# From One Attack Domain to Another: Contrastive Transfer Learning with Siamese Networks for APT Detection

arXiv: https://arxiv.org/abs/2511.20500 · HTML: https://mlsanity.com/paper/2511.20500/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 13 of its 64 references that are in the map.
- First posted on arXiv 25 Nov 2025.

## Builds on (most cited first, 13 of 13)

- [Deep Anomaly Detection with Deviation Networks](https://mlsanity.com/paper/1911.08623/) (2019)
- [A Survey on Explainable Anomaly Detection](https://mlsanity.com/paper/2210.06959/) (2022)
- [MAGIC: Detecting Advanced Persistent Threats via Masked Graph Representation Learning](https://mlsanity.com/paper/2310.09831/) (2023)
- [A baseline for unsupervised advanced persistent threat detection in system-level provenance](https://mlsanity.com/paper/1906.06940/) (2019)
- [A Rule Mining-Based Advanced Persistent Threats Detection System](https://mlsanity.com/paper/2105.10053/) (2021)
- [Machine Learning-Enabled IoT Security: Open Issues and Challenges Under Advanced Persistent Threats](https://mlsanity.com/paper/2204.03433/) (2022)
- [A Survey of Few-Shot Learning for Biomedical Time Series](https://mlsanity.com/paper/2405.02485/) (2024)
- [Hack Me If You Can: Aggregating AutoEncoders for Countering Persistent Access Threats Within Highly Imbalanced Data](https://mlsanity.com/paper/2406.19220/) (2024)
- [Categorical anomaly detection in heterogeneous data using minimum description length clustering](https://mlsanity.com/paper/2006.07916/) (2020)
- [Combating Advanced Persistent Threats: Challenges and Solutions](https://mlsanity.com/paper/2309.09498/) (2023)
- [APT-LLM: Embedding-Based Anomaly Detection of Cyber Advanced Persistent Threats Using Large Language Models](https://mlsanity.com/paper/2502.09385/) (2025)
- [Adversarial Augmentation and Active Sampling for Robust Cyber Anomaly Detection](https://mlsanity.com/paper/2509.04999/) (2025)
- [Attackers Strike Back? Not Anymore -- An Ensemble of RL Defenders Awakens for APT Detection](https://mlsanity.com/paper/2508.19072/) (2025)

## Built on by (most cited first, 3 of 3)

- [RPG-AE: Neuro-Symbolic Graph Autoencoders with Rare Pattern Mining for Provenance-Based Anomaly Detection](https://mlsanity.com/paper/2602.02929/) (2026)
- [A Source Domain is All You Need: Source-Only Cross-OS Transfer Learning for APT Anomaly Detection via Semantic Alignment and Optimal Transport](https://mlsanity.com/paper/2606.10216/) (2026)
- [RareSense: Rarity-Aware Similarity Search for Anomaly Retrieval in Transactional Data](https://mlsanity.com/paper/2607.28879/) (2026)

## Abstract (arXiv)

Advanced Persistent Threats (APT) pose a major cybersecurity challenge due to their stealth, persistence, and adaptability. Traditional machine learning detectors struggle with class imbalance, high dimensional features, and scarce real world traces. They often lack transferability-performing well in the training domain but degrading in novel attack scenarios. We propose a hybrid transfer framework that integrates Transfer Learning, Explainable AI (XAI), contrastive learning, and Siamese networks to improve cross-domain generalization. An attention-based autoencoder supports knowledge transfer across domains, while Shapley Additive exPlanations (SHAP) select stable, informative features to reduce dimensionality and computational cost. A Siamese encoder trained with a contrastive objective aligns source and target representations, increasing anomaly separability and mitigating feature drift. We evaluate on real-world traces from the DARPA Transparent Computing (TC) program and augment with synthetic attack scenarios to test robustness. Across source to target transfers, the approach delivers improved detection scores with classical and deep baselines, demonstrating a scalable, explainable, and transferable solution for APT detection.