Adversarial Optimization Scheme for Threat Detection Based on Hierarchical Oracle Supervision

1 Introduction

Network security is intrinsically linked to operational continuity and public safety, underscoring the critical importance of deploying threat detection systems that can effectively counteract sophisticated cyberattacks. Nevertheless, current threat detection approaches continue to encounter substantial limitations. A primary issue lies in the unidimensional nature of threat analysis. Predominant approaches frequently reduce threat detection to a flattened multiclass classification problem [Zhao et al., 2025b; Shen et al., 2025; Zhao et al., 2025a], wherein only the attack type of network flow is identified, while the essential contextual dimension pertaining to attack scenarios is neglected. This results in fragmented threat intelligence and complicates forensic traceability. A further challenge involves the brittleness of model decision boundaries [Ennaji et al., 2025; He et al., 2023; Yan et al., 2025]. Real-world network settings are characterized by considerable noise, and emergent threat variants [Ben Atitallah et al., 2025], imposing stringent demands on model robustness. Conventional models are susceptible to overfitting to superficial patterns in training data [Agarwal et al., 2024; Musthafa et al., 2024b; Musthafa et al., 2024a] and exhibit limited stability at their decision boundaries when confronted with noise perturbations, flow shifts, or novel threat mutations, thereby undermining their practical applicability and reliability in dynamic adversarial environments.

This paper proposes a novel framework for threat detection that integrates hierarchical labels, prompt learning, and adversarial training. The method first models the hierarchical relationships between attack scenarios and types using graph networks, enabling fine-grained multi-label threat perception and traceability analysis. It then employs prompt learning to reframe the classification task as a mask prediction task familiar to pre-trained models, thereby improving knowledge transfer efficiency. Finally, an adversarial training mechanism supervised by hierarchical labels is introduced, forcing the model to learn robust features resistant to interference, which effectively enhances the generalization capability and stability of the system in dynamic adversarial environments.

The main contributions of this paper are as follows.

• We introduce a multi-label classification framework designed to facilitate the collaborative analysis of security scenarios and attacks. By leveraging graph networks to model their hierarchical dependencies, this method not only categorizes attack types but also deduces the corresponding scenarios, thereby supplying essential contextual information for threat attribution and supporting more granular threat awareness.
• A prompt learning-based method for classifier construction has been proposed, which reframes the classification task as a masked language modeling problem com-

patible with pre-trained models. By optimizing continuous prompt embeddings, this method enables efficient and stable transfer of pre-trained knowledge to the domain of threat detection.

• We introduce an adversarial training strategy that leverages genuine hierarchical information as a robust supervisory signal. This method formulates a game-theoretic framework comprising a generator, an encoder, and a discriminator, wherein instance-specific hierarchical label information acts as a regularizer to directly steer the model toward learning feature representations consistent with hierarchical constraints. In contrast to conventional methods, our design explicitly integrates structural knowledge of the hierarchy, thus improving the model's resilience to noise, adversarial perturbations, and unforeseen threats.

2 Problem and Threat Model Assumptions

2.1 ProblemDefinition

Current threat detection methods face two core challenges. Firstly, threat analysis suffers from a lack of dimensionality. Flat, single-label classification [Zhao et al., 2025b; Shen et al., 2025; Zhao et al., 2025a] leads to isolated threat intelligence, making it difficult to correlate attack tactics, stages, and target environments, thereby hindering in-depth traceability and response decisions. Secondly, model decision boundaries are fragile [Ennaji et al., 2025; He et al., 2023; Yan et al., 2025]. Traditional models are prone to overfitting superficial features of the training data [Agarwal et al., 2024; Musthafa et al., 2024b; Musthafa et al., 2024a], resulting in significant performance degradation when confronted with input perturbations or unknown threat variants, and making them ineffective against adversarial attacks or incapable of adapting to novel threats.

2.2 Threat Model Assumption

This method assumes that the attacker possesses the capability to launch multi-stage persistent attacks, with the objectives of compromising service availability, data confidentiality/integrity, or escalating privileges, while the target network contains security flaws such as unpatched vulnerabilities and weak password configurations.

