SENTRY: An Adversarial Robust Anomaly Detection Approach in System Log based on Pattern Unit Extraction and Time-Step Masking

SENTRY: An Adversarial Robust Anomaly Detection Approach in System Log based on Pattern Unit Extraction and Time-Step Masking | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article SENTRY: An Adversarial Robust Anomaly Detection Approach in System Log based on Pattern Unit Extraction and Time-Step Masking Bo Geng, Jinfu Chen, Saihua Cai, Jiahui Lu, Yisong Liu This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7747871/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 10 You are reading this latest preprint version Abstract Anomaly detection in system log plays a critical role in identifying abnormal behaviors and ensuring the security of software systems. Although dynamic analysis and deep learning-based models have demonstrated strong detection capabilities, they remain vulnerable to adversarial perturbations. To address these challenges, this paper proposes an adversarial robust anomaly detection approach, SENTRY, which integrates Shapelet-based pattern unit extraction, dynamic time-step masking, and knowledge distillation with difficult sample learning. We enhance the Shapelet algorithm with a customized distance metric to extract semantically meaningful pattern units, enabling effective reconstruction of log sequences while eliminating adversarial noise. These refined sequences are subsequently fed into an LSTM-based model equipped with a confidence-guided masking mechanism that reweights each time step according to its estimated likelihood of being part of normal system behavior, thereby emphasizing potential anomalies. Finally, the framework incorporates a teacher-student learning paradigm, in which the student model is guided by the teacher’s misclassified examples through a difficulty-aware strategy, enhancing its robustness against a wide range of adversarial attacks. Extensive experiments on real-world log datasets demonstrate that the proposed method significantly outperforms baseline models in both standard anomaly detection and adversarial scenarios, while transferability tests across different backbone models further validate its generalizability. Adversarial defense Anomaly detection System log Knowledge distillation Long short-term memory Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Editorial decision: Revision requested 12 Jan, 2026 Reviews received at journal 02 Jan, 2026 Reviewers agreed at journal 24 Oct, 2025 Reviews received at journal 08 Oct, 2025 Reviewers agreed at journal 08 Oct, 2025 Reviewers agreed at journal 08 Oct, 2025 Reviewers invited by journal 08 Oct, 2025 Editor assigned by journal 07 Oct, 2025 Submission checks completed at journal 04 Oct, 2025 First submitted to journal 30 Sep, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7747871","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":531568690,"identity":"908ed8f6-16f2-4285-a41e-5ff4399e57e5","order_by":0,"name":"Bo Geng","email":"","orcid":"","institution":"Jiangsu university","correspondingAuthor":false,"prefix":"","firstName":"Bo","middleName":"","lastName":"Geng","suffix":""},{"id":531568691,"identity":"02e7e55c-2c09-409e-8f21-cb841199d7e3","order_by":1,"name":"Jinfu Chen","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA40lEQVRIiWNgGAWjYBACxmYGhg8MDAcYGNgbGAxAAg1EaGGcAdbCc4BILSBFEC0SCRAeQS3M7bwHm3lq7siZS74xKPzBYCO74QDzswf4HcaX2Mxz7Jmx5ewcA2MehjTjDQfYzA3wa+Exf8zbcDhxw22gFgYGIOMAD5sEAS2GzUAt9RtunjEw/MHwn3gtCQY3eAwMeBgOEKelcc6xw4YbzqQVGPMYJBvPPMxmhleLYf8Zw4Y3NYflDY4f3mb4o8JOtu948zP8WhoQbDYDcGQy41MPBPJIbOYHBBSPglEwCkbBCAUAGCZKRCE7wH4AAAAASUVORK5CYII=","orcid":"","institution":"Jiangsu university","correspondingAuthor":true,"prefix":"","firstName":"Jinfu","middleName":"","lastName":"Chen","suffix":""},{"id":531568692,"identity":"3e09136e-8adb-4016-9d28-0425a09d0783","order_by":2,"name":"Saihua Cai","email":"","orcid":"","institution":"Jiangsu university","correspondingAuthor":false,"prefix":"","firstName":"Saihua","middleName":"","lastName":"Cai","suffix":""},{"id":531568693,"identity":"e78b9364-7bbf-4ce0-a292-3f999f91fe19","order_by":3,"name":"Jiahui Lu","email":"","orcid":"","institution":"Jiangsu university","correspondingAuthor":false,"prefix":"","firstName":"Jiahui","middleName":"","lastName":"Lu","suffix":""},{"id":531568694,"identity":"94c05101-5be2-4992-ba7a-90b08774b31a","order_by":4,"name":"Yisong Liu","email":"","orcid":"","institution":"Jiangsu university","correspondingAuthor":false,"prefix":"","firstName":"Yisong","middleName":"","lastName":"Liu","suffix":""}],"badges":[],"createdAt":"2025-09-30 06:38:16","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7747871/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7747871/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":94017936,"identity":"133a2d18-94ed-48ed-a7b7-e749473c4ab4","added_by":"auto","created_at":"2025-10-21 11:42:06","extension":"json","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":6803,"visible":true,"origin":"","legend":"","description":"","filename":"3b1174348b1c44aead1af4b65432fc93.json","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/b4803322bd0efc351c79a1a6.json"},{"id":94017939,"identity":"d2912d7e-bd2d-4b70-9833-b1fbc3d8e7ab","added_by":"auto","created_at":"2025-10-21 11:42:06","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":2037142,"visible":true,"origin":"","legend":"","description":"","filename":"SENTRYAnAdversarialRobustAnomalyDetectionApproachinSystemLogbasedonPatternUnitExtractionandTimeStepMasking2.