Physiological biometrics (fingerprint, face, iris) are susceptible to presentation attacks and, once compromised, cannot be revoked. In addition, they are inherently entry-point mechanisms that provide no guarantee of continued legitimate control after the initial check. Surveys by Abuhamad et al. [1] (140+ approaches, six modality groups) and Liang et al. [9] (IoT-wide AI perspective) establish that behavioral biometrics overcome these limitations by enabling transparent, nonintrusive continuous authentication (CA) and that 90% of users prefer such passive verification over explicit credential prompts. Focusing on device-native behavioral signals, Murmuria et al. [10] showed that Android power consumption, touch, gestures, and movement form a viable ensemble (Equal Error Rate (EER) 6.1%–6.9%, 59 users). Neal et al. [11] demonstrated that application traffic, Bluetooth sightings, and Wi-Fi associations are distinctive fingerprints stable over 19 months (up to 93% identification for Wi-Fi), while a companion study [12] using association rule mining reached 91% verification accuracy. Jakubeit et al. [7] were able to authenticate a device’s registered environment against 11 other locations, achieving precision $>$ 0.98 and recall $>$ 0.99 across all test sites, from passive Wi-Fi beacon frames alone, without storing any personally identifiable information.

Log-based anomaly detection begins with log parsing, which is the transformation of raw, semi-structured messages into structured event templates and dynamic variable fields. This step is not trivial at production scale: Drain [5], an online prefix-tree parser, remains the dominant choice due to its efficiency and competitive accuracy, yet a large-scale re-evaluation by Jiang et al. [8] shows that all 15 surveyed parsers degrade substantially on infrequent and parameter-intensive templates, thus motivating the domain-specific adaptations we apply to Android system logs. LogBERT [4] established the dominant paradigm for self-supervised log anomaly detection by combining masked log-key prediction with hypersphere minimization. Subsequent work extended this baseline in orthogonal directions: HilBERT [6] adds a hierarchical encoder to handle log instability, Loader [13] replaces the Recurrent Neural Network (RNN) backbone with a Transformer and a confidence-adaptive top-$p$ rule, and Yan et al. [15] exploit unlabeled production logs via masked-reconstruction pre-training. LogSer [2] is closest to our work: it introduces named semantic tokens and fuses template with parameter embeddings, recognizing that dynamic variable values carry independent anomaly signals. LogGD [14] captures co-occurrence structure via a Graph Transformer.

All log anomaly detectors above target server infrastructure, produce stateless binary verdicts per window and they cannot provide a continuous trust score bound to a specific physical user. CA systems, conversely, exploit Bluetooth, Wi-Fi, and power consumption as pre-aggregated statistics and never mine the raw OS-level log stream that natively encodes all three modalities: network identity, power consumption dynamics, and spatial topology. To the best of our knowledge, this paper is the first attempt to apply domain-decomposed BERT-based expert models to on-device Android logs for continuous behavioral authentication, fusing the aforementioned modalities into a PDP-ready trust score for zero-trust architectures.

Raw log lines are heterogeneous semi-structured text. We adapt Drain [5], an online prefix-tree parser, to Android 11.0 by injecting domain-specific regular expressions that atomically identify MAC addresses, IPv4/IPv6 identifiers, BLE state strings, and integer fields before the tree traversal begins. Each parsed line is decomposed into: (i) a stable event template with typed placeholder tokens (<mac>, <ipv4>, <ipv6>, <int>, <string>, <bool>), (ii) a hash-derived event ID, and (iii) an ordered list of dynamic variable values. Templates define the structural grammar the pre-trained BERT encoder learns in Section V, while dynamic values form the semantic vocabulary the expert models validate in Section VI.

The Identity Expert transitions the encoder from syntactic awareness, knowing where a variable type appears, to semantic validation: knowing which specific value is expected given the device’s behavioral history.

Input and Tokenization. The input uses [CLS] SEQ [SEP] MEM [SEP] TASK + TARGET TEMPLATE. SEQ contains only the last 50 Identity Event IDs, without dynamic variables, MEM stores the dynamic variables from the previous occurrence of the Event ID under evaluation, TASK is that Event ID, and TARGET TEMPLATE masks its dynamic-variable positions (e.g., Unicasting DHCPREQUEST ciaddr=[MASK] request=[MASK] serverid=[MASK] to [MASK]:[MASK]). Variables are omitted from SEQ because full parameterized windows often exceed BERT’s 512-token limit and would propagate injected or swapped values through the next 50 contexts, increasing false positives. All unique training-set dynamic values are added as atomic tokens (Custom Dynamic Vocabulary) to prevent WordPiece fragmentation of structured identifiers (e.g., 194.177.200.5 split into seven tokens). For each masked variable, the model also receives an embedding of its placeholder type (e.g., MAC, IPv4, integer), so that predictions are conditioned on both context and expected value class:

where $E_{type}$ encodes the variable category and limits candidate values to the matching semantic class. OOV values are mapped to [UNK]. As this token is not observed in normal user-specific training contexts, the model assigns it very low confidence during evaluation, producing a low $S_{Ident}$ for unseen identity values.

Training. The first two encoder layers are frozen to preserve the structural features acquired during pre-training. The remaining 10 layers and a classification head are trained with Cross-Entropy over the custom value vocabulary, while static tokens are excluded from the objective.

Confidence Score. The per-log confidence score $S_{Ident}\in[0,1]$ is the arithmetic mean of the predicted Softmax probabilities at each dynamic variable position:

where $N$ is the number of dynamic variable positions in the log, $v_{j}$ is the observed value, and $\mathbf{C}_{Ident}$ denotes the Identity Expert input context: the 50-event-ID SEQ, MEM, TASK, and masked target template.

The Battery Expert models the temporal and logical behavior of the device’s power subsystem using two complementary abstractions: battery-transition states and temporal classes. First, each pair of consecutive battery observations is assigned to one of three transition states according to the direction of the battery-level change: STABLE, when the battery percentage remains unchanged, DRAIN, when the level decreases by 1%, and CHARGE, when the level increases by 1%. Second, for physically valid transitions, the elapsed time between observations is quantized into one of five temporal classes derived from K-Means clustering on the normal training data (Table II): TS_INSTANT, TS_SHORT, TS_MID, TS_LONG, and TS_SUSTAINED. These classes capture the device’s normal power-consumption rhythm at different time scales, from short reporting intervals to sustained battery states. In addition, a separate rule-based class, TS_VIOLATION, captures physically inconsistent transitions, such as a discharging event while the device is reported as connected to AC power. The Battery Expert therefore learns not only how quickly battery transitions normally occur, but also whether the observed transition is logically consistent with the device’s charger state.

Level-Agnostic Input. To eliminate dependency on absolute battery level (the “Level Trap”), the gauge value is omitted from the input. Each snapshot is encoded as a two-segment BERT sequence: Segment A carries the operational mode (STABLE/DRAIN/CHARGE) and Segment B carries the telemetry context:

where c_c and p_c denote the current and previous charger states (USB/AC/None), and drain_ema and chg_ema are EMA-smoothed estimates ($\alpha=0.6$) of the battery percentage change per unit time during drain and charge phases, updated recursively as $R_{EMA}^{(t)}=\alpha\cdot R_{current}+(1-\alpha)\cdot R_{EMA}^{(t-1)}$. The final input representation is:

where $E_{segment}$ trains the attention heads to cross-reference the operational mode against telemetry, enabling detection of cross-segment contradictions such as a DRAIN state with an active AC connection, or a CHARGE state with no charger reported.

Training. The Battery Expert is trained as a Multi-Class Classifier over the 6 bins using Categorical Cross-Entropy with normalized soft labels. For valid temporal ground-truth bin $c^{*}$ and neighboring-bin set $\mathcal{N}(c^{*})$, the target distribution is:

Thus middle bins keep the usual $0.1/0.8/0.1$ target, while edge bins such as TS_INSTANT or TS_SUSTAINED receive $0.889$ for the ground truth and $0.111$ for their single neighbor. Synthetic TS_VIOLATION samples are injected as hard targets ($y^{\prime}=1.0$).

Confidence Score. The per-snapshot confidence score $S_{Batt}\in[0,1]$ combines the Softmax probability assigned to the observed valid temporal bin $c_{\mathrm{obs}}$ with the probability assigned to the logical-violation class $p_{viol}$:

A high value indicates that the observed inter-event interval and charger state are consistent with the model’s learned discharge rhythm, whereas a low value signals a timing or logical-consistency anomaly. $S_{Batt}$ is propagated to the Multi-Expert Fusion Classifier, where the nearest-neighbor distance test evaluates it jointly with the Identity and Wi-Fi Topology scores.

The Wi-Fi Topology Expert is trained as a dual-head autoencoder to reconstruct the device’s Wi-Fi topology from WifiPickerTracker scans. As with the Identity Expert, SSIDs are added as atomic tokens to a Custom SSID Vocabulary. Unknown SSIDs at inference time are mapped to [UNK], indicating a potential out-of-distribution environment. Each access point is represented as a fused identity–intensity embedding:

allowing the self-attention mechanism to learn inter-AP spatial correlations (e.g., “if AP-A is at level 4, AP-B is expected at level 2”).

Training. The dual-head objective separates the two components of the Wi-Fi topology: access-point identity and signal-strength intensity. The SSID head is trained with Cross-Entropy over the categorical SSID vocabulary, while the intensity head is trained with Mean Squared Error (MSE) over the ordinal RSSI level representation. The total reconstruction objective is defined as a weighted multi-task objective:

where $\lambda_{\mathrm{SSID}}$ and $\lambda_{\mathrm{Level}}$ are nonnegative weighting coefficients that control the relative contribution of the identity and intensity reconstruction terms. In our experiments, both are set to 1, yielding an equal-weight objective. Under this formulation, unfamiliar or incorrectly reconstructed SSIDs increase $L_{\mathrm{SSID}}$, while deviations in the expected signal-strength levels increase $L_{\mathrm{Level}}$, so the total objective captures both semantic and spatial deviations from the learned Wi-Fi topology.

Confidence Score. The per-scan confidence score $S_{WiFi}\in[0,1]$ combines the outputs of the SSID and intensity heads. For each visible access point $k$, the SSID head assigns a Softmax probability $p_{k}$ to the observed SSID, while the intensity head produces a reconstruction error $\ell_{k}$ for the corresponding RSSI level. The scan-level score is computed as:

where $M$ is the number of visible access points. Unknown SSIDs receive near-zero identity probability, substantially reducing the score in an unfamiliar environment. Absent access points are excluded from the sum, so partial but spatially consistent topologies retain high confidence.

At every inference step, the system maintains a persistent snapshot of the device’s behavioral state as a three-dimensional score vector:

where $S_{Ident}$, $S_{Batt}$, and $S_{WiFi}$ are the confidence scores emitted by the Identity, Battery, and Wi-Fi Topology experts, respectively. Raw confidence scores are poorly suited for direct distance comparison: normal behavior clusters near $S\approx 1.0$, so small deviations from normality produce imperceptibly small differences in Euclidean space. To address this, we apply a nonlinear log-space transformation:

where $\epsilon=10^{-15}$ prevents numerical collapse at $S=0$. This negative-log structure maps perfect confidence to zero and strongly expands low-confidence scores, mapping $[0,1]$ onto an unbounded range where anomalous scores are geometrically separated from the normal cluster.

Because the three experts operate under different objectives and output scales, their raw log-transformed scores exhibit different variances. To ensure that each dimension contributes equally to the distance metric, the transformed scores are standardized using the mean $\mu_{i}$ and standard deviation $\sigma_{i}$ computed exclusively from the normal training set:

This maps the normal training distribution onto a 3D Normal Region centered at the origin, where deviations along each axis reflect proportional anomalousness in the corresponding expert channel. The complete set of transformed normal-training vectors is stored as the reference structure for the distance classifier.

We adopt an unsupervised 5-nearest-neighbor distance classifier to define the boundary of normal behavior, trained exclusively on clean historical data. At inference time, the classifier identifies the set $\mathcal{N}_{5}(\mathbf{z})$ of the five nearest stored normal vectors and computes the mean Euclidean distance:

Distance Threshold. The distance threshold $\tau$ is computed during offline calibration as the 99.9th percentile of all mean 5-NN distances observed across normal-training snapshots. Thus, $\tau$ is the largest distance that still covers 99.9% of normal behavior. It is dimensionless, measured in Euclidean distance units of the standardized log-score (z-score) space. The remaining 0.1% is deliberately excluded because it corresponds to noisy training snapshots with unusually low confidence scores across one or more experts. Including these outliers would expand the boundary and reduce sensitivity to genuine anomalies. In our training set, $\tau=1.725$. A snapshot with $D\leq\tau$ is classified as normal, whereas a snapshot with $D>\tau$ is raised as an anomaly, regardless of whether any individual expert score crossed its per-channel threshold.