In this setting, given a network flow dataset D = {xi, yi}Ni=1 , where xi ∈ Rd is the feature vector and yi ∈ {1, 2, . . . , K} is the threat label. The objective of the task is to learn a robust classification function f : Rd → {1, 2, . . . , K} that can maintain prediction stability and accurately output the threat category y = f (x) when confronted with malicious flow x′ crafted by attackers through adversarial examples.

3 Method

The proposed method comprises three core components: hierarchical label encoding, a prompt learning-driven hierarchical classification model, and adversarial training-based optimization, as depicted in Fig.1.

3.1 Hierarchical Label Encoding

This module employs a progressive encoding strategy to transform discrete labels into distributed vector representations that concurrently capture lexical semantics, global hierarchical relationships, and local contextual information.

First, we developed a hierarchical labeling framework. In contrast to conventional threat detection approaches, which typically categorize attacks by type alone, our system not only incorporates detailed attack classifications but also introduces attack scenarios as higher-level labels, thereby constructing a more thorough descriptive framework for characterizing threats, as depicted in Fig.2.

Subsequently, we need to convert the textual label names into a numerical representation that can be processed by machine learning models. Labels initially exist as natural language entities. We utilize the pre-trained language model BERT to encode the semantic information of the labels, transforming each label name y into a distributed representation. Specifically, each label name y is first processed by BERT's WordPiece tokenizer:

In the formulation, ty represents the subword sequence obtained after tokenization, with tk denoting the k-th subword token. For instance, the label "port scanning" is decomposed into the subword sequence ["port", "scanning"]. This tokenization strategy effectively addresses out-of-vocabulary compound words and domain-specific terminology, thereby preserving the full semantic content of the label. The resulting token sequence is subsequently mapped to vector representations via BERT's embedding layer:

Wtoken is the token embedding matrix, Wpos is the position embedding matrix, and Wseg is the segment embedding matrix. The embedding layer integrates lexical semantics, positional information, and segment type to generate a contextindependent initial representation for each token.

The final semantic representation of the label is generated using an average pooling strategy:

lsem y is the semantic representation vector of the label, and K is the number of tokens in the sequence. Average pooling considers the contribution of each subword equally, and is insensitive to variations in sequence length, making it suitable for handling label names of different lengths.

However, lsem y only contains the semantic meaning of the label itself and fails to capture its position within the hierarchical structure. To address this, we introduce a Graph Attention Network (GAT), treating it as a graph for encoding. The GAT employs a message-passing mechanism, allowing the representation of each label node to aggregate information from its neighbors (parent and child classes). Specifically, for each label node i in the label hierarchy, its global representation is iteratively updated through a multi-layer graph attention mechanism:

In this context, α(l) ij represents the attention weight at the l-th layer, N(i) denotes the set of neighboring nodes of node i, W (l) is the transformation matrix, and σ is the activation function. This process ensures that semantically similar or hierarchically adjacent labels are positioned closely in the vector space, thereby enhancing the discriminative power and semantic richness of the label representations. Furthermore, the hierarchical encoding of GAT allows each label's representation to incorporate not only its own lexical semantics but also the structural contextual information from the global hierarchy. For example, "port scanning" and "uploading injection" both belonging to the parent category of the EdgeIIoTset dataset scenario, will share certain common features in their representations after GAT encoding, while retaining their distinct characteristics.

After propagation through the L layers, we obtain the final global label embedding matrix Lglobal. For the complete label system comprising N tags, we derive the hierarchical representation liglobal ∈ Rd for each tag through GAT encoding, where i ∈ {1, 2, . . . ,N} is the tag index and d is the embedding dimension. These vectors are combined row-wise to construct the global tag embedding matrix:

This matrix will serve as the learnable label representation in the next section's classification model, used to compute the semantic similarity between input features and all labels.

3.2 Hierarchical ClassificationModel Based on Prompt Learning

Upon acquiring the hierarchical vector representations of the labels, the central objective of this module is to construct a classification model capable of mapping raw flow into the same semantic space. Hierarchical classification is subsequently achieved by computing the similarity between the input data and the label representations.

We first fill the original flow data x into a carefully designed prompt template T to construct the final input sequence T (x) for the model, which can be described as:

In this framework, [V1], [V2], · · · , [VP ] represent a set of learnable continuous virtual tokens. These tokens are not associated with any natural language vocabulary but are optimized through gradient descent during training. They function as task-specific contextual cues, enabling the pre-trained model to better adapt to the downstream threat classification task. The placement of the [MASK] token is critical within the overall template, as the model is tasked with generating predictions at this specific position.

