Log2Sig: Frequency-Aware Insider Threat Detection via Multivariate Behavioral Signal Decomposition

• URL: http://arxiv.org/abs/2508.05696v1
• Date: Wed, 06 Aug 2025 18:47:26 GMT
• Title: Log2Sig: Frequency-Aware Insider Threat Detection via Multivariate Behavioral Signal Decomposition
• Abstract summary: Insider threat detection presents a significant challenge due to the deceptive nature of malicious behaviors.<n>We propose Log2Sig, a robust anomaly detection framework that transforms user logs into behavioral frequency signals.<n>We show that Log2Sig significantly outperforms state-of-the-art baselines in both accuracy and F1 score.
• Score: 6.945554245486656
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Insider threat detection presents a significant challenge due to the deceptive nature of malicious behaviors, which often resemble legitimate user operations. However, existing approaches typically model system logs as flat event sequences, thereby failing to capture the inherent frequency dynamics and multiscale disturbance patterns embedded in user behavior. To address these limitations, we propose Log2Sig, a robust anomaly detection framework that transforms user logs into multivariate behavioral frequency signals, introducing a novel representation of user behavior. Log2Sig employs Multivariate Variational Mode Decomposition (MVMD) to extract Intrinsic Mode Functions (IMFs), which reveal behavioral fluctuations across multiple temporal scales. Based on this, the model further performs joint modeling of behavioral sequences and frequency-decomposed signals: the daily behavior sequences are encoded using a Mamba-based temporal encoder to capture long-term dependencies, while the corresponding frequency components are linearly projected to match the encoder's output dimension. These dual-view representations are then fused to construct a comprehensive user behavior profile, which is fed into a multilayer perceptron for precise anomaly detection. Experimental results on the CERT r4.2 and r5.2 datasets demonstrate that Log2Sig significantly outperforms state-of-the-art baselines in both accuracy and F1 score.