PDP Trust Score. The distance is mapped to a continuous PDP trust score as

This yields 100% at $D{=}0$, 50% at $D{=}\tau$, and exponentially decaying values for anomalies, enabling risk-proportional access control at the PDP.

The Identity Expert’s primary role is to validate the semantic integrity of dynamic variables within system logs. Unlike traditional anomaly detectors that treat variables as arbitrary strings, this expert evaluates whether a specific value (e.g., an IP address) is appropriate for its corresponding placeholder (e.g., <ipv4>) given the clean event-ID sequence and the previous dynamic-variable state of the Event ID under evaluation. OOV values and soft confidence deviations on known-vocabulary logs are assessed through the fusion stage.

The Battery Expert outputs a probability distribution over the six temporal classes; TS_VIOLATION probability is folded directly into $S_{\mathrm{Batt}}$ as a logical-consistency penalty rather than a separate hard rule, so stochastic inter-event interval variability is absorbed by the learned nearest-neighbor normal-region manifold.

The Wi-Fi Topology Expert is designed as a Dual-Head Reconstruction model. To evaluate its robustness against topological changes and Out-of-Distribution (OOD) environments, we conducted four stress-test scenarios (Table VII).

The analysis reveals three key insights: (1) the model is most sensitive to SSID mismatches as in Scenario 1, the confidence effectively vanished ($0.23\%$), indicating the model’s sensitivity in identifying unfamiliar physical environments, (2) the Self-Attention mechanism exploits topological redundancy, maintaining $97.30\%$ confidence even when 2 of 5 APs disappear, because the surviving APs maintain their expected spatial intensities and the model successfully reconstructs the known topology from partial context, and (3) a minor signal fluctuation ($\pm 1$) is treated as expected environmental noise ($82.26\%$), while a major signal level jump (Scenario 4) is correctly flagged as a significant spatial shift ($71.60\%$), capturing sudden movements toward or away from individual routers.

The final evaluation assesses the complete decision pipeline described in Section VII. During inference, each incoming log event updates the persistent score snapshot $\mathbf{x}=[S_{Ident},S_{Batt},S_{WiFi}]$. The snapshot is transformed to log space, standardized using the normal-training statistics, and compared against the stored normal region using the mean 5-nearest-neighbor distance $D$. The calibrated 99.9th-percentile threshold was $\tau=1.727$ and snapshots with $D>\tau$ are reported as anomalous and mapped to a PDP-facing normality score $P_{normality}$.

Table VIII summarizes the end-to-end behavior on normal operation and controlled perturbation datasets. These tests are designed to probe model sensitivity, not to represent complete real-world attack simulations. Each anomaly dataset is a mixed stream: injected events are labeled anomalous, while the remaining log entries retain normal labels. We report $\mathrm{FPR}=\mathrm{FP}/(\mathrm{FP}+\mathrm{TN})$ over normal-labeled samples and $\mathrm{FNR}=\mathrm{FN}/(\mathrm{FN}+\mathrm{TP})$ over anomalous samples. The normal dataset contains 2,041 log entries and produces 12 false positives, corresponding to an FPR of 0.59%. The identity, battery, and new-environment Wi-Fi perturbations yield zero missed injected events in this controlled setting. Their nonzero FPR values are computed over the normal entries in the same mixed streams. The benign Wi-Fi perturbation tests contain no anomaly labels and therefore report only FPR.

These results indicate the intended role of the fusion layer. Strong controlled perturbations, such as OOV identity values, unseen battery-drain timing, or complete Wi-Fi topology changes, moved the snapshot outside the normal manifold in these datasets. At the same time, benign Wi-Fi changes do not trigger direct topology alerts, because the remaining known SSIDs and nearby RSSI levels preserve sufficient evidence of the learned environment. The residual false positives are dominated by the same borderline events observed in the clean normal trace, suggesting that errors arise from the global nearest-neighbor decision boundary rather than from the anomaly-injection procedure itself.