximum space is taken before the algorithm begins to optimize (worst case scenario)
We still come out to have .3mb (292740 bytes) for the entire range of 0-255.x.x.x

even if you have a low end computer with 512 mb of ram[4] it's still feasible to store.

storing them in a file will be unhelpful (especially during a dos attack) because it will take far too long to open, search through, and close the file again.

I'm still trying to write some sample code, as a proof of concept, but I've run into bug after bug, and I have a class in about half an hour.