Log2Sig: Insider Threat & Log-Signature Fusion

• Log2Sig is a dual-faceted approach that integrates a frequency-aware insider threat detection framework with log-signature methods to represent sequential data.
• Its cybersecurity component transforms user logs into multiscale behavioral frequency signals using MVMD and Mamba-based temporal encoding for enhanced anomaly detection.
• The log-signature aspect leverages tensor algebra to compress sequential structures, capturing higher-order dependencies through recursive computation.

Log2Sig denotes, in the most recent cybersecurity usage, a frequency-aware anomaly detection framework for insider threat detection that transforms user logs into multivariate behavioral frequency signals and jointly models symbolic behavior sequences and frequency-decomposed signals. In adjacent rough-path, stochastic-analysis, and sequential-learning literatures, closely related usage refers to the log-transform of expected signatures—also called signature cumulants or log-signatures—which provides a compact, non-commutative representation of paths and streamed data. The shared label therefore spans both a specific insider-threat detection architecture and a broader mathematical feature construction centered on logarithms of signatures (Kong et al., 6 Aug 2025, Friz et al., 2021, Friz et al., 2024).

1. Terminological scope and disambiguation

In the insider-threat literature, Log2Sig is the name of the framework introduced in "Log2Sig: Frequency-Aware Insider Threat Detection via Multivariate Behavioral Signal Decomposition" (Kong et al., 6 Aug 2025). There, the term refers to a pipeline that maps raw user logs into two parallel representations—behavior sequences and behavior frequency signals—then combines multiscale decomposition, sequence modeling, and classification for anomaly detection.

In the stochastic-analysis literature, the same label is associated with the signature cumulant, defined as the logarithm of the expected signature in tensor algebra. One formulation is

$\mathcal{L}(T) = \log \mathcal{S}(T),$

where $$\mathcal{S}(T)=\mathbb{E}(\operatorname{Sig}(X)_{0,T})$$ is the expected signature; an equivalent notation is

$\kappa_{0,T} := \log \mu_{0,T},$

with $$\mu_{0,T} := \mathbb{E}\left[ \mathrm{Sig}(X)_{0,T} \right]$$ (Friz et al., 2021, Friz et al., 2024). In machine-learning usage, log-signatures are then employed as feature maps for sequential data, including streamed multimodal data and time series (Liao et al., 2019, Barancikova et al., 2024).

This terminological overlap should be distinguished from other unrelated notions involving “signature” or “log,” including system signatures in reliability theory (Marichal, 2013), the logarithmic gauged linear sigma model (Chen et al., 2019), continued logarithm representation (Neunhäuserer, 2018), and twofold variants of log() and exp() in floating-point arithmetic (Latkin, 2015). This suggests a terminological bifurcation rather than a single unified concept.

2. Log2Sig as a frequency-aware insider threat detection framework

The 2025 Log2Sig framework addresses insider threat detection by arguing that existing approaches typically model system logs as flat event sequences and therefore fail to capture the inherent frequency dynamics and multiscale disturbance patterns embedded in user behavior (Kong et al., 6 Aug 2025). Its central proposal is to transform user activity logs into multivariate behavioral frequency signals, then jointly model symbolic and frequency-domain views.

The architecture is organized into four main components: behavior representation construction, behavior signal decomposition, dual-view encoding, and anomaly detection. Raw, heterogeneous user logs are mapped into a behavior sequence and a behavior frequency signal. For each day $t$, the sequence is written as

$s_t = [b_1^{(t)}, b_2^{(t)}, ..., b_L^{(t)}],$

where each $b_i^{(t)}$ is a discretized token representing a high-level behavior. The corresponding daily frequency vector is

$$\mathbf{f}(t) = [f_1(t), f_2(t), ..., f_C(t)]^\top \in \mathbb{R}^{C \times 1},$$

where $f_c(t)$ is the count of behavior type $c$ for day $$\mathcal{S}(T)=\mathbb{E}(\operatorname{Sig}(X)_{0,T})$$0. Concatenating across $$\mathcal{S}(T)=\mathbb{E}(\operatorname{Sig}(X)_{0,T})$$1 days yields a $$\mathcal{S}(T)=\mathbb{E}(\operatorname{Sig}(X)_{0,T})$$2 multivariate time series $$\mathcal{S}(T)=\mathbb{E}(\operatorname{Sig}(X)_{0,T})$$3 (Kong et al., 6 Aug 2025).

The framework is explicitly designed around a dual-view representation. The sequence view retains temporal order and symbolic semantics, while the frequency view aggregates per behavior type per time window, for example per day. The paper describes this as frequency-aware log modeling and states that it is the first to treat user logs as multivariate frequency signals, thereby exposing frequency-domain anomaly cues that flat models may miss (Kong et al., 6 Aug 2025).