Then, the BERT model is used to encode the promptprocessed sequence T(x) into a sequence of hidden states:

We take the hidden state corresponding to the [CLS] token or perform a pooling operation on the entire sequence to obtain the aggregated representation hx ∈ Rd of the data x:

This representation effectively integrates raw flow data with contextual information derived from learnable prompts, while the BERT model captures the deep semantic features of the input via its multi-layer Transformer encoder.

Classification decisions are made by calculating the similarity between the text representation hx and each label vector in the global label embedding matrix Lglobal generated in the previous section. Specifically, we employ the dot product operation to measure the proximity in the semantic space.

liglobal represents the label vector of the i-th label in the global label embedding matrix Lglobal. The similarity score is then transformed into the predicted probability for each label y using the sigmoid function:

where bi is the label-specific bias term.

The model learns its parameters by minimizing the binary cross-entropy loss Lcls between the predicted probabilities and the true labels, allowing the predicted probability P(y|x) to gradually approximate the distribution of the true labels.

During the inference stage, we employ an optimized single-model architecture that retains only the trained generator to ensure efficient forward propagation. For an input sample xtest, it is initially formatted via a prompt template T(xtest), incorporating pre-trained continuous prompt tokens and the target [MASK] position. The model then computes the hidden state h[MASK] at the [MASK] position to serve as the data representation, and performs multi-label prediction by measuring its similarity against a global label embedding matrix Lglobal .

The final decision is made using a threshold strategy of τ=0.5, and hierarchical consistency constraints are applied to ensure the prediction results align with the label hierarchy.

3.3 Model Optimization Based on Adversarial Training

The principal aim of this module is to utilize sample-specific, authentic hierarchical information as a robust supervisory signal to regularize the base model, thereby improving its resilience and generalization performance in the presence of noisy perturbations and out-of-distribution data.

The essence of adversarial training is to enable the model to learn through "adversarial gaming" by generating indistinguishable adversarial samples, thereby enhancing the smoothness and stability of the decision boundary. In this module, the adversarial training framework consists of three components: a generator, an encoder, and a discriminator.

The generator, implemented as a hierarchical classification model parameterized by θG and trained in the preceding section, processes flow data x to generate a latent representation hmix that incorporates both semantic and prompt-related information. Throughout adversarial training, the generator aims to produce representations that are statistically indistinguishable from the real data distribution, thereby attempting to mislead the discriminator.

The encoder comprises a network architecture analogous to that of the generator, yet endowed with independent parameters. Its distinctive characteristic is the incorporation of both the input data x and the label representation ˆL, derived via local hierarchical perception, to produce a high-quality oracle representation ˆhmix that embeds the true local hierarchical prior. This representation effectively integrates authentic local hierarchical information, thereby furnishing the generator with a well-defined learning objective and a robust regularization signal.

The discriminator is a binary classification neural network tasked with determining whether an input representation originates from the generator or the encoder. It outputs a scalar probability value indicating the likelihood that the input representation is considered to come from the encoder (i.e., the oracle representation).

To generate high-quality oracle representations ˆhmix, we first enhance the label representations by incorporating sample-specific presence information:

Among them, epresent and eabsent are learnable vectors, and I(·) is an indicator function. This step assigns each label a clear semantic meaning (presence or absence) within the context of the current sample. The encoder utilizes this set of enhanced label representations ˆL and the input data x to generate the final oracle representation ˆhmix. This process ensures that hmix is a high-quality reference representation that incorporates genuine local hierarchical knowledge.

Adversarial training is performed through alternating optimization. First, the parameters of the generator G and the encoder E are fixed, while the parameters θD of the discriminator D are updated. The goal of the discriminator is to maximize its discriminative ability, and its loss function is:

Here, the discriminator is trained to correctly distinguish between the oracle representations from the encoder and the "generated" representations from the generator.

Next, with the parameters of the discriminator D and the encoder E held fixed, the parameters θG of the generator G are updated. The generator is optimized under a dual objective: minimizing the classification loss Lcls to preserve baseline classification performance, and minimizing the adversarial loss Ladv, which promotes the generation of representations hmix that are indistinguishable from the oracle representations ˆhmix, thereby misleading the discriminator. The adversarial loss is defined as:

Therefore, the total loss of the generator is:

Among them, α is a hyperparameter used to balance the weights of the two loss terms.

Through this adversarial training process, the generator is compelled to learn representations that are distributionally aligned with those of the oracle model. Consequently, the internal feature representations of the generator implicitly capture and encode the true hierarchical structure of the data. This approach yields several key benefits: (1) It introduces a strong regularization effect by incorporating hierarchical information as a powerful inductive bias, which mitigates overfitting on limited training data, particularly for rare attack classes; (2) It promotes smoother decision boundaries, encouraging the model to learn a more stable decision function in the vicinity of the boundary between genuine and adversarial examples, thus improving robustness to input variations; (3) It facilitates a form of knowledge distillation, whereby the oracle hierarchical knowledge embedded in the encoder is effectively transferred to the generator (the primary model).

4 Evaluation

4.1 Evaluation Setup

Dataset

We conducted a comprehensive evaluation on four public datasets: Kitsune (for IoT and Industrial Internet of Things environments, including 9 types of attacks), Edge-IIoTset (for large-scale IoT scenarios, including 14 types of attacks), MSCAD (for multi-step network attack scenarios, including 5 types of attacks), and USTC-TFC2016 (for encrypted flow detection scenarios, including 10 type of attack).

Parameter Setting

Unless otherwise stated, all experimental results presented in this study are derived under the following parameter configurations: The AdamW optimizer is employed for parameter optimization during training, with a base learning rate of 310-5 . In adversarial training, the weight of the adversarial loss is set to 1.0. The discriminator is trained with a learning rate of 1×10-4 , updated once every five generator steps, and a gradient penalty coefficient of 10.0 is applied. During inference, a classification threshold of 0.5 is used. All datasets are partitioned into training, validation, and test sets with a ratio of 64:16:20, respectively.

Evaluating Metrics

We used accuracy, precision, recall, macro F1-score(MaF1) and micro F1-score(MiF1) to evaluate the classification ability of the proposed method.

4.2 Overall Comparative Analysis

To comprehensively evaluate the effectiveness of the proposed method, we designed cross-validation experiments with 10 combinations ranging from 2 to 4 scenarios on four public datasets. As summarized in Table 1, the proposed method exhibits robust performance in both attack scenario and attack category detection under varying scenario configurations. This consistency suggests that hierarchical label encoding and prompt learning effectively capture discriminative feature representations at the macro-scenario level, thereby affirming the distinctiveness of scenario-specific fingerprints embedded within network flow.

Furthermore, based on the fused dataset of four scenarios, Kitsune-IIoTset-TFC2016-MSCAD, we compared this method with other advanced threat detection approaches and evaluated its detection performance across different attack categories, as shown in Table 2. In contrast to approaches that depend on statistical features, our method employs prompt learning and hierarchical label encoding to more effectively model flow semantics and contextual relationships, thereby achieving superior generalization. Unlike semantic featurebased techniques, the generative adversarial training framework incorporated in our method substantially improves its capacity to address class imbalance, yielding notable advantages in the identification of infrequent attack types.

4.3 Local Ablation Analysis

In this section, we performed ablation studies by systematically excluding the GAT-based label hierarchy encoding, prompt learning, and adversarial training modules from the complete model, in order to assess the individual contribution of each component to attack category detection on the integrated four-scenario dataset. As summarized in Table 3, the adversarial training module provided the most substantial improvement for recognizing rare attack categories, with the GAT-based label hierarchy encoding also contributing significantly. Optimal performance was achieved when all three components were utilized together.

4.4 Generalization and Induction Performance Analysis

Generalizability

To assess the model's generalization capacity, cross-testing was performed across datasets encompassing diverse network environments, topologies, and service scenarios. As illustrated in Table 4, the model attains a detection accuracy exceeding 80% in the majority of cross-scenario evaluations, indicating its ability to capture common underlying features present in disparate scenario-based datasets and thereby demonstrating a measurable degree of generalization.

