用对比学习提升网络攻击检测跨域能力，解决真实场景适应难题。
From One Attack Domain to Another: Contrastive Transfer Learning with Siamese Networks for APT Detection
- 构建孪生网络+对比学习框架，对齐源域与目标域特征表示。
- 在DARPA TC数据集上实现比基线更高的跨域检测准确率。
- 结合可解释性分析，适合需要透明决策的安全系统部署。
高级持续性威胁（APT）因其隐蔽性、持久性和适应性构成重大网络安全挑战。传统机器学习检测器面临类别不平衡、高维特征和真实攻击样本稀缺等问题，且泛化能力差——在训练域表现良好，但在新攻击场景中性能下降。本文提出一种融合迁移学习、可解释AI（XAI）、对比学习与孪生网络的混合迁移框架，以提升跨域泛化能力。基于注意力的自编码器支持跨域知识迁移，而基于Shapley值的特征重要性分析（SHAP）筛选出稳定且信息量高的特征，降低维度与计算开销。通过对比学习目标训练孪生编码器，对齐源域与目标域的表示，增强异常样本的可分性并缓解特征漂移。在来自DARPA透明计算（TC）项目的实际攻击日志上进行评估，并引入合成攻击场景测试鲁棒性。实验表明，在源域到目标域的迁移任务中，该方法显著优于经典与深度学习基线模型，验证了其可扩展性、可解释性与迁移能力，为APT检测提供了一种高效可靠的解决方案。
原文摘要 · Abstract (English)
Advanced Persistent Threats (APT) pose a major cybersecurity challenge due to their stealth, persistence, and adaptability. Traditional machine learning detectors struggle with class imbalance, high dimensional features, and scarce real world traces. They often lack transferability-performing well in the training domain but degrading in novel attack scenarios. We propose a hybrid transfer framework that integrates Transfer Learning, Explainable AI (XAI), contrastive learning, and Siamese networks to improve cross-domain generalization. An attention-based autoencoder supports knowledge transfer across domains, while Shapley Additive exPlanations (SHAP) select stable, informative features to reduce dimensionality and computational cost. A Siamese encoder trained with a contrastive objective aligns source and target representations, increasing anomaly separability and mitigating feature drift. We evaluate on real-world traces from the DARPA Transparent Computing (TC) program and augment with synthetic attack scenarios to test robustness. Across source to target transfers, the approach delivers improved detection scores with classical and deep baselines, demonstrating a scalable, explainable, and transferable solution for APT detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。