Model Comparison and Sensitivity Analysis of Changes in Attack Technique Relations in Temporal Knowledge Graphs Built from CTI Reports

Temporal knowledge graphs built from public cyber threat intelligence (CTI) reports reflect report composition and analysis conditions as well as the reported techniques. Interpreting temporal changes therefore requires examining sensitivity to these factors. To this end, we constructed annual graphs for 2002–2023 from 1474 reports, linking techniques identified in the same report and applying report-level time allocation. We compared the observed weighted ratio W with the excess ratio R, the positive part of W minus the composition-preserving randomization mean μ. Nine descriptors and constant, linear, and piecewise-constant models summarized graph-level changes. The top 74 reports accounted for 92.72% of summed per-report combination counts. One case showed an increase in W while R became zero; another had 12 positive years both before and after exclusion, with only 11 years in common. Under the unified positive criterion and 9600 randomized samples per year, the full corpus retained only the piecewise-constant model across five replicate bundles, whereas top-15 or top-74 exclusion retained only the constant model. Random removal of 74 reports retained only the piecewise-constant model in 95/100 subsets sampled from all reports and 85/100 sampled from reports generating combinations. Top-74 exclusion produced greater score movement toward the constant model than any sampled subset. Candidate sets also depended on the positive criterion and relation selection rules. We derived reporting items covering supporting reports, W, μ, R, condition-specific year sets, and candidate sets. Interpreting these patterns as attack-behavior changes requires source-event and operational evidence.