## 3 Results
### Ontology and Knowledge Graph Construction
MALOnt, an open-source malware ontology leading to the construction of a threat intelligence KG from a corpus of annotated malware reports, was introduced by [PERSON] et al. [23]. The ontology contains concepts referring to malware characteristics along with attack and attacker details. New knowledge is inferred through deduction and induction using an OWL-based reasoner. Analysis, detection, classification, and attribution of malware-related threats is made feasible using MALOnt. MALOnt was evaluated through SPARQL queries. Queries that extracted instances as a response indicated that the questions adhered to the aim of the ontology. [PERSON] et al. [46] focused on generating a CTI repository referring to IoT medical devices and their known vulnerabilities from heterogeneous online data sources. The collected information was used to enrich a cybersecurity KG. Using relevant knowledge from Wikida data [47] and the Food and Drug Administration's AccessGUDID database [48], the gener \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Reference** & **Year Published** & **Brief Summary** & **Domain** \\ \hline
[31] & 2013 & Proposed the use of Semantic Web and Ontology concepts to define an approach for analyzing security logs for security issues identification. & Web Attacks \\ \hline
[32] & 2013 & Introduced S-MAIDS, a semantic approach to IDRS modeling using OWL ontologies. & IDRS \\ \hline
[33] & 2014 & Proposed a taxonomy for the classification of existing CTI sharing technologies. & CTI \\ \hline
[34] & 2015 & Proposed the DFAX ontology for representing and exchanging digital information. & Digital forensic information \\ \hline
[36] & 2015 & Presented an ontology for the enhancement of cyber defense against APTs. & APT \\ \hline
[37] & 2016 & Proposed an ontology for the efficient organization of OSINT and threat indicators. & CTI \\ \hline
[38] & 2017 & Proposed an ontology-based framework for the IoT environment to safeguard against APTs. & APT in IoT Environments \\ \hline
[39] & 2017 & Defined an ontology for threat analytics. & CTI \\ \hline
[40] & 2018 & Presented a CTI ontology for the analysis and classification of Sysmon logs. & CTI \\ \hline
[41] & 2019 & Proposed an approach of analyzing real-time network log data within a NSM environment by using a graph database. & NSM \\ \hline
[42] & 2019 & Proposed an ontology of metrics for security management. & Cybersecurity Management \\ \hline
[43] & 2019 & Proposed an ontology knowledge base that can define APT attack patterns and recommend security requirements. & APT \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Works relevant to ontology or KG construction from 2013 to 2019. Records are arranged in ascending order based on their publication year, and alphabetically by author name when the publication years of two or more papers coincide. ated graph embeddings were further refined to allow the augmented KG to create node graph representations of higher quality. The authors observed a 31% increase in the Mean Average Precision (MAP) when implementing an information retrieval (IR) task on the CTI and Wikidata KG augmented with AccessGudid compared to performing the same task on the CTI-only KG and the CTI KG augmented only with Wikidata. [PERSON] and [PERSON] [25] proposed an ontology structure for enhancing the defensive capabilities of web apps when facing Cross-Site-Scripting (XSS) attacks. The authors discussed the importance and the advantages of leveraging ontologies and concluded that the exclusive use of ontologies as a defensive mechanism was not adequate to improve the security of web apps. An ontology-based framework for enhancing the resilience and security of Information Technology (IT) systems in maritime port ecosystems was developed by [PERSON] et al. [49]. The framework comprises three subcomponents that leverage ontologies and inference methods for the recovery of cyber-related incidents. Additional advanced security tools handle the detection of suspicious activity.