An Adversarial Robust Behavior Sequence Anomaly Detection Approach Based on Critical Behavior Unit Learning

2025-09-19

AI Summary

Existing RNN/LSTM-based behavioral sequence anomaly detection models suffer from poor robustness against adversarial perturbations—particularly sequence reordering—leading to vulnerability under evasion attacks. To address this, we propose a Key Behavioral Unit (KBU)-driven robust detection framework. Our method introduces the first formal definition and extraction of semantically complete, context-sensitive local behavioral units, which are modeled via a multi-level deep architecture capturing both intra-unit structural patterns and inter-unit dependencies. This design inherently mitigates the impact of structural perturbations while enabling unified analysis of heterogeneous system logs—including API calls and syscalls—and supporting both high- and low-level behavioral representations. Extensive experiments demonstrate that our approach significantly outperforms state-of-the-art baselines under diverse obfuscation attacks, achieving an 8.2% absolute improvement in detection accuracy, alongside substantial gains in robustness and generalization capability.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Sequential deep learning models (e.g., RNN and LSTM) can learn the sequence features of software behaviors, such as API or syscall sequences. However, recent studies have shown that these deep learning-based approaches are vulnerable to adversarial samples. Attackers can use adversarial samples to change the sequential characteristics of behavior sequences and mislead malware classifiers. In this paper, an adversarial robustness anomaly detection method based on the analysis of behavior units is proposed to overcome this problem. We extract related behaviors that usually perform a behavior intention as a behavior unit, which contains the representative semantic information of local behaviors and can be used to improve the robustness of behavior analysis. By learning the overall semantics of each behavior unit and the contextual relationships among behavior units based on a multilevel deep learning model, our approach can mitigate perturbation attacks that target local and large-scale behaviors. In addition, our approach can be applied to both low-level and high-level behavior logs (e.g., API and syscall logs). The experimental results show that our approach outperforms all the compared methods, which indicates that our approach has better performance against obfuscation attacks.

Problem

• Detecting malware via behavior sequences vulnerable to adversarial attacks
• Improving robustness against perturbation attacks on behavior sequences
• Enhancing anomaly detection for both low and high level behavior logs

Innovation

• Behavior unit learning for robustness
• Multilevel deep learning model
• Mitigates local and large-scale attacks