{"id":"https://openalex.org/W7127182603","doi":"https://doi.org/10.1109/trustcom66490.2025.00340","title":"Log2Sig: Frequency-Aware Insider Threat Detection via Multivariate Behavioral Signal Decomposition","display_name":"Log2Sig: Frequency-Aware Insider Threat Detection via Multivariate Behavioral Signal Decomposition","publication_year":2025,"publication_date":"2025-11-14","ids":{"openalex":"https://openalex.org/W7127182603","doi":"https://doi.org/10.1109/trustcom66490.2025.00340"},"language":null,"primary_location":{"id":"doi:10.1109/trustcom66490.2025.00340","is_oa":false,"landing_page_url":"https://doi.org/10.1109/trustcom66490.2025.00340","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 24th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5015711713","display_name":"Kaichuan Kong","orcid":"https://orcid.org/0000-0002-3228-8980"},"institutions":[{"id":"https://openalex.org/I159948400","display_name":"Jinan University","ror":"https://ror.org/02xe5ns62","country_code":"CN","type":"education","lineage":["https://openalex.org/I159948400"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kaichuan Kong","raw_affiliation_strings":["Jinan University,College of Cyber Security,Guangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Jinan University,College of Cyber Security,Guangzhou,China","institution_ids":["https://openalex.org/I159948400"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5124797191","display_name":"Dongjie Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I159948400","display_name":"Jinan University","ror":"https://ror.org/02xe5ns62","country_code":"CN","type":"education","lineage":["https://openalex.org/I159948400"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dongjie Liu","raw_affiliation_strings":["Jinan University,College of Cyber Security,Guangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Jinan University,College of Cyber Security,Guangzhou,China","institution_ids":["https://openalex.org/I159948400"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5119339011","display_name":"Xiaobo Jin","orcid":null},"institutions":[{"id":"https://openalex.org/I69356397","display_name":"Xi\u2019an Jiaotong-Liverpool University","ror":"https://ror.org/03zmrmn05","country_code":"CN","type":"education","lineage":["https://openalex.org/I69356397"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaobo Jin","raw_affiliation_strings":["Xi’an Jiaotong-Liverpool University,School of Advanced Technology,Suzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Xi’an Jiaotong-Liverpool University,School of Advanced Technology,Suzhou,China","institution_ids":["https://openalex.org/I69356397"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5010114181","display_name":"Zhiying Li","orcid":"https://orcid.org/0000-0001-6056-9387"},"institutions":[{"id":"https://openalex.org/I159948400","display_name":"Jinan University","ror":"https://ror.org/02xe5ns62","country_code":"CN","type":"education","lineage":["https://openalex.org/I159948400"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhiying Li","raw_affiliation_strings":["Jinan University,College of Cyber Security,Guangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Jinan University,College of Cyber Security,Guangzhou,China","institution_ids":["https://openalex.org/I159948400"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5123286507","display_name":"Guanggang Geng","orcid":null},"institutions":[{"id":"https://openalex.org/I159948400","display_name":"Jinan University","ror":"https://ror.org/02xe5ns62","country_code":"CN","type":"education","lineage":["https://openalex.org/I159948400"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guanggang Geng","raw_affiliation_strings":["Jinan University,College of Cyber Security,Guangzhou,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Jinan University,College of Cyber Security,Guangzhou,China","institution_ids":["https://openalex.org/I159948400"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"2868","last_page":"2876"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.42480000853538513,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.42480000853538513,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.1370999962091446,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.10140000283718109,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/insider-threat","display_name":"Insider threat","score":0.7386000156402588},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.614799976348877},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.5673999786376953},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.4968000054359436},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.49219998717308044},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.4569000005722046},{"id":"https://openalex.org/keywords/multivariate-statistics","display_name":"Multivariate statistics","score":0.4487000107765198},{"id":"https://openalex.org/keywords/mode","display_name":"Mode (computer interface)","score":0.41670000553131104},{"id":"https://openalex.org/keywords/multilayer-perceptron","display_name":"Multilayer perceptron","score":0.388700008392334}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7480000257492065},{"id":"https://openalex.org/C2776633304","wikidata":"https://www.wikidata.org/wiki/Q6038026","display_name":"Insider threat","level":3,"score":0.7386000156402588},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.614799976348877},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5920000076293945},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.5673999786376953},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.4968000054359436},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.49219998717308044},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.46129998564720154},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.4569000005722046},{"id":"https://openalex.org/C161584116","wikidata":"https://www.wikidata.org/wiki/Q1952580","display_name":"Multivariate statistics","level":2,"score":0.4487000107765198},{"id":"https://openalex.org/C48677424","wikidata":"https://www.wikidata.org/wiki/Q6888088","display_name":"Mode (computer interface)","level":2,"score":0.41670000553131104},{"id":"https://openalex.org/C179717631","wikidata":"https://www.wikidata.org/wiki/Q2991667","display_name":"Multilayer perceptron","level":3,"score":0.388700008392334},{"id":"https://openalex.org/C124681953","wikidata":"https://www.wikidata.org/wiki/Q339062","display_name":"Decomposition","level":2,"score":0.37860000133514404},{"id":"https://openalex.org/C78639753","wikidata":"https://www.wikidata.org/wiki/Q3318160","display_name":"Behavioral modeling","level":2,"score":0.3716999888420105},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.36559998989105225},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.3450999855995178},{"id":"https://openalex.org/C60908668","wikidata":"https://www.wikidata.org/wiki/Q690207","display_name":"Perceptron","level":3,"score":0.3375000059604645},{"id":"https://openalex.org/C45273575","wikidata":"https://www.wikidata.org/wiki/Q578970","display_name":"Spectrogram","level":2,"score":0.3156999945640564},{"id":"https://openalex.org/C83804111","wikidata":"https://www.wikidata.org/wiki/Q1063558","display_name":"Behavioral pattern","level":2,"score":0.3149000108242035},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.3093000054359436},{"id":"https://openalex.org/C2778971194","wikidata":"https://www.wikidata.org/wiki/Q1664551","display_name":"Insider","level":2,"score":0.2980000078678131},{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.2957000136375427},{"id":"https://openalex.org/C2779843651","wikidata":"https://www.wikidata.org/wiki/Q7390335","display_name":"SIGNAL (programming language)","level":2,"score":0.2919999957084656},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.2906000018119812},{"id":"https://openalex.org/C18555067","wikidata":"https://www.wikidata.org/wiki/Q8375051","display_name":"Joint (building)","level":2,"score":0.2840000092983246},{"id":"https://openalex.org/C23224414","wikidata":"https://www.wikidata.org/wiki/Q176769","display_name":"Hidden Markov model","level":2,"score":0.275299996137619},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.2721000015735626},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2678999900817871},{"id":"https://openalex.org/C42355184","wikidata":"https://www.wikidata.org/wiki/Q1361088","display_name":"Matrix decomposition","level":3,"score":0.2621000111103058},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.25369998812675476}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/trustcom66490.2025.00340","is_oa":false,"landing_page_url":"https://doi.org/10.1109/trustcom66490.2025.00340","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE 24th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.687454879283905,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":25,"referenced_works":["https://openalex.org/W2123563890","https://openalex.org/W2744120475","https://openalex.org/W2958872067","https://openalex.org/W2986944522","https://openalex.org/W3000429356","https://openalex.org/W3153493802","https://openalex.org/W3165582618","https://openalex.org/W4200292123","https://openalex.org/W4285356110","https://openalex.org/W4312938817","https://openalex.org/W4313245390","https://openalex.org/W4319987480","https://openalex.org/W4320169128","https://openalex.org/W4328053447","https://openalex.org/W4385076040","https://openalex.org/W4386066497","https://openalex.org/W4389937376","https://openalex.org/W4390871511","https://openalex.org/W4391589219","https://openalex.org/W4391934197","https://openalex.org/W4392151675","https://openalex.org/W4393141466","https://openalex.org/W4401979652","https://openalex.org/W4403937240","https://openalex.org/W4413074849"],"related_works":[],"abstract_inverted_index":{"Insider":[0],"threat":[1],"detection":[2,58],"presents":[3],"a":[4,55,70,116,146,155],"significant":[5],"challenge":[6],"due":[7],"to":[8,34,83,120,132,144],"the":[9,36,97,109,125,134,165],"deceptive":[10],"nature":[11],"of":[12,73,103],"malicious":[13],"behaviors,":[14],"which":[15,86,151],"often":[16],"resemble":[17],"legitimate":[18],"user":[19,46,62,74,148],"operations.":[20],"However,":[21],"existing":[22],"approaches":[23],"typically":[24],"model":[25,98],"system":[26],"logs":[27,63],"as":[28],"flat":[29],"event":[30],"sequences,":[31],"thereby":[32],"failing":[33],"capture":[35,121],"inherent":[37],"frequency":[38,67,127],"dynamics":[39],"and":[40,106,168,181],"multiscale":[41],"disturbance":[42],"patterns":[43],"embedded":[44],"in":[45,178],"behavior.":[47,75],"To":[48],"address":[49],"these":[50],"limitations,":[51],"we":[52],"propose":[53],"Log2Sig,":[54],"robust":[56],"anomaly":[57,160],"framework":[59],"that":[60,172],"transforms":[61],"into":[64,154],"multivariate":[65],"behavioral":[66,88,104],"signals,":[68],"introducing":[69],"novel":[71],"representation":[72],"Log2Sig":[76,173],"employs":[77],"Multivariate":[78],"Variational":[79],"Mode":[80],"Decomposition":[81],"(MVMD)":[82],"extract":[84],"IMFs,":[85],"reveal":[87],"fluctuations":[89],"across":[90],"multiple":[91],"temporal":[92,118],"scales.":[93],"Based":[94],"on":[95,164],"this,":[96],"further":[99],"performs":[100],"joint":[101],"modeling":[102],"sequences":[105,112],"frequency-decomposed":[107],"signals:":[108],"daily":[110],"behavior":[111,149],"are":[113,129,141],"encoded":[114],"using":[115],"Mamba-Based":[117],"encoder":[119],"long-term":[122],"dependencies,":[123],"while":[124],"corresponding":[126],"components":[128],"linearly":[130],"projected":[131],"match":[133],"encoder\u2019s":[135],"output":[136],"dimension.":[137],"These":[138],"dual-view":[139],"representations":[140],"then":[142],"fused":[143],"construct":[145],"comprehensive":[147],"profile,":[150],"is":[152],"fed":[153],"multilayer":[156],"perceptron":[157],"for":[158],"precise":[159],"detection.":[161],"Experimental":[162],"results":[163],"CERT":[166],"r4.2":[167],"r5.2":[169],"datasets":[170],"demonstrate":[171],"significantly":[174],"outperforms":[175],"state-of-the-art":[176],"baselines":[177],"both":[179],"accuracy":[180],"F1":[182],"score.":[183]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-02-03T00:00:00"}