In the digital age, software security is essential for the stability of information systems and data protection, yet increasing complexity in software systems has made vulnerabilities a significant cybersecurity threat, leading to data breaches, system crashes, and service disruptions. Traditional vulnerability assessments usually analyze vulnerabilities in isolation, ignoring their time relations and the risk of attackers exploiting multiple vulnerabilities simultaneously, known as co-exploitation. This paper proposes an innovative time-aware cybersecurity knowledge graph (TCG) reasoning method called TCGFormer, which is designed to address these challenges. TCGFormer comprises four modules: (1) an entity encoding module that adjusts attention based on positional information and interaction frequency, (2) a novel attention mechanism for encoding relational topology graphs, (3) a joint sequence encoding module for extracting temporal representations and node relations from historical interactions, and (4) a parameter learning module for predicting entities and relations. Extensive experiments on three public temporal datasets demonstrate that TCGFormer significantly outperforms existing baseline methods, and validation on a cybersecurity knowledge graph dataset—including NVD, CVE details, CWE database, and EDB—further confirms its efficacy in identifying co-exploitation behaviors.

Graph neural networks (GNNs) are highly effective on relational data, yet their performance degrades sharply when graph topology is poisoned before training. Existing defenses usually assume a fixed attack pattern and a fixed graph structure, which makes them brittle when the poisoned graph changes across attacks, perturbation budgets, or deployment conditions. We propose GADD, a game-inspired adversarial distillation framework for robust graph defense. GADD first constructs multiple positive and negative graph views through a homophily-aware graph sampling scheme, allowing the model to learn from both purified and high-risk subgraphs. It then trains a heterogeneous group of student GNNs online, where each student receives global class-distribution knowledge from its peers and local structural knowledge through an adversarial cyclic distillation objective. Finally, GADD replaces uniform ensembling with an entropy-regularized adaptive aggregation rule that assigns graph-adaptive weights according to confidence and inter-model agreement. On Cora, CiteSeer, and PubMed, GADD consistently improves robustness against both Meta and Nettack attacks while preserving clean accuracy. Under the strongest Meta and Nettack settings in the main benchmark, GADD improves the best competing baseline by up to 2.99 and 3.42 percentage points, respectively. Additional ablations show that graph sampling, adversarial distillation, and adaptive aggregation all contribute materially to the final robustness gains.