## 5 Concluding Remarks
### Future Work  
Future work can be guided in many directions. First, ontologies can be improved in quality, mainly by developing more elaborate evaluation criteria [24], as well as by refining the relationships and inference rules [24, 65]. Additionally, methods for automatic adjustment of ontologies and KGs to incorporate recent knowledge can be researched [24, 30, 97]. Complex measures for assessing vulnerability scores, asset costs, or attack probability may be developed as well [117]. As stated in Section 4, the proposed ontologies can be merged into a common representation by matching the vocabularies and properties. This task can be quite difficult in cases where automated matching fails; therefore, it is essential to explore methods and frameworks that ease the ontology matching process, such as the Alignment platform, which offers the ability to collaboratively perform and validate the necessary matching [21]. The extraction process from different data sources can also be refined. Due to recent breakthrough involving LLMs, researchers can harness the continuous progress within this field to use more advanced models that can improve the accuracy of information extraction [100] and help in th, fine-tuning of existing pretrained models [24]. Additionally, ontologies could serve as a robust baseline for correcting NER tasks [90]. By improving the extraction process, researchers will be able to expand the size of the datasets that can be used [119] and extend the developed frameworks to different languages and broader domains within the cybersecurity landscape [30, 63], potentially resulting to more robust models with better ability to generalize [119]. Furthermore, defense mechanisms should be developed to mitigate the effect of adversarial attacks; for instance, analysts might track the source of CTI-related texts and assign provenance scores that quantify the validity of information [110, 111]. An interesting approach for defending against suspicious CTI data generated by LLMs could to detect linguistic mistakes [111] or phrases that are quite uncommon in relevant CTI sources. Ultimately, all proposed frameworks and methods should be scaled to handle large amounts of data [30, 64] and should be tested and evaluated based on realistic situations [30, 62, 120]. Therefore, collaboration between scholars and practitioners in the fieldshould be encouraged in order to bridge the gap between industry and purely academic work [30]. Conceptualization, C.B., E.K.A., A.K.A. and L.I. ; methodology, C.B., E.K.A., A.K.A. and L.I. ; formal analysis, E.K.A. and A.K.A. ; investigation, E.K.A. and A.K.A. ; data curation, E.K.A. and A.K.A. ; writing--original draft preparation, E.K.A. and A.K.A. ; writing--review and editing, C.B., E.K.A., A.K.A., L.I., R.K. and S.O. ; visualization, E.K.A. and A.K.A. ; supervision, C.B., R.K. and S.O. All authors have read and agreed to the published version of the manuscript. This research received no external funding  
Not applicable. The authors would like to acknowledge the ongoing INTERSOF project, funded by the European Union's Cybersecurity and Trust Programme under Grant Agreement no. 101145853. Acknowledgments are also extended to the reviewers, whose remarks significantly improved the quality of this work. The authors declare no conflicts of interest.