CyberDQFormer: A Knowledge Graph-Enhanced Transformer Framework for Security-Aware Data Quality Anomaly Detection and Autonomous Repair Against Network Attacks

Abstract

The increasing reliance on data-driven cyber infrastructures has made data quality degradation a critical security concern, as adversaries can deliberately manipulate, inject, or poison data to disrupt network defense, threat intelligence, and operational decision-making. This study aims to develop a unified framework for security-aware data quality anomaly detection and autonomous repair against network attacks by proposing CyberDQFormer, a Knowledge Graph-Enhanced Transformer architecture that jointly models temporal quality evolution and relational attack semantics. The framework first encodes heterogeneous quality indicators, including completeness, consistency, authenticity, temporal stability, and access trustworthiness, into latent representations, then employs a Transformer-based temporal encoder and a Graph Attention Network operating on a Cyber Knowledge Graph to distinguish benign degradation from malicious anomalies and to infer appropriate repair actions through an attack-aware policy module. Extensive experiments conducted on CIC-IDS2017, UNSW-NB15, and TON_IoT with synthesized data quality degradation scenarios demonstrate that CyberDQFormer achieves an F1-score of 97.9% and an AUC of 0.992, outperforming representative anomaly detection baselines. Moreover, the proposed framework obtains an average Quality Recovery Rate of 94.9% for autonomous repair under missing data, tampering, and poisoning attacks, validating its effectiveness in trustworthy cyber data governance.