## 4 Discussion  
Our review identifies a noticeable imbalance between research focused exclusively on constructing CTI-based ontologies and KGs compared to studies exploring their utilization. While the number of the former works significantly surpassed the latter, this finding is not surprising. The vastness of the cyber threat domain requires more effort to map the existing knowledge into a formal representation; therefore, attention is primarily oriented \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Reference** & **Year Published** & **Brief Summary** & **Technology Used** & **Evaluation Scores** \\ \hline \multirow{10}{*}{[112]} & \multirow{6}{*}{2021} & \multicolumn{2}{c}{Modelled APT} & \multirow{6}{*}{AML} & \multirow{6}{*}{Before adversarial attacks: Accuracy \(=72\%\) (\(79\%\))} \\  & & & & \\  & & & & After adversarial attacks: Accuracy \(=22\%\) (\(25\%\)) \\ \cline{3-5}  & & & & \\ \cline{3-5}  & & & & \\ \hline \multirow{10}{*}{[113]} & \multirow{6}{*}{2021} & \multicolumn{2}{c}{Combined cyber} & \multirow{6}{*}{RF, GBoost} & \multirow{6}{*}{Accuracy \(=80\%\)} \\  & & & & \\ \cline{3-5}  & & