Detecting deceptive behavior has become a critical challenge as malicious behaviors grow more sophisticated. Cunning attackers (e.g., telecommunication fraudsters and insider spy employees) confuse their deceptive behaviors with benign behaviors, which has rendered traditional detection methods increasingly indistinguishable. By adopting a mindset that maps behavior onto a high-dimensional attribute space, valuable clues can be derived to aid in detecting deceptive behavior by transforming nearly inseparable behavioral data into separable patterns within a behavioral attribute space. Within the current landscape, the work of effectively learning behavioral attributes remains largely unknown. This work proposes a novel method called motif-based behavior reconstruction (MORE). It reconstructs behavior as the frequent connectivity pattern on the granularity of attributes instead of representing behaviors, where we design a transformation network for learning a vector field to get expressive attribute representations. We assess our work across four representative security scenarios: detecting fraudulent transactions in online payment services, identifying malicious domains in domain name systems, detecting insider threats within organizational information systems, and identifying suspicious traffic within anonymous network communications. These experiments are conducted using private and public datasets, as well as real and simulated data that encompass various deceptive behaviors relevant to different security domains.