EAAI Journal 2026 Journal Article
Predicting inter-state cyberattacks with graph-text fusion using graph neural networks and large language models
- Jiping Dong
- Mengmeng Hao
- Fangyu Ding
- Shuai Chen
- Jiajie Wu
- Jun Zhuo
Accurate forecasting of inter-state cyberattacks is crucial for the timely prevention of security risks. However, the dynamic evolution of international relations and the heterogeneity of multi-source data make this task significant challenging in both data integration and model design. To address these issues, we propose GeoDyG-LLM (Geopolitical Dynamic Graph-Large Language Model), a unified multimodal framework for geopolitically grounded cyberattack prediction. The framework models inter-state interactions by integrating dynamic graph neural networks (GNNs) with large language models (LLMs), jointly capturing the temporal, structural, and semantic dependencies from historical cyberattack records and news events. Methodologically, the framework (i) employs a dynamic multi-view GNN with a learnable projector, whose node embeddings are layer-wise injected into the Transformer layers of the LLM; (ii) leverages LLM-based semantic refinement to construct a high-quality multimodal dataset from raw data sources; and (iii) adopts a geopolitically-aware negative sampling strategy to generate informative and balanced training pairs. Experimental results show that GeoDyG-LLM (8B) substantially outperforms baselines, achieving an F1 score of 0. 888 on cyberattack prediction. Moreover, the fine-tuned model generates coherent natural-language explanations aligned with historical and contextual evidence, enhancing interpretability and supporting practical geopolitical cyber risk analysis.