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/2850f4f7a4d8c05b4add96f0.pdf"},{"id":94017937,"identity":"a8f55677-dcaf-47f5-ac2a-f384e64e40ea","added_by":"auto","created_at":"2025-10-21 11:42:06","extension":"png","order_by":2,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":224859,"visible":true,"origin":"","legend":"","description":"","filename":"distillationtemperatureeffectadfa.png","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/519dbabac54bb911163328df.png"},{"id":94018328,"identity":"d4cd73c0-cd91-4070-a429-1ec0019a8150","added_by":"auto","created_at":"2025-10-21 11:50:06","extension":"png","order_by":3,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":197945,"visible":true,"origin":"","legend":"","description":"","filename":"distillationtemperatureeffecthdfs.png","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/45b795377608d2198ce45a9c.png"},{"id":94018330,"identity":"8c59607c-c4dd-46d1-bc31-4de21b79c6ab","added_by":"auto","created_at":"2025-10-21 11:50:07","extension":"pdf","order_by":4,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":1254377,"visible":true,"origin":"","legend":"","description":"","filename":"fig1.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/fed52fe676d14ee4837a1b9b.pdf"},{"id":94017942,"identity":"503a6a65-880b-4b52-a9f7-097b15dcc905","added_by":"auto","created_at":"2025-10-21 11:42:07","extension":"png","order_by":5,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":285372,"visible":true,"origin":"","legend":"","description":"","filename":"fig2.png","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/c84ef3bf1fc69c52fa478fc6.png"},{"id":94018329,"identity":"cba67133-30cf-4e99-9f7b-e50168f8decc","added_by":"auto","created_at":"2025-10-21 11:50:07","extension":"png","order_by":6,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":115756,"visible":true,"origin":"","legend":"","description":"","filename":"fig3.png","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/a6adc8dc8e9d4756a1a4c401.png"},{"id":94017945,"identity":"ae9bd224-b9e1-43d6-a87a-aa740cfcf6ce","added_by":"auto","created_at":"2025-10-21 11:42:07","extension":"png","order_by":7,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":288936,"visible":true,"origin":"","legend":"","description":"","filename":"fig4.png","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/6c720c64d1e503831f4a936a.png"},{"id":94017941,"identity":"84530163-f67e-428c-9cce-bf8502b403d9","added_by":"auto","created_at":"2025-10-21 11:42:06","extension":"bst","order_by":8,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":35515,"visible":true,"origin":"","legend":"","description":"","filename":"snbasic.bst","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/2eb90d2448cc9ea0d556a6e6.bst"},{"id":94017944,"identity":"975866e2-7502-42c3-aaf0-cd28b637c335","added_by":"auto","created_at":"2025-10-21 11:42:07","extension":"cls","order_by":9,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":55857,"visible":true,"origin":"","legend":"","description":"","filename":"snjnl.cls","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/fd059e8fd0ad0cbf131b8902.cls"},{"id":94017943,"identity":"f5d1ea88-7502-45ae-8df4-4bac5c5be6c1","added_by":"auto","created_at":"2025-10-21 11:42:07","extension":"png","order_by":10,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":211999,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinedistillationtemperatureeffectadfa.png","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/e5412dae6e26cca807e6008b.png"},{"id":94019241,"identity":"19d51a72-ade0-4881-a023-14c5842aab4c","added_by":"auto","created_at":"2025-10-21 11:58:07","extension":"png","order_by":11,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":184914,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinedistillationtemperatureeffecthdfs.png","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/1d65ce847fe7e51f6ce8c81a.png"},{"id":94017948,"identity":"b8f2bd42-f50c-48b7-ab88-93974333d99f","added_by":"auto","created_at":"2025-10-21 11:42:07","extension":"png","order_by":12,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":212879,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefig2.png","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/f37260b0e4dd18dc1b3b3b9f.png"},{"id":94018331,"identity":"4201db0a-f452-498c-a9b2-7f778da097e7","added_by":"auto","created_at":"2025-10-21 11:50:07","extension":"png","order_by":13,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":76399,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefig3.png","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/44f7004250f51dc628449501.png"},{"id":94018332,"identity":"cc434072-d72d-44f4-b283-890267da63d9","added_by":"auto","created_at":"2025-10-21 11:50:07","extension":"png","order_by":14,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":213922,"visible":true,"origin":"","legend":"","description":"","filename":"Onlinefig4.png","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/11112d34db02e171cc80b3dc.png"},{"id":94017950,"identity":"656f25d3-ade4-4c77-aa92-55dad2ec3a4f","added_by":"auto","created_at":"2025-10-21 11:42:07","extension":"xml","order_by":15,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":135126,"visible":true,"origin":"","legend":"","description":"","filename":"3b1174348b1c44aead1af4b65432fc931structuring.xml","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1/fc51e5a52d2e0223563e558e.xml"},{"id":94019564,"identity":"fb1ab3bb-bdd8-482c-96d1-0db70360740f","added_by":"auto","created_at":"2025-10-21 12:06:09","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1404109,"visible":true,"origin":"","legend":"","description":"","filename":"SENTRYAnAdversarialRobustAnomalyDetectionApproachinSystemLogbasedonPatternUnitExtractionandTimeStepMasking2.