3. Multiscale decomposition, dual-view fusion, and anomaly scoring

The frequency branch is built around Multivariate Variational Mode Decomposition (MVMD). MVMD generalizes univariate VMD to multiple behavioral channels and decomposes the multichannel frequency vector into $$\mathcal{S}(T)=\mathbb{E}(\operatorname{Sig}(X)_{0,T})$$4 narrowband Intrinsic Mode Functions (IMFs) aligned across behavior types. If $$\mathcal{S}(T)=\mathbb{E}(\operatorname{Sig}(X)_{0,T})$$5, MVMD seeks a decomposition

$$\mathcal{S}(T)=\mathbb{E}(\operatorname{Sig}(X)_{0,T})$$6

with outputs arranged as $$\mathcal{S}(T)=\mathbb{E}(\operatorname{Sig}(X)_{0,T})$$7; at time $$\mathcal{S}(T)=\mathbb{E}(\operatorname{Sig}(X)_{0,T})$$8, the $$\mathcal{S}(T)=\mathbb{E}(\operatorname{Sig}(X)_{0,T})$$9-th multichannel IMF is

$\kappa_{0,T} := \log \mu_{0,T},$0

The daily frequency input is then formed by residual signal fusion,

$\kappa_{0,T} := \log \mu_{0,T},$1

and over all timesteps

$\kappa_{0,T} := \log \mu_{0,T},$2

These IMFs are intended to reveal behavioral fluctuations across multiple temporal scales (Kong et al., 6 Aug 2025).

The sequence branch uses a Mamba-based temporal encoder. Mamba is described as a state space model designed for efficient, linear-time sequence modeling, and it is used to capture long-range dependencies in user event sequences. For day $\kappa_{0,T} := \log \mu_{0,T},$3, the embedded sequence $\kappa_{0,T} := \log \mu_{0,T},$4 is encoded into $\kappa_{0,T} := \log \mu_{0,T},$5, while the frequency vector $\kappa_{0,T} := \log \mu_{0,T},$6 is linearly projected to

$\kappa_{0,T} := \log \mu_{0,T},$7

The two branches are fused by concatenation along the token dimension,

$\kappa_{0,T} := \log \mu_{0,T},$8

then flattened for classification:

$\kappa_{0,T} := \log \mu_{0,T},$9

The final anomaly score is

$$\mu_{0,T} := \mathbb{E}\left[ \mathrm{Sig}(X)_{0,T} \right]$$0

trained with binary cross entropy (Kong et al., 6 Aug 2025).

The paper characterizes this combination as integrating symbolic sequential semantics and frequency-aware features. A plausible implication is that the model is intended to detect both fine-grained event-pattern irregularities and slower, distributed deviations that emerge only after temporal aggregation.

4. Benchmarks, ablations, and efficiency claims

Evaluation is reported on the CERT r4.2 and CERT r5.2 insider-threat benchmarks. The paper states that CERT r4.2 contains 1,000 users; 7,323 anomalous events; anomaly ratio: 0.022%, while CERT r5.2 contains 2,000 users; 10,328 anomalous events; anomaly ratio: 0.013% (Kong et al., 6 Aug 2025).

The reported F1-scores are as follows:

Model	r4.2 F1	r5.2 F1
IForest	0.846	0.843
XGBoost	0.871	0.899
OCSVM	0.639	0.677
ITDBERT	0.898	0.901
CATE	0.911	0.926
LogGPT	0.899	0.907
ITDLM	0.879	0.884
Log2Sig	0.956	0.946

On these figures, Log2Sig is reported to significantly outperform state-of-the-art baselines in both accuracy and F1 score (Kong et al., 6 Aug 2025). The ablation results further state that removing MVMD or Mamba lowers F1 to 0.929 and 0.890, respectively, indicating that both the multiscale decomposition and the temporal encoder materially contribute to performance.

The parameter-sensitivity study identifies optimal MVMD mode number $$\mu_{0,T} := \mathbb{E}\left[ \mathrm{Sig}(X)_{0,T} \right]$$1, best bandwidth parameter $$\mu_{0,T} := \mathbb{E}\left[ \mathrm{Sig}(X)_{0,T} \right]$$2, Mamba encoder depth: 2 layers, and MLP classifier: 3 layers. Efficiency claims are also explicit: MVMD yields higher accuracy and F1 than MEMD with much lower compute time, and the Mamba encoder is more accurate and far more efficient than LSTM or Transformer (Kong et al., 6 Aug 2025).

The paper’s stated advantages over prior work include higher detection accuracy and F1, improved generalization to subtle and multi-scale anomalies, resource efficiency and real-time applicability, and modularity. These claims are framed around low-frequency, distributed, and sophisticated insider attacks often missed by flat models (Kong et al., 6 Aug 2025).

5. Log2Sig as signature cumulant and log-signature

Outside cybersecurity, Log2Sig refers to the logarithm of the expected signature or, more broadly, to log-signature representations. In semimartingale settings, the expected signature is treated as a path-space analogue of the classical moment generating function, and the signature cumulant is its tensor-algebra logarithm (Friz et al., 2021). This establishes a non-commutative analogue of classical cumulants.

