Entity Embeddings and Ensemble Learning for Multi-Attribute Cyber-Attack Forecasting: A Benchmark and Evaluation Protocol for Merged Incident Repositories

Abstract Integrating heterogeneous repositories into a single knowledge base, and completing each source’s missing attributes by supervised imputation, is routine in data engineering, but its effect on downstream evaluation is rarely measured. We study it in cyber-attack forecasting, where individual incident repositories are either temporally dated or categorically shallow. To our knowledge, the resulting form of leakage has not been described for merged threat-intelligence corpora. Harmonising the VERIS Community Database with Hackmageddon timelines into 20,279 incidents under a common 64-attribute schema, we find attack-type macro F1 of 70.41% on records whose labels were reconstructed during merging against 26.58% on records whose labels were observed, a 43.83-point gap (p < 0.0001) that pooled metrics conceal. Because the sources cover disjoint periods, a masked-imputation control holding era and source constant isolates the effect: inflation persists at 16.86 points (p = 0.012) and scales inversely with imputer fidelity, so a weak imputation step distorts evaluation more than a strong one. We propose a source-agnostic, three-part protocol (provenance stratification, feature-group ablation and the masked-imputation control) applicable to any integrated dataset. Entity embeddings raise attack-type macro F1 from 14.00% to 32.57% at fixed architecture, and class cardinality rather than imbalance bounds performance: the 189-class country target reaches at most 7.32% macro F1 despite 66.79% accuracy. Under chronological evaluation, attack-type forecasting reaches 38.44% accuracy and 19.32% macro F1, and the deep model overtakes the tree-based baseline (p < 0.003). Code, taxonomy and corpus-construction scripts are released.