在數位轉型與雲端服務普及的趨勢下，全球網路流量呈現指數型成長，帶來便利之餘，也徹底改變了網路攻擊規模與樣貌，同時，也使企業每日要面對的資安威脅大幅增加，在此背景下，網路入侵偵測系統（NIDS）也成為企業安全防護的核心；然而，深度學習方法高度仰賴人工標註，而現有的半監督方法亦面臨多重挑戰，包含偽標籤雜訊所引發的確認偏誤、模型過度自信而使閾值失效、以及特徵重疊導致的邊界偏移等等。 為了解決上述問題，本研究提出「基於中心點聚合與雙空間約束之半監督網路入侵偵測架構（A Medoid-Aggregated Semi-Supervised Learning Framework with Dual Constraints for Network Intrusion Detection， DC-HypoCon）」，這是一個整合原型聚合、雙空間約束與對比學習的新方法，DC-HypoCon導入雙門檻機制，結合機率信心與特徵邊距相似度，透過雙重驗證確保偽標籤的品質；同時以Top-N Medoids原型更新機制（Hypotype），挑選最具代表性的真實樣本作為類別中心，降低離群值擾動；並藉由對比學習將樣本拉近所屬原型並推離他類原型，強化少數攻擊類別的判別性。 為了驗證DC-HypoCon的有效性，本研究於公開資料集進行廣泛實驗，實驗結果顯示，在僅有10%標籤資料的設定下，DC-HypoCon的效能優於既有的半監督基準方法，顯示DC-HypoCon不僅能為企業提供低成本且可行的落地途徑，也為網路安全防護提供了有效且穩健的解決方案。;Over the past decade， digital transformation and cloud service adoption have driven exponential growth in global network traffic， reshaping the scale and nature of cyberattacks. As a result， Network Intrusion Detection Systems (NIDS) have become a cornerstone of modern cybersecurity architectures. Although deep learning has shown strong performance in detecting known attacks， existing semi-supervised frameworks remain limited by pseudo-label noise， model overconfidence， and representation overlap， which can lead to confirmation bias， unreliable thresholding， and decision boundary drift. This paper introduces DC-HypoCon， a semi-supervised learning framework that integrates contrastive learning， class prototype modeling， and pseudo-label filtering mechanisms to improve the structure of the feature space and enhance the model’s discriminative capability. Our method employs a dual-space thresholding mechanism to simultaneously constrain pseudo-label selection based on probability confidence and feature-margin similarity， thereby ensuring the quality and reliability of pseudo-label selection. We also incorporate Hypotype， a dynamic medoid updating mechanism designed to eliminate outlier pseudo-labels and stabilize class prototypes. Additionally， we employ cross-label supervised contrastive learning to align embeddings with their corresponding class prototypes while increasing inter-class separation， thereby establishing clearer decision boundaries. Through extensive experiments， we demonstrate that DC-HypoCon outperforms state-of-the-art baselines on multiple real-world datasets， significantly enhancing pseudo-label quality and class-discriminative capability， thereby providing a cost-effective and practical adoption path for enterprises while offering a reliable and robust solution for cybersecurity defense.
