Knowledge Graph–Augmented Reasoning for Robust Multi-modal Document Attack Detection

Document-based cyber attacks pose significant threats to cybersecurity due to their multi-modal content and cross-platform adaptability. However, existing anomaly detection methods are often limited by modality isolation, reliance on static rules, and vulnerability to adversarial perturbations. To address these challenges, we propose SynGraph (Knowledge Graph-Augmented Anomaly Detection), a unified framework that integrates dynamic knowledge graphs, adversarial sequence modeling, and multi-modal fusion for robust document security analysis. SynGraph overcomes the above limitations through four key innovations: (1) dynamic security knowledge graphs that capture hierarchical document structures via temporal graph convolutions; (2) syntax–semantic joint optimization for identifying contextual inconsistencies; (3) adversarially trained bidirectional LSTMs for perturbation-invariant sequence analysis; and (4) lightweight multi-modal fusion with attention-based gating to enable real-time inference. Evaluations on APT datasets demonstrate SynGraph’s superiority, achieving 95.1% F1-score in PDF attack detection (18.7% improvement over state-of-the-art), 26.4% average adversarial attack success rate (2.4 \(\times \) lower than baselines), and sub-60 ms processing latency. The proposed framework enables accurate identification of multi-vector attacks while maintaining adaptability to evolving threats through continuous graph-based rule updates.