Pair-Level Candidate Generation for Threat Early Warning over Temporal Security Knowledge Graphs
DOI:
https://doi.org/10.54097/pfw7hs86Keywords:
Temporal Security Knowledge Graph, Temporal Link Prediction, Early-Warning Candidate Generation, Temporal Graph Network, Concept DriftAbstract
Threat early warning must flag suspicious actor interactions from open-source intelligence ahead of time. We frame it as temporal link prediction over a temporal security knowledge graph, whose output is an early-warning candidate for human triage. TGN-Sec adapts the temporal graph network to the security setting via a relation-aware message function (Modification A) and temporal decay attention (Modification B), mapping scores to candidates through relative ranking; online maintenance loops via memory updates, elastic weight consolidation (EWC) fine-tuning, and a Kolmogorov–Smirnov (KS) test for drift retraining. Built from GDELT 2.0, the evaluation graph spans 92 days, 167 entities, 14,223 edges, and 5 CAMEO-derived relation types; under an aligned protocol we ablate the two modifications, compare against five baselines, and run a comparability check exposing 8 defects. On pair-level early-warning candidate generation TGN-Sec reaches F1 of 0.1074 ± 0.0134 against the top baseline TransE at 0.0402, about 2.2 to 3.0 times, with pair-level recall leading 2.87 to 4.65 times and the lowest repeated-alert rate (29.99%), scoped to human triage rather than automatic alerting. The reverse also holds: item-level precision of 0.0762 ± 0.0090 lags the baselines (0.2427 to 0.2813) by 3.2 to 3.7 times, the two modifications show no significant independent contribution, and recall on pairs unseen in training is 0.000 across three seeds. This paper favors honest assessment of a constructed system and treats protocol alignment as a prerequisite before any continuous-time metric is reported.
Downloads
References
[1] Zhang, S., Wang, Y., Zhang, Z., et al. (2026). Warning-Graph: An Early Warning Framework for APT Attacks Based on Threat Intelligence Modeling. IEEE Transactions on Dependable and Secure Computing.
[2] Xu, D., Ruan, C., Korpeoglu, E., Kumar, S., & Achan, K. (2020). Inductive representation learning on temporal graphs. In Proceedings of the International Conference on Learning Representations (ICLR).
[3] Rossi, E., Chamberlain, B., Frasca, F., Eynard, D., Monti, F., & Bronstein, M. (2020). Temporal graph networks for deep learning on dynamic graphs. arXiv:2006.10637.
[4] Nayeri, Z. M., & Rezvani, M. (2026). Alert prediction in computer networks using transformer-based temporal graph neural networks: Identifying the next victim. Journal of Network and Computer Applications.
[5] Dudziak-Gajowiak, D., Juszczyszyn, K., Chudzicki, D. M., et al. (2026). Link prediction using temporal graph neural network model. Electronics.
[6] Trivedi, R., Farajtabar, M., Biswal, P., & Zha, H. (2019). DyRep: Learning representations over dynamic graphs. In Proceedings of the International Conference on Learning Representations (ICLR).
[7] Alilou, M., Bhuyan, B. P., Fissoune, R., et al. (2026). Temporal motif-based representation learning on continuous-time dynamic graphs. Data Mining and Knowledge Discovery.
[8] Cheriyan, J., Nair, L. S., & Hsiung, P. A. (2026). A unified theoretical and deep learning framework for temporal link prediction in dynamic networks. IEEE Access.
[9] Ren, Y., Xiao, Y., Zhou, Y., et al. (2023). CSKG4APT: A Cybersecurity Knowledge Graph for Advanced Persistent Threat Organization Attribution. IEEE Transactions on Knowledge and Data Engineering.
[10] Ge, W., Wang, J., Cui, Z., et al. (2026). ThreatMAMBA: Achieving high-robustness cyber threat attribution during the evolution of attacks. IEEE Transactions on Information Forensics and Security.
[11] De Paola, A., Drago, S., Ferraro, P., et al. (2026). HOIDS: Concept drift aware hybrid online intrusion detection system. Journal of Network and Computer Applications.
[12] Kirkpatrick, J., Pascanu, R., Rabinowitz, N., Veness, J., Desjardins, G., Rusu, A. A., Milan, K., Quan, J., Ramalho, T., Grabska-Barwinska, A., Hassabis, D., Clopath, C., Kumaran, D., & Hadsell, R. (2017). Overcoming catastrophic forgetting in neural networks. Proceedings of the National Academy of Sciences of the United States of America, 114(13), 3521–3526.
[13] Leetaru, K., & Schrodt, P. A. (2013). GDELT: Global data on events, location and tone, 1979–2012. In Proceedings of the International Studies Association (ISA) Annual Convention.
[14] Gerner, D. J., Schrodt, P. A., & Yilmaz, O. (2002). Conflict and mediation event observations (CAMEO): A new event data framework for the analysis of foreign policy interactions. Presented at the International Studies Association Annual Convention, New Orleans, LA.
[15] Bordes, A., Usunier, N., Garcia-Duran, A., Weston, J., & Yakhnenko, O. (2013). Translating embeddings for modeling multi-relational data. In Advances in Neural Information Processing Systems (NeurIPS), 2787–2795.
[16] Hochreiter, S., & Schmidhuber, J. (1997). Long short-term memory. Neural Computation, 9(8), 1735–1780.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Journal of Computer Science and Artificial Intelligence
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
