From One Attack Domain to Another: Contrastive Transfer Learning with Siamese Networks for APT Detection

2025-11-01

Knowledge-Based Systems

AI Summary

APT detection faces challenges including high stealthiness, scarce labeled data, and poor cross-scenario generalization; conventional methods suffer from class imbalance, high-dimensional features, and domain shift. This paper proposes a contrastive transfer learning framework based on a Siamese network, integrating behavioral sequence modeling, contrastive learning, and domain adaptation to enable knowledge transfer across heterogeneous APT attack domains. Its key contributions are: (i) an end-to-end Siamese architecture jointly optimizing feature discriminability and domain invariance; (ii) contrastive loss to enhance fine-grained behavioral pattern discrimination; and (iii) efficient cross-domain detection with only a few target-domain labels. Evaluated on multiple real-world APT datasets under few-shot settings, the method achieves an average 12.6% improvement in cross-domain detection accuracy over state-of-the-art baselines, demonstrating superior generalizability and practicality.

Technology Category

• Machine Learning: Transfer, Domain Adaptation, Multi-Task Learning
• Application Domains: Security
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Vertical and domain-specific search
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Problem

• Detecting Advanced Persistent Threats with limited real-world attack traces
• Addressing class imbalance and high dimensionality in cybersecurity data
• Improving model transferability across different attack domains and scenarios

Innovation

• Siamese networks enable cross-domain contrastive transfer learning
• Attention-based autoencoder facilitates knowledge transfer across domains
• SHAP feature selection reduces dimensionality and computational costs