In this paper, we investigate cheating behaviors in computer-based examinations and propose an effective detection approach based on candidate behavioral analysis. The dataset was collected through simulated exam sessions and subsequently annotated frame by frame to support model training. To extract relevant features of the head, eyes, and mouth, we employed the Face Mesh framework from Mediapipe. We further introduce AnoResLSTM, a hybrid model combining a ResNet module with an AttLSTM network, designed to enhance the representation and analysis of sequential behavioral patterns. Experimental results demonstrate that our proposed method achieves high accuracy in detecting cheating while maintaining efficient processing time.