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7747871/v1_covered_a5e1572f-7509-4e55-9228-4e2895be8936.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"SENTRY: An Adversarial Robust Anomaly Detection Approach in System Log based on Pattern Unit Extraction and Time-Step Masking","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"automated-software-engineering","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"ause","sideBox":"Learn more about [Automated Software Engineering](http://link.springer.com/journal/10515)","snPcode":"10515","submissionUrl":"https://submission.nature.com/new-submission/10515/3","title":"Automated Software Engineering","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"Adversarial defense, Anomaly detection, System log, Knowledge distillation, Long short-term memory","lastPublishedDoi":"10.21203/rs.3.rs-7747871/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7747871/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Anomaly detection in system log plays a critical role in identifying abnormal behaviors and ensuring the security of software systems. Although dynamic analysis and deep learning-based models have demonstrated strong detection capabilities, they remain vulnerable to adversarial perturbations. To address these challenges, this paper proposes an adversarial robust anomaly detection approach, SENTRY, which integrates Shapelet-based pattern unit extraction, dynamic time-step masking, and knowledge distillation with difficult sample learning. We enhance the Shapelet algorithm with a customized distance metric to extract semantically meaningful pattern units, enabling effective reconstruction of log sequences while eliminating adversarial noise. These refined sequences are subsequently fed into an LSTM-based model equipped with a confidence-guided masking mechanism that reweights each time step according to its estimated likelihood of being part of normal system behavior, thereby emphasizing potential anomalies. Finally, the framework incorporates a teacher-student learning paradigm, in which the student model is guided by the teacher’s misclassified examples through a difficulty-aware strategy, enhancing its robustness against a wide range of adversarial attacks. Extensive experiments on real-world log datasets demonstrate that the proposed method significantly outperforms baseline models in both standard anomaly detection and adversarial scenarios, while transferability tests across different backbone models further validate its generalizability.","manuscriptTitle":"SENTRY: An Adversarial Robust Anomaly Detection Approach in System Log based on Pattern Unit Extraction and Time-Step Masking","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-10-21 11:42:02","doi":"10.21203/rs.3.rs-7747871/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2026-01-12T08:29:18+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-01-02T12:11:20+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"28549587591259951666222541854890832743","date":"2025-10-24T11:08:27+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-10-08T21:13:12+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"124346280389169221743247908211139254481","date":"2025-10-08T20:09:14+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"246492616647767778528012722383808221986","date":"2025-10-08T11:37:10+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-10-08T09:40:45+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-10-07T17:15:56+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-10-04T05:30:11+00:00","index":"","fulltext":""},{"type":"submitted","content":"Automated Software Engineering","date":"2025-09-30T06:24:05+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"automated-software-engineering","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"ause","sideBox":"Learn more about [Automated Software Engineering](http://link.springer.com/journal/10515)","snPcode":"10515","submissionUrl":"https://submission.nature.com/new-submission/10515/3","title":"Automated Software Engineering","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"097edd1f-1d23-405c-bc01-de75000f3a77","owner":[],"postedDate":"October 21st, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[],"tags":[],"updatedAt":"2026-05-18T10:09:08+00:00","versionOfRecord":[],"versionCreatedAt":"2025-10-21 11:42:02","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-7747871","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7747871","identity":"rs-7747871","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}