Inductive

To assess the adaptability of the proposed method under inductive learning conditions, we systematically varied the proportion of training data using a multi-scenario integrated dataset, thereby simulating real-world threat detection environments with differing levels of data availability. As illustrated in Fig.3(a), this method exhibits notable robustness in data-scarce inductive settings, sustaining an F1-score exceeding 70% on the integrated dataset even when trained on only 10% of the available data.

4.5 Robust Performance Analysis

Evaluation of Model Robustness Based on Low Rate Strategy

To assess the model's robustness against low-rate attacks, this section emulates an attacker's low-rate strategy by introducing delay sequences-generated via a Poisson process featuring a base delay of 5 seconds superimposed with ±30% random jitter into the network flow at an injection ratio ranging from 0.1% to 0.5%. These sequences exhibit long-period and low-density statistical properties. As illustrated in Fig.3(b), this method maintains strong robustness under such conditions. Although low-rate attacks perturb the temporal distribution of network flows, they leave semantic features of

(a) Scarcity of training data

Figure 3: Comparison of detection performance of this method under different conditions

payloads and flow-level interaction logic unaltered, thereby preserving the effectiveness of hierarchical label encoding and prompt learning-based semantic representations. Furthermore, through adversarial training, the model learns intrinsic features that are robust to temporal disturbances, thereby improving detection stability against low-rate attacks.

Evaluation of Model Robustness Based on Temporal Noise Interference

This section evaluates this method's resilience against timingbased interference by simulating an attacker's strategy and comparing its performance with existing robustness approaches, such as Whisper[Fu et al., 2021]. In the experiments, random delays drawn from a Gaussian distribution (mean = 0.5 s, standard deviation = 0.2 s) were introduced into the network flow, with the injection rate incrementally raised from 0.1% to 0.5%. As illustrated in Fig.3(c), this method exhibits significantly greater robustness to timing noise compared to Whisper. The latter depends on frequencydomain features that are highly susceptible to disruptions in temporal structure, rendering it prone to performance degradation under noise. By contrast, the proposed method utilizes hierarchical semantic encoding coupled with adversarial training, which facilitates the extraction of deep features that are inherently less sensitive to temporal variations, thus ensuring more consistent detection accuracy in noisy conditions.

Evaluation of Model Robustness Based on Payload Filling Interference

This section simulates an adversarial payload-padding interference strategy and compares this method with the Whisper[Fu et al., 2021]. The strategy involves inserting cryptographically secure random hexadecimal data into the mid-section of packet payloads, constituting 20% of the original payload length (injection ratio: 0.1%-0.5%), to obfuscate flow features while dynamically updating protocol headers to ensure compatibility. As illustrated in Fig.3(d), this method exhibits significantly superior detection performance over the Whisper, which relies on frequency-domain analysis, under conditions of payload-padding interference. The introduction of random hexadecimal data disrupts the frequency-domain feature structure essential toWhisper's operation. In contrast, this method leverages prompt learning and hierarchical encoding to extract deep semantic features that remain robust to content-level perturbations. Furthermore, adversarial training enhances the model's robustness and adaptability in the presence of payload obfuscation.

Evaluation of Model Robustness Based on Network Phenomena

To evaluate the impact of network-induced phenomena on the model, this section utilizes the scapy library to manipulate PCAP packets by deleting, duplicating, and reordering packets to simulate three typical network anomalies: packet loss (Rl), retransmission (Rr), and packet reordering (Ro), respectively. As shown in Table 5, packet reordering has the most significant impact on model performance, as it disrupts flow-level temporal dependencies and protocol state machines, to which the hierarchical semantic encoding and prompt learning method employed here are relatively sensitive. In contrast, packet loss and retransmission mainly cause information loss or redundancy but do not alter the relative timing among the remaining packets, thus resulting in a comparatively smaller impact.

5 Conclusion

This method introduces an adversarial training mechanism that utilizes real local hierarchical information as a strong supervisory signal, compelling the model to learn feature representations that are insensitive to noise and adversarial perturbations. Evaluation results demonstrate that this method achieves an accuracy exceeding 0.998 in detecting scenes and attack categories under complex conditions, while exhibiting strong robustness against interference.

Acknowledgments

This work was supported in part by the National Natural Science Foundation of China under Grant 62402053 and Grant 62227805, and in part by the Fundamental Research Funds for the Central Universities under Grant 2025KYQD17(BUPT).