Complex Threat Detection: Learning vs. Rules, using a Hierarchy of Features