ChronoSentinel: Incremental temporal embedding for Security Knowledge Graph using Dynamic Reachability Centrality and Efficient language model

Abstract

The increasing sophistication of cyber threats requires adaptive, real-time defenses that can evolve with dynamic attack patterns. Security Knowledge Graphs (SKGs) have become essential for representing complex interrelationships among cyber entities, which are vital for combating ongoing cybercrime. However, most existing incremental update methods rely on non-temporal strategies that fail to capture the evolution of security data. This paper presents ChronoSentinel, an innovative framework that synergistically integrates Dynamic Reachability Centrality (DRC) with Efficient Language Models (ELMs) to offer a robust and scalable solution for maintaining and enhancing Temporal Security Knowledge Graphs. By incorporating temporal dynamics, ChronoSentinel incrementally updates the graph while reducing the computational cost of full retraining, leveraging time-sensitive information to respond to emerging threats. The framework employs DRC to prioritize influential and temporally critical core nodes, ensuring the graph remains up-to-date and responsive to evolving threat landscapes. Additionally, by integrating ELMs such as BART, FLAN-T5, and DeepSeek, ChronoSentinel enriches the graph with contextual insights that improve semantic representation and enable predictive link generation. This hybrid approach supports faster threat prediction and defense while maintaining reliability, accuracy, and low computational overhead.