Wavelet-Aware Anomaly Detection in Multi-Channel User Logs via Deviation Modulation and Resolution-Adaptive Attention

• URL: http://arxiv.org/abs/2601.12231v1
• Date: Sun, 18 Jan 2026 02:49:48 GMT
• Title: Wavelet-Aware Anomaly Detection in Multi-Channel User Logs via Deviation Modulation and Resolution-Adaptive Attention
• Abstract summary: Insider threat detection is a key challenge in enterprise security.<n>We propose a novel framework that integrates wavelet-aware modulation, multi-resolution wavelet decomposition, and resolution-adaptive attention.
• Score: 10.159102430666588
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Insider threat detection is a key challenge in enterprise security, relying on user activity logs that capture rich and complex behavioral patterns. These logs are often multi-channel, non-stationary, and anomalies are rare, making anomaly detection challenging. To address these issues, we propose a novel framework that integrates wavelet-aware modulation, multi-resolution wavelet decomposition, and resolution-adaptive attention for robust anomaly detection. Our approach first applies a deviation-aware modulation scheme to suppress routine behaviors while amplifying anomalous deviations. Next, discrete wavelet transform (DWT) decomposes the log signals into multi-resolution representations, capturing both long-term trends and short-term anomalies. Finally, a learnable attention mechanism dynamically reweights the most discriminative frequency bands for detection. On the CERT r4.2 benchmark, our approach consistently outperforms existing baselines in precision, recall, and F1 score across various time granularities and scenarios.

