Wavelet-Aware Anomaly Detection in Multi-Channel User Logs via Deviation Modulation and Resolution-Adaptive Attention

TL;DR

The paper tackles insider threat detection from multi-channel, non-stationary user logs where anomalies are rare. It introduces a wavelet-aware, multi-resolution framework integrating deviation-aware modulation, discrete wavelet decomposition, and resolution-adaptive attention to produce a robust anomaly representation. Empirical results on the CERT r4.2 benchmark show state-of-the-art performance with high precision and recall across multiple time granularities, and ablation studies confirm the necessity of each component. The approach offers a scalable, frequency-aware solution for real-world enterprise security with potential for streaming analysis and deployment on diverse log datasets.

Abstract

Insider threat detection is a key challenge in enterprise security, relying on user activity logs that capture rich and complex behavioral patterns. These logs are often multi-channel, non-stationary, and anomalies are rare, making anomaly detection challenging. To address these issues, we propose a novel framework that integrates wavelet-aware modulation, multi-resolution wavelet decomposition, and resolution-adaptive attention for robust anomaly detection. Our approach first applies a deviation-aware modulation scheme to suppress routine behaviors while amplifying anomalous deviations. Next, discrete wavelet transform (DWT) decomposes the log signals into multi-resolution representations, capturing both long-term trends and short-term anomalies. Finally, a learnable attention mechanism dynamically reweights the most discriminative frequency bands for detection. On the CERT r4.2 benchmark, our approach consistently outperforms existing baselines in precision, recall, and F1 score across various time granularities and scenarios.

Figures (1)

• Figure 1: Overview of our framework. Raw user logs are converted into an action matrix $\mathbf{X}\!\in\!\mathbb{R}^{H\times W}$, which is then modulated by bias-aware weights $\mathbf{M}\!\in\!\mathbb{R}^{H\times W}$, resulting in a modulation matrix $\hat{\mathbf{X}}=\mathbf{X}\odot\mathbf{M}$ (right). The modulation matrix is decomposed into $J{+}1$ resolution subbands $\tilde{\mathbf{X}}\!\in\!\mathbb{R}^{(J{+}1)\times H\times W}$ using a DWT, where the weights are determined by a resolution-adaptive attention mechanism. This matrix, comprised of multiple resolution subbands, is then fed into the detection model to produce anomaly results.