A central result in this literature is a universal functional equation for signature cumulants in a general semimartingale context. The formulation involves the adjoint operator $$\mu_{0,T} := \mathbb{E}\left[ \mathrm{Sig}(X)_{0,T} \right]$$3, the Magnus kernel

$$\mu_{0,T} := \mathbb{E}\left[ \mathrm{Sig}(X)_{0,T} \right]$$4

its inverse

$$\mu_{0,T} := \mathbb{E}\left[ \mathrm{Sig}(X)_{0,T} \right]$$5

and an additional universal kernel $$\mu_{0,T} := \mathbb{E}\left[ \mathrm{Sig}(X)_{0,T} \right]$$6 (Friz et al., 2021, Friz et al., 2024). In deterministic finite-variation continuous settings, the recursion reduces to a classical Magnus expansion; in the commutative or projected setting, it becomes reminiscent of classical cumulant-moment relations and generalized Riccati equations (Friz et al., 2021).

The computational consequence emphasized in both papers is level-wise recursion: to compute the $$\mu_{0,T} := \mathbb{E}\left[ \mathrm{Sig}(X)_{0,T} \right]$$7th level of the signature or log-signature, one only needs lower levels. The 2024 paper states that the log-transform of expected signatures offers a significant reduction in complexity and revisits computation in a general semimartingale setting with several new formulae (Friz et al., 2024). It also states that, under natural conditions, the expectation of the signature determines the law of the signature, making expected signatures and their logarithms useful statistical summaries of sequential data.

The 2025 paper "Cartan's Path Development, the Logarithmic Signature and a Conjecture of Lyons-Sidorova" adds a different perspective: signature coefficients decay factorially fast, whereas coefficients of the logarithmic signature generically only possess geometric decay (Boedihardjo et al., 22 Jun 2025). It proves that if the logarithmic signature has infinite radius of convergence, then the signature coefficients satisfy an infinite system of rigid algebraic identities defined in terms of iterated integrals along complex exponential one-forms, and it establishes a strengthened version of the conjecture asserting that if the logarithmic signature of a bounded-variation path has infinite radius of convergence over all sub-intervals of time, the underlying path must be a straight line (Boedihardjo et al., 22 Jun 2025).

These results place Log2Sig, in the mathematical sense, at the intersection of rough paths, free Lie algebras, Magnus expansions, affine processes, and recursive computation of non-commutative cumulants.

6. Computation, representation, and machine-learning applications of log-signatures

For path representations, the signature of a path is the sequence of iterated integrals, and the log signature is the tensor logarithm projected into the free Lie algebra. For a continuous path $$\mu_{0,T} := \mathbb{E}\left[ \mathrm{Sig}(X)_{0,T} \right]$$8, the signature component associated with a word is an iterated integral, Chen’s identity gives concatenation, and for a straight line segment the signature is explicit:

$$\mu_{0,T} := \mathbb{E}\left[ \mathrm{Sig}(X)_{0,T} \right]$$9

The log signature of concatenated segments is then computed with the Baker–Campbell–Hausdorff (BCH) formula (Reizenstein, 2017). The practical significance is compression: the log signature encodes the same information as the signature but with fewer components.

The iisignature library systematizes this computation. It implements a direct BCH-based method for low-to-moderate depth and a signature-to-log-signature projection method for higher levels, with the latter exploiting sparse algebraic structure and favorable properties of the Lyndon basis (Reizenstein et al., 2018). The paper presents these as efficient algorithms for repeated feature extraction in Python-based workflows.

In machine learning, log-signature features are used as compressed summaries of sequential data. "Learning stochastic differential equations using RNN with log signature features" introduces Logsig-RNN, in which high-frequency sequences are partitioned, local truncated log-signatures are computed, and an RNN processes the resulting shorter sequence of log-signature vectors. The paper states that this hybrid approach is easy to code, quicker to train, and of lower complexity for a given accuracy, while showing robustness to missing data, variable-length series, and high-frequency data (Liao et al., 2019).

"SigDiffusions: Score-Based Diffusion Models for Time Series via Log-Signature Embeddings" moves log-signatures into generative modeling. It introduces a diffusion model operating on log-signature embeddings, with forward and backward processes that perturb and denoise log-signatures while preserving their algebraic structure, and provides closed-form inversion formulae for recovering signal coefficients in Fourier or orthogonal polynomial bases as explicit polynomial functions of the log-signature (Barancikova et al., 2024). This suggests that the log-signature variant of Log2Sig functions not only as a descriptive statistic but also as a latent representation for synthesis and inference over long multivariate time series.

Taken together, these strands show that “Log2Sig” names two technically distinct constructs. One is a cybersecurity architecture that fuses Mamba-based sequence modeling with MVMD-derived multiscale behavioral signals for insider threat detection (Kong et al., 6 Aug 2025). The other is a mathematically grounded log-signature formalism used for recursive computation, dimensionality reduction, and representation learning on paths and sequential data (Friz et al., 2021, Friz et al., 2024, Reizenstein, 2017, Reizenstein et al., 2018). The shared emphasis is compression of sequential structure without discarding higher-order dependencies.