Related papers

• Freq-RemoteVAR: Next-Frequency Autoregressive Modeling for Remote Sensing Change Detection [14.222308941007674]
  We propose a frequency autoregressive framework that reformulates change detection as a structured generation problem in the frequency domain.<n>We develop a Frequency VAR Transformer, which performs causal autoregressive modeling over frequency tokens.<n>Experiments on CDD, GZ-CD, and LEVIR-CD demonstrate that Freq-Remote consistently outperforms existing methods.
  arXiv  Detail & Related papers  (2026-07-28T14:59:56Z)
• LEFT: Learnable Fusion of Tri-view Tokens for Unsupervised Time Series Anomaly Detection [53.191369031661885]
  Unsupervised time series anomaly detection aims to build a model for identifying abnormal timestamps without assuming the availability of annotations.<n>We present Learnable Fusion of Tri-view Tokens (LEFT), a unified unsupervised TSAD framework that models anomalies as inconsistencies across complementary representations.<n>Experiments on real-world benchmarks show that LEFT yields the best detection accuracy against SOTA baselines, while achieving a 5x reduction on FLOPs and 8x speed-up for training.
  arXiv  Detail & Related papers  (2026-02-09T13:33:49Z)
• FusAD: Time-Frequency Fusion with Adaptive Denoising for General Time Series Analysis [92.23551599659186]
  Time series analysis plays a vital role in fields such as finance, healthcare, industry, and meteorology.<n>FusAD is a unified analysis framework designed for diverse time series tasks.
  arXiv  Detail & Related papers  (2025-12-16T04:34:27Z)
• Log2Sig: Frequency-Aware Insider Threat Detection via Multivariate Behavioral Signal Decomposition [6.945554245486656]
  Insider threat detection presents a significant challenge due to the deceptive nature of malicious behaviors.<n>We propose Log2Sig, a robust anomaly detection framework that transforms user logs into behavioral frequency signals.<n>We show that Log2Sig significantly outperforms state-of-the-art baselines in both accuracy and F1 score.
  arXiv  Detail & Related papers  (2025-08-06T18:47:26Z)
• Track Any Anomalous Object: A Granular Video Anomaly Detection Pipeline [63.96226274616927]
  A new framework called Track Any Anomalous Object (TAO) introduces a granular video anomaly detection pipeline.<n>Unlike methods that assign anomaly scores to every pixel, our approach transforms the problem into pixel-level tracking of anomalous objects.<n>Experiments demonstrate that TAO sets new benchmarks in accuracy and robustness.
  arXiv  Detail & Related papers  (2025-06-05T15:49:39Z)
• SlowFastVAD: Video Anomaly Detection via Integrating Simple Detector and RAG-Enhanced Vision-Language Model [52.47816604709358]
  Video anomaly detection (VAD) aims to identify unexpected events in videos and has wide applications in safety-critical domains.<n> vision-language models (VLMs) have demonstrated strong multimodal reasoning capabilities, offering new opportunities for anomaly detection.<n>We propose SlowFastVAD, a hybrid framework that integrates a fast anomaly detector with a slow anomaly detector.
  arXiv  Detail & Related papers  (2025-04-14T15:30:03Z)
• PA-CLIP: Enhancing Zero-Shot Anomaly Detection through Pseudo-Anomaly Awareness [10.364634539199422]
  We introduce PA-CLIP, a zero-shot anomaly detection method that reduces background noise and enhances defect detection through a pseudo-anomaly-based framework.<n>The proposed method integrates a multiscale feature aggregation strategy for capturing detailed global and local information.<n>It outperforms existing zero-shot methods, providing a robust solution for industrial defect detection.
  arXiv  Detail & Related papers  (2025-03-03T08:29:27Z)
• Calibrated Unsupervised Anomaly Detection in Multivariate Time-series using Reinforcement Learning [0.0]
  This paper investigates unsupervised anomaly detection in time-series data using reinforcement learning (RL) in the latent space of an autoencoder.<n>We use wavelet analysis to enhance anomaly detection, enabling time-series data decomposition into both time and frequency domains.<n>We calibrate the decision boundary by generating synthetic anomalies and embedding a supervised framework within the model.
  arXiv  Detail & Related papers  (2025-02-05T15:02:40Z)
• Deep Multi-Manifold Transformation Based Multivariate Time Series Fault Detection [22.005142941322912]
  We propose a new method that combines a neighborhood-driven data augmentation strategy with a multi-manifold representation learning framework.<n>Our method achieves superior performance in terms of both accuracy and robustness, showing strong potential for generalization and real-world deployment.
  arXiv  Detail & Related papers  (2024-05-25T14:48:04Z)
• Revisiting VAE for Unsupervised Time Series Anomaly Detection: A Frequency Perspective [40.21603048003118]
  Variational Autoencoders (VAEs) have gained popularity in recent decades due to their superior de-noising capabilities. FCVAE exploits an innovative approach to concurrently integrate both the global and local frequency features into the condition of Conditional Variational Autoencoder (CVAE) Our approach has been evaluated on public datasets and a large-scale cloud system, and the results demonstrate that it outperforms state-of-the-art methods.
  arXiv  Detail & Related papers  (2024-02-05T09:06:57Z)
• Graph Spatiotemporal Process for Multivariate Time Series Anomaly Detection with Missing Values [67.76168547245237]
  We introduce a novel framework called GST-Pro, which utilizes a graphtemporal process and anomaly scorer to detect anomalies. Our experimental results show that the GST-Pro method can effectively detect anomalies in time series data and outperforms state-of-the-art methods.
  arXiv  Detail & Related papers  (2024-01-11T10:10:16Z)
• DiffusionAD: Norm-guided One-step Denoising Diffusion for Anomaly Detection [80.20339155618612]
  DiffusionAD is a novel anomaly detection pipeline comprising a reconstruction sub-network and a segmentation sub-network.<n>A rapid one-step denoising paradigm achieves hundreds of times acceleration while preserving comparable reconstruction quality.<n>Considering the diversity in the manifestation of anomalies, we propose a norm-guided paradigm to integrate the benefits of multiple noise scales.
  arXiv  Detail & Related papers  (2023-03-15T16:14:06Z)
• Adaptive Frequency Learning in Two-branch Face Forgery Detection [66.91715092251258]
  We propose Adaptively learn Frequency information in the two-branch Detection framework, dubbed AFD. We liberate our network from the fixed frequency transforms, and achieve better performance with our data- and task-dependent transform layers.
  arXiv  Detail & Related papers  (2022-03-27T14:25:52Z)
• Memory-augmented Adversarial Autoencoders for Multivariate Time-series Anomaly Detection with Deep Reconstruction and Prediction [4.033624665609417]
  We propose MemAAE, a novel unsupervised anomaly detection method for time-series. By jointly training two complementary proxy tasks, reconstruction and prediction, we show that detecting anomalies via multiple tasks obtains superior performance. MemAAE achieves an overall F1 score of 0.90 on four public datasets, significantly outperforming the best baseline by 0.02.
  arXiv  Detail & Related papers  (2021-10-15T18:29:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.