CyberFuse-CI: Adversarially Resilient Vulnerability Detection Through Heterogeneous Multi-Source Data Fusion and LLM-Augmented Reasoning
Year: 2026
Type: conference-paper
Abstract: Enterprise vulnerability detection faces two persistent challenges: fragmented data streams that cannot be correlated across silos, and classifiers that fail under adversarial perturbation. CyberFuse-CI is a three-layer Computational Intelligence framework built to address both. It normalizes CVE repositories, STIX 2.1 threat feeds, SIEM event logs, and open-source code repositories to a common VulnerabilityEntity schema, constructs an LLM-augmented knowledge graph using BiLSTM-CRF named entity recognition, Graph Attention Network link prediction, and GPT-4 candidate link validation, and classifies each entity with an adversarially hardened XGBoost ensemble trained with Fast Gradient Sign Method perturbations at epsilon = 0.01 applied exclusively to continuous input features. Every detection maps to a MITRE ATT&CK v15 technique and a remediation control. On the CVEfixes benchmark and a 90-day anonymized enterprise SIEM corpus, CyberFuse-CI achieves 94.7% macro-averaged F1-score under normal conditions and 91.2% accuracy under FGSM adversarial perturbation. Cross-source knowledge graph fusion enables zero-day candidate identification a mean of 6.2 days before NVD publishes the corresponding CVE. An ablation study confirms that each component contributes independently to the final result. Code and evaluation scripts are available at [7].
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7220684111