Related papers

• DeMTS: Denoising Trajectories as Multivariate Time Series for Hallucination Detection in Diffusion Language Models [59.414664850109155]
  Diffusion large language models (D-LLMs) have emerged as a promising paradigm for text generation.<n>D-LLMs remain vulnerable to hallucinations, where fluent outputs may contain factually incorrect or unsupported content.
  arXiv  Detail & Related papers  (2026-07-24T06:45:43Z)
• MV-Gate: Insider Threat Detection via Multi-View Behavioral Statistics and Semantic Modeling [9.029887829076866]
  We propose MV-Gate, a behavior modeling framework that integrates statistical regularities with sequence semantics.<n>An anomaly-aware computation gating mechanism injects these statistical views into the attention, guiding the encoder to emphasize statistically irregular events.
  arXiv  Detail & Related papers  (2026-05-18T02:29:03Z)
• SMKC: Sketch Based Kernel Correlation Images for Variable Cardinality Time Series Anomaly Detection [0.0]
  In operational environments, monitoring systems frequently experience sensor churn.<n>We propose SMKC, a framework that decouples the dynamic input structure from the anomaly detector.<n>We find that a detector using random projections and nearest neighbors on the SMKC representation performs competitively with fully trained baselines.
  arXiv  Detail & Related papers  (2026-01-28T21:15:11Z)
• Wavelet-Aware Anomaly Detection in Multi-Channel User Logs via Deviation Modulation and Resolution-Adaptive Attention [10.159102430666588]
  Insider threat detection is a key challenge in enterprise security.<n>We propose a novel framework that integrates wavelet-aware modulation, multi-resolution wavelet decomposition, and resolution-adaptive attention.
  arXiv  Detail & Related papers  (2026-01-18T02:49:48Z)
• FusAD: Time-Frequency Fusion with Adaptive Denoising for General Time Series Analysis [92.23551599659186]
  Time series analysis plays a vital role in fields such as finance, healthcare, industry, and meteorology.<n>FusAD is a unified analysis framework designed for diverse time series tasks.
  arXiv  Detail & Related papers  (2025-12-16T04:34:27Z)
• HiFIRec: Towards High-Frequency yet Low-Intention Behaviors for Multi-Behavior Recommendation [10.558247582357783]
  HiFIRec is a novel multi-behavior recommendation method.<n>It corrects the effect of high-frequency yet low-intention behaviors by differential behavior modeling.<n>Experiments on two benchmarks show that HiFIRec relatively improves HR@10 by 4.21%-6.81% over several state-of-the-art methods.
  arXiv  Detail & Related papers  (2025-09-30T04:20:45Z)
• VMDNet: Time Series Forecasting with Leakage-Free Samplewise Variational Mode Decomposition and Multibranch Decoding [18.868677160493526]
  Variational Mode Decomposition (VMD) is a powerful signal-processing method for periodicity-aware decomposition.<n>We propose VMDNet, a causality-preserving framework that applies sample-wise VMD to avoid leakage.<n> Experiments on two energy-related datasets demonstrate that VMDNet achieves state-of-the-art results when periodicity is strong.
  arXiv  Detail & Related papers  (2025-09-18T20:02:14Z)
• Multi-granularity Interest Retrieval and Refinement Network for Long-Term User Behavior Modeling in CTR Prediction [68.90783662117936]
  Click-through Rate (CTR) prediction is crucial for online personalization platforms.<n>Recent advancements have shown that modeling rich user behaviors can significantly improve the performance of CTR prediction.<n>We propose Multi-granularity Interest Retrieval and Refinement Network (MIRRN)
  arXiv  Detail & Related papers  (2024-11-22T15:29:05Z)
• What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approach [12.980238412281471]
  We propose a Transformer-based anomaly detection model to capture semantic, sequential, and temporal information in log data.<n>We conduct experiments with different combinations of input features to evaluate the roles of different types of information in anomaly detection.<n>The results indicate that the event occurrence information plays a key role in identifying anomalies, while the impact of the sequential and temporal information is not significant for anomaly detection on the studied public datasets.
  arXiv  Detail & Related papers  (2024-09-30T17:03:13Z)
• Deep Multi-Manifold Transformation Based Multivariate Time Series Fault Detection [22.005142941322912]
  We propose a new method that combines a neighborhood-driven data augmentation strategy with a multi-manifold representation learning framework.<n>Our method achieves superior performance in terms of both accuracy and robustness, showing strong potential for generalization and real-world deployment.
  arXiv  Detail & Related papers  (2024-05-25T14:48:04Z)
• Graph Spatiotemporal Process for Multivariate Time Series Anomaly Detection with Missing Values [67.76168547245237]
  We introduce a novel framework called GST-Pro, which utilizes a graphtemporal process and anomaly scorer to detect anomalies. Our experimental results show that the GST-Pro method can effectively detect anomalies in time series data and outperforms state-of-the-art methods.
  arXiv  Detail & Related papers  (2024-01-11T10:10:16Z)
• Dynamic Erasing Network Based on Multi-Scale Temporal Features for Weakly Supervised Video Anomaly Detection [103.92970668001277]
  We propose a Dynamic Erasing Network (DE-Net) for weakly supervised video anomaly detection. We first propose a multi-scale temporal modeling module, capable of extracting features from segments of varying lengths. Then, we design a dynamic erasing strategy, which dynamically assesses the completeness of the detected anomalies.
  arXiv  Detail & Related papers  (2023-12-04T09:40:11Z)
• GLAD: Content-aware Dynamic Graphs For Log Anomaly Detection [49.9884374409624]
  GLAD is a Graph-based Log Anomaly Detection framework designed to detect anomalies in system logs. We introduce GLAD, a Graph-based Log Anomaly Detection framework designed to detect anomalies in system logs.
  arXiv  Detail & Related papers  (2023-09-12T04:21:30Z)
• MultiWave: Multiresolution Deep Architectures through Wavelet Decomposition for Multivariate Time Series Prediction [6.980076213134384]
  MultiWave is a novel framework that enhances deep learning time series models by incorporating components that operate at the intrinsic frequencies of signals. We show that MultiWave consistently identifies critical features and their frequency components, thus providing valuable insights into the applications studied.
  arXiv  Detail & Related papers  (2023-06-16T20:07:15Z)
• An Attention-based ConvLSTM Autoencoder with Dynamic Thresholding for Unsupervised Anomaly Detection in Multivariate Time Series [2.9685635948299995]
  We propose an unsupervised Attention-based Convolutional Long Short-Term Memory (ConvLSTM) Autoencoder with Dynamic Thresholding (ACLAE-DT) framework for anomaly detection and diagnosis. The framework starts by pre-processing and enriching the data, before constructing feature images to characterize the system statuses. The constructed feature images are fed into an attention-based ConvLSTM autoencoder, which aims to encode the constructed feature images and capture the temporal behavior. The reconstruction errors are then computed and subjected to a statistical-based, dynamic thresholding mechanism to detect and diagnose the anomalies
  arXiv  Detail & Related papers  (2022-01-23T04:01:43Z)
• Time-Window Group-Correlation Support vs. Individual Features: A Detection of Abnormal Users [13.516999440962678]
  We propose ACOBE, an Anomaly detection method based on COmpound BEhavior. Our evaluation shows that ACOBE outperforms prior work by a large margin in terms of precision and recall.
  arXiv  Detail & Related papers  (2020-12-27T16:30:31Z)
• A Novel Anomaly Detection Algorithm for Hybrid Production Systems based on Deep Learning and Timed Automata [73.38551379469533]
  DAD:DeepAnomalyDetection is a new approach for automatic model learning and anomaly detection in hybrid production systems. It combines deep learning and timed automata for creating behavioral model from observations. The algorithm has been applied to few data sets including two from real systems and has shown promising results.
  arXiv  Detail & Related papers  (2020-10-29T08:27:43Z)
• Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs [59.04636530383049]
  We propose Logsy, a classification-based method to learn log representations. We show an average improvement of 0.25 in the F1 score, compared to the previous methods.
  arXiv  Detail & Related papers  (2020-08-21T07:26:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.