Function classify_perf_event 

pub fn classify_perf_event(event_type: u32, config: u64) -> bool

Classify whether a perf_event is suspicious.

Flags RAW PMU access (type 4) and certain cache event configurations (type 3).