## 3 Results
### Utilization of Ontologies and Knowledge Graphs  
[PERSON] and [PERSON] [69] proposed a method for generating RDF-based metadata to effectively manage cybersecurity-related information. The metadata structure adheres to the information types defined in a previously constructed cybersecurity information ontology [70]. The proposed RDF mechanism also manages to update obsolete information to mitigate potential security threats. The method was evaluated based on its extensibility, scalability, and credibility of information. [PERSON] and [PERSON] [71] developed a reasoning mechanism for cybersecurity queries when examining cyber situations. After proposing a formal definition of the term \"cyber situation\", the authors used [PERSON]'s situation theory to extend the STIX ontology [8] for situation recognition. The proposed reasoning mechanism can recognize specific situation types and identify the smallest amount of information needed for answering a query automatically. Two queries were tested in a small part of the Skaion dataset, with the reported precision and recall scores exceeding 80% in both cases. In another study, [PERSON] and [PERSON] [9] explored different CTI exchange standards such as STIX [8], Incident Object Description Exchange Format (IODEF) [72], and OpenIOC to evaluate the overlap between each other and other features using ontologies and techniques from library science. A comparison among the semantics of each format was conducted to highlight the potential advantages of RDF/OWL-based semantic exchange formats. The authors constructed an RDW/OWL ontology based on elements of STIX and IODEF, aiming to leverage the semantic power of RDF/OWL for the automation of cyber threat response systems. [PERSON] et al. [73] evaluated the security risks of networked systems by proposing a novel metric named \"net vulnerability\". The authors leveraged an ontology they built in a prior work [74] and cataloged the vulnerabilities (CVE IDs and CVSS base vector) of the host of the network after gaining knowledge about the network's inventory and mapping the relationships between the assets of the network. Two indices were computed for each vulnerability: the impact sub-score and the exploitability sub-score. Net vulnerability was evaluated on a fictitious network. To enhance the knowledge regarding security issues within the IoT environment, [PERSON] and [PERSON] [75] utilized an ontology to gain relevant knowledge about the environment. To achieve this, the authors enabled the generation of automated alerts from sources such as IDS and firewalls or advanced correlations between different access attempts and network probes with location and time data. A case study approach for security requirement identification was also demonstrated. [PERSON] [76] used a description logic formalism based on \(\mathcal{SROIQ}\)[77] to model fuzzy cyber-related knowledge and information, aiming to potentially enhance the automation of querying and reasoning when discovering CTI. By combining P-\(\mathcal{SROIQ}\)[78], \(\pi\)-\(\mathcal{SROIQ}\)[79], and \(L\)-\(\mathcal{SROIQ}\)[80], the author was able to infer probabilistic, possibilistic, and fuzzy cyber-related knowledge. The proposed method was evaluated on a case study involving the representation of vulnerabilities, attack patterns, rankings, and malware behavior, with certain, uncertain, crisp, and fuzzy axioms expressed as percentages of the captured semantics with respect to all the semantics of the model. The method was compared to alternative representations, and was able to capture 65.54% more knowledge than \(\mathcal{ALC}\) logic or standard \(\mathcal{SROIQ}\). [PERSON] and [PERSON] [81] used the STIX standard and the Maltego tool [82] to apply semantic methods in various CTI use cases. They emphasized the significant advantage of representing CTI within RDF repositories when dealing with previously undiscovered threats. Unlike relational databases, RDF repositories provide flexibility, as they do not require schematic alterations.