🤖 machine learning

Continuous Behavioral Authentication via Multi-Expert BERT Log Analysis for Secure Data Sharing

This paper proposes a continuous behavioral authentication framework that leverages a multi-expert BERT model to analyze Android system logs for real-time user-device context verification, achieving high security with a sub-1% false positive rate through the fusion of network, battery, and Wi-Fi behavioral patterns.

Original authors: Stergios Lantzos, Ilias Syrigos, Apostolos Apostolaras, Thanasis Korakis

Published 2026-06-23

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Stergios Lantzos, Ilias Syrigos, Apostolos Apostolaras, Thanasis Korakis

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your smartphone is like a high-security office building. Traditionally, you only check your ID at the front door (the login screen). Once you're inside, the guards assume you are still the same person for the rest of the day. But what if someone swapped places with you the moment you walked in? They could steal your files, and the building wouldn't know.

This paper proposes a new kind of security guard that never sleeps. Instead of asking for a password every five minutes (which is annoying), it watches how you live inside the building. It doesn't look at your face or fingerprints; instead, it reads the building's daily logbook (the Android system logs) to see if your behavior matches your usual habits.

Here is how their "Smart Guard" system works, broken down into simple parts:

1. The Three "Detectives" (The Multi-Expert System)

The system uses three specialized AI detectives, all based on a powerful language model called BERT (think of it as a super-smart librarian who has read every logbook entry in the world). Each detective watches a different part of your digital life:

Detective Identity (The "Who"): This detective checks the network. It looks at who your phone is talking to. Are you connecting to the same Wi-Fi routers, Bluetooth devices, and IP addresses you usually do? If your phone suddenly starts talking to a strange new device it's never seen before, this detective gets suspicious.
- Analogy: It's like a receptionist who knows exactly which delivery trucks usually visit your office. If a truck with a weird license plate shows up, they raise an alarm.
Detective Battery (The "When"): This detective watches your energy usage. It learns your specific rhythm. Do you usually drain your battery slowly over the day, or do you charge it at specific times? If your battery suddenly drains in 2 minutes instead of 2 hours, or if it charges while you aren't plugged in, this detective knows something is wrong.
- Analogy: It's like a fitness coach who knows your exact running pace. If you suddenly start sprinting at a speed that's physically impossible for you, or if you stop moving but your heart rate spikes, the coach knows you aren't being honest.
Detective Wi-Fi (The "Where"): This detective maps your surroundings. It listens to the invisible Wi-Fi signals around you. Even if you don't connect to them, your phone "sees" them. It creates a map of the radio waves in your room. If you suddenly move to a different building, the map changes completely.
- Analogy: It's like a bat using echolocation. The bat knows exactly what the cave sounds like. If the echoes suddenly sound like an open field, the bat knows it's not in the cave anymore.

2. The "Logbook" Translation

Computers speak in messy, raw text logs. Before the detectives can read them, the system has to clean them up. It uses a tool called Drain to turn messy sentences into neat templates.

Example: Instead of seeing User 192.168.1.5 connected to MAC AA:BB:CC, it turns it into a template: User <IP> connected to <MAC>.
The AI learns the "grammar" of these logs first (Pre-training), so it knows that an IP address should look like an IP address, not a name.

3. The "Scorecard" (Fusion)

Once the three detectives do their work, they don't just shout "Stop!" or "Go!" individually. They pass their confidence scores to a Manager (the Fusion Classifier).

The Manager takes the three scores and combines them into a single "Trust Score."
It uses a mathematical trick (log-space transformation) to make sure that even a tiny drop in trust is noticed.
It compares your current behavior against a "Normal Zone" built from your past data. If your behavior is too far away from your normal zone, it flags you as an anomaly.

4. The Results: How Well Did It Work?

The researchers tested this system on a real phone (a OnePlus 8T) over a week of normal use. Then, they tried to trick it:

The "Imposter" Test: They injected fake network addresses. The system caught them.
The "Battery Hack" Test: They forced the phone to drain its battery super fast. The system caught it.
The "New Location" Test: They moved the phone to a place with different Wi-Fi signals. The system caught it.

The Good News: The system was very good at catching these tricks.
The Great News: It rarely made mistakes on normal people. It had a False Positive Rate of less than 1%. This means it almost never accused a legitimate user of being an imposter, which is crucial so you don't get locked out of your own phone while just walking around your house.

Summary

This paper presents a way to keep your phone secure without annoying you with constant password prompts. By acting like a super-smart librarian who reads the phone's internal logbook, the system can tell if the person holding the phone is still the same person who logged in, based on who they talk to, how they use power, and where they are. It's a "silent guardian" that ensures your digital identity remains valid the whole time you use your device.

Technical Summary: Continuous Behavioral Authentication via Multi-Expert BERT Log Analysis

Problem Statement
Modern mobile devices are central to data-sharing infrastructures governed by zero-trust policies, yet traditional authentication remains static, relying on entry-point verification (e.g., PINs, biometrics). Once a session begins, these mechanisms cannot verify that the legitimate user remains in control, leaving devices vulnerable to physical access attacks. While continuous authentication (CA) based on behavioral biometrics (e.g., typing cadence, motion) exists, it often requires intrusive sensor data. Furthermore, existing log anomaly detectors (e.g., LogBERT) are designed for server infrastructure reliability, producing stateless binary verdicts per window rather than continuous, user-specific trust scores. There is a gap in utilizing raw Android system logs—which natively encode network identity, power consumption dynamics, and spatial topology—as a non-intrusive, sensor-free signal for continuous user-device context assurance.

Methodology
The proposed framework utilizes a four-phase pipeline to transform raw Android system logs into a continuous trust score for a Policy Decision Point (PDP):

Log Parsing: Raw logcat streams are processed by a domain-adapted Drain parser. This decomposes log lines into stable event templates (with typed placeholders like <mac>, <ipv4>) and dynamic variable values.
Feature Engineering: The parsed data is routed into three semantically independent channels:
- Identity Channel: Pairs a sliding window of the last 50 event IDs with the last observed dynamic values, injecting type-aware embeddings.
- Battery Channel: Processes DeviceStatisticsService logs into dual exponential moving-average (EMA) telemetry, encoding operational modes (STABLE, DRAIN, CHARGE) and temporal intervals.
- Wi-Fi Topology Channel: Encodes WifiPickerTracker scans as fused SSID–RSSI token pairs.
Multi-Expert Fine-Tuning: A shared BERT-base encoder (pre-trained on Android log syntax via a domain-specific Masked Language Modeling task) is fine-tuned with specialized heads for each channel:
- Identity Expert: Predicts masked dynamic variable values based on context. It uses a custom vocabulary to prevent fragmentation of identifiers (e.g., IP addresses) and assigns low confidence to Out-of-Vocabulary (OOV) values.
- Battery Expert: Classifies battery transitions into six temporal bins (e.g., TS_INSTANT, TS_MID) and a logical violation class. It is level-agnostic, focusing on the rhythm of power consumption rather than absolute battery percentage.
- Wi-Fi Topology Expert: A dual-head autoencoder that reconstructs both SSID identity (Cross-Entropy) and signal strength (MSE), learning spatial correlations between access points.
Multi-Expert Fusion: The confidence scores ( $S_{Ident}$ , $S_{Batt}$ , $S_{WiFi}$ ) from the three experts are aggregated. They undergo a log-space transformation ( $-\ln(S + \epsilon)$ ) to amplify deviations near high-confidence regions, followed by Z-score standardization. Finally, a 5-nearest-neighbor (5-NN) distance classifier compares the transformed vector against a stored "normal region" derived from clean training data. An anomaly is flagged if the distance exceeds a calibrated threshold (99.9th percentile).

Key Contributions

Framework: A continuous behavioral authentication system that exploits Android system logs as a non-intrusive source of user and device evidence.
Pre-training Strategy: A domain-adapted BERT pre-training approach that learns the structural grammar of Android logs (co-occurrence rules) without needing specific user data initially.
Multi-Expert Architecture: A novel decomposition of behavioral authentication into three distinct dimensions (network identity, battery timing, spatial topology), modeled separately before fusion.
Fusion Mechanism: A log-space transformation and nearest-neighbor classifier that generates a continuous trust score suitable for zero-trust Policy Decision Points, rather than a binary alert.
Evaluation: A comprehensive assessment covering semantic deviations (OOV values), physical anomalies (battery exhaustion), and environmental changes (Wi-Fi topology).

Experimental Results
The framework was evaluated on data collected from a OnePlus 8T running Android 11.0.

Identity Expert: Achieved 99.07% Top-1 accuracy in predicting dynamic variables given context. It demonstrated robustness to OOV values (100% identification rate of unknowns) and high sensitivity to value-context inconsistencies (confidence dropped from ~98% to ~10% with 100% inconsistency).
Battery Expert: Successfully detected resource-exhaustion attacks that altered discharge rhythms. It achieved 100% recall on injected anomalies (rapid discharge events) with zero false positives, as the training distribution contained no TS_INSTANT drain events.
Wi-Fi Topology Expert: Showed high sensitivity to unknown environments (confidence dropped to 0.23%) while tolerating partial signal loss (97.30% confidence with missing APs) and minor fluctuations.
Fusion Classifier: The end-to-end system maintained a False Positive Rate (FPR) below 1% (ranging from 0.45% to 0.78% across datasets) while detecting all injected anomalies (0% False Negative Rate) in the controlled settings. Benign Wi-Fi variations were largely tolerated, confirming the system's ability to distinguish between noise and genuine context shifts.

Significance and Claims
The paper claims that Android system logs serve as a practical, sensor-free signal for continuous authentication. By fusing network, power, and spatial modalities, the system can detect semantic, timing, and topological deviations while maintaining a low false-positive rate. The authors position this work as the first attempt to apply domain-decomposed BERT-based expert models to on-device logs for continuous behavioral authentication, providing a PDP-ready trust score that supports zero-trust architectures without degrading user experience through intrusive re-authentication. The study suggests that such systems can verify the validity of the user-device context throughout a session, addressing a fundamental pillar of modern authentication frameworks.