Cross-Domain Cybersecurity Threat Detection via Self-Supervised Feature Disentanglement: A Modular AI Framework for Zero-Shot Generalization

We propose a novel Cross-Domain Cybersecurity Threat Detection framework that addresses the critical challenge of generalizing threat detection across heterogeneous network environments without labeled data. The proposed method integrates a Self-Supervised Feature Disentanglement Framework (SSFDF) to decouple domain-specific features from threat-specific features, enabling robust zero-shot adaptation to unseen domains. Our architecture employs a dual-branch Transformer encoder to separately learn domain-invariant attack patterns and domain-dependent environmental characteristics through contrastive learning and adversarial training. Furthermore, a prototype disentanglement network enforces consistency among threat representations, while a dynamic feature masking mechanism selectively suppresses domain-related noise during classification. The framework also introduces a switching-aggregation mechanism to dynamically combine expert models based on domain similarity, ensuring scalable deployment in multi-domain settings. Experiments demonstrate significant improvements over monolithic deep learning models, particularly in scenarios with domain shifts. The modular design allows seamless integration with existing Cybersecurity Threat Detection and Response (CTDR) systems, offering a practical solution for real-world deployment. This work advances the state-of-the-art in AI-driven threat detection by providing a theoretically grounded yet computationally efficient approach to cross-domain generalization.