## 3 Results
### Machine Learning and Deep Learning Applications
#### 3.3.2 Other Uses of Machine Learning and Deep Learning
A proposed provenance score quantifies the provenance of each datum and is later used to update the KG with provenance-specific classes and relations. In an alternative use case of ML and DL application in CTI, [PERSON] et al. [111] used transformers such as GPT-2 to produce spurious CTI text data for later use in a data poisoning scenario with a KG and a cybersecurity corpus. The results showed that experts were not able to distinguish fake CTI from real data and were misguided to produce erroneous reasoning outputs, rendering the KG useless. The effectiveness of cyber threat ontologies and Adversarial Machine Learning (AML) techniques in making predictions was studied by [PERSON] et al. [112]. APT attacks were modeled as a cyber threat ontology to accurately represent knowledge. Adversarial attacks based on RF and Gradient Boosting (GBoost) classifiers were subsequently applied. Analysis of the AML attacks showed that the use of ontological semantic reasoning capabilities was useful for validating a schema designed for vulnerability identification. In another study, [PERSON] et al. [113] utilized RF and GBoost algorithms along with cyber supply chain ontologies to map relationships between cyber attacks and cyber threat propagation and ultimately explore the cascading impact of different cyberattacks against the nodes of a supply chain network. The evaluation results revealed that the utilization of ontologies provided a better understanding of the correlations in the cyber supply chain security domain, achieving 80% accuracy in ML prediction of potential cyberattacks. [PERSON] et al. [114] proposed Relational Multi-Head Graph Attention Networks (R-MGAT), a model based on Graph Neural Networks (GNNs) for learning KG embeddings related to CTI with the aim of better understanding the semantics in text data. The authors also contributed a novel dataset of APT reports labeled using a text annotation tool (BRAT). R-MGAT achieved satisfying results in terms of Mean Rank, Mean Reciprocal Rank, and Hit@k in entity classification and link prediction tasks. The Cyber threat indicators association prediction (Ctiap) model was created by [PERSON] et al. in [115]; Ciap combines matrix factorization and NN methods for the semantic and topological extraction processes, respectively. The authors created a graph dataset of threat indicators containing more than 20,000 samples and compared the performance of Ciap against baseline methods that address the link prediction problem. Ciap demonstrated the best accuracy and F1-score in mining threat indicator relationships. [PERSON] et al. [116] demonstrated the effectiveness of pairing knowledge from cyber-security KGs with offline Reinforcement Learning (RL) algorithms such as conservative Q-learning (CQL) for malware detection. The observed training time was lower when RL was guided by existing knowledge. For certain malware families, the proposed model achieved better performance when knowledge of these malware type existed; however, it was less efficient in generalizing the knowledge across all malware families. [PERSON] et al. [117] proposed a CTI ontology and KG structure using data stemming from different sources, along with an inference model based on graph embedding algorithmsand reasoning rules (CTI-KGE). Their model applies link prediction tasks to augment the CTI landscape by automatically inferring the tail entities that potentially form relationships with the head entities. Using the proposed inference and reasoning rules, the analyst is able to automatically generate defense strategies. The method was evaluated in actual network system scenarios. A model based on a GNN for edge information propagation was deployed by [PERSON] et al. [118]. The model was tested on three public datasets, achieving state-of-the-art results, and was later used for link prediction tasks on a constructed CTI KG (RCTI). A connectivity rate equal to 97% was observed between CTI and security requirements entities. The authors asserted that the model was suitable for management vulnerability detection.