用安卓日志分析实现无感持续认证，精准识别异常行为。
Continuous Behavioral Authentication via Multi-Expert BERT Log Analysis for Secure Data Sharing
- 通过BERT解析系统日志，构建三专家模型分别识别网络、电池和Wi-Fi异常。
- 在真实场景中检测到语义、电池时序与拓扑偏差，误报率低于1%。
- 无需额外传感器，适合移动与零信任环境的持续安全验证。
面向移动设备与零信任系统的持续认证需在初始登录后持续验证用户-设备上下文有效性。本文提出一种基于安卓系统日志的BERT日志分析框架，将logcat流解析为事件模板与动态变量，对安卓日志语法预训练领域适配的BERT编码器，并微调三个专家模型以识别网络/设备身份、电池状态切换时机及Wi-Fi拓扑变化。专家置信度经对数空间变换与5近邻距离分类器融合，生成正常性评分供策略决策点（PDP）进行风险感知访问控制。在正常轨迹、可控异常注入及良性Wi-Fi扰动实验中，该方法能有效检测语义、电池时序与拓扑偏离，且保持低于1%的误报率（FPR）。结果表明，安卓系统日志是实现持续认证与用户-设备上下文保障的实用无传感器信号。
原文摘要 · Abstract (English)
Continuous authentication for mobile and zero-trust systems requires nonintrusive evidence confirming the enrolled user-device context remains valid after initial login. This paper presents a BERT log analysis framework for continuous behavioral authentication using Android system logs. The proposed pipeline parses logcat streams into event templates and dynamic variables, pre-trains a domain-adapted BERT encoder on Android log syntax, and fine-tunes three expert models for network/device identity, battery-transition timing, and Wi-Fi topology. The expert confidence scores are fused through a log-space transformation and a 5-nearest-neighbor distance classifier to generate a normality score that is provided to a Policy Decision Point (PDP) for risk-aware access control. Experiments on normal traces, controlled anomaly injections, and benign Wi-Fi perturbations indicate that multi-expert BERT log analysis can detect semantic, battery-timing, and topology deviations in the evaluated setting while maintaining sub-1% False Positive Rate (FPR). The results suggest that Android system logs are a practical sensor-free signal for continuous authentication and user-device context assurance.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。