## 3 Results
### Ontology and Knowledge Graph Construction
The proposed ontology contains the structure of STIX [8], CybOX [35], network configurations, and CVE, and is populated with extracted information from descriptions of emerging threats such as Tactics, Techniques, and Procedures (TTP), indicators, observables, exploit targets, and CVEs. The investigation of cyber threats is automated. The framework classifies threat relevance, determines threat likelihood, and identifies exposed assets through formulated rules and inferences by applying logic-based deductive inference rules defined in the Semantic Web Rule Language (SWRL). Protege and OWL-Manchester syntax are employed along with the open-source Pellet reasoner. The proposed framework was evaluated by assessing the ontology's structure, clarity, consistency, accuracy, and feature novelty. [PERSON] et al. [40] presented an automated threat assessment system (CTI ontology) relying on the analysis of continuous incoming feeds of Sysmon logs in order to classify software in different threat levels (high, medium, low, or unknown threat). A lookup engine is included to reduce the load of SPARQL queries. The proposed system outputs RDF graphs in triples. [PERSON] et al. [41] proposed an approach to analyzing real-time network log data within a Network Security Monitoring (NSM) environment using a graph database. They attempted to address the problem of integrating information from different sources to identify the relationship between various network traffic entities in a real-time logging NSM environment. Using relatively simple queries, the user can find related data from different log files and ultimately reconstruct malicious cyber activity to effectively find different potentially related attack paths. An ontology for cybersecurity assessment was constructed by [PERSON] et al. [42]. The authors focused on defining concepts and relationships between the primary attributes of relevant security data. The ontology includes classes such as \"Source\", \"SecurityInformation\", \"Infrastructure\", and \"Metric\", along with several types of defined relationships such as class inheritance hierarchy, object properties, and data properties. The authors also proposed an inference mechanism for calculating ontology-based security metrics to represent security metrics as separate instances within the ontology, allowing for computation of comprehensive metrics describing the security state of a system. [PERSON] et al. [43] proposed an ontology knowledge base to recommend security requirements focusing on APTs and system domain knowledge. The proposed knowledge base is divided into three parts: APT ontology, general security knowledge ontology, and domain-specific knowledge ontology. The integration of the aforementioned parts renders the extraction of appropriate security requirements feasible through a recommendation process that considers both real attack cases and system specifications. The authors aimed to enhance the understanding of complex attacks such as APTs and improve the security response in real-world scenarios. The works related to the construction of ontologies or KGs during the period 2013-2019 are summarized in Table 1.  
[PERSON] et al. [44] proposed a KG ontology modeling method for network security based on STIX [8]. They analyzed the overlap between STIX and network security knowledge and generated an ontology schema with minimal redundancy and a strong structural hierarchy, aiming to further understand the structure and the relationships of attack activities in order to encourage informed decision-making when addressing security incidents. [PERSON] et al. [45] fused different representations of malware threat intelligence to extend cybersecurity-related knowledge. Malware samples were retrieved, executed, and ultimately integrated with OSINT to construct a cybersecurity KG that would allow professionals to leverage its reasoning capabilities for malware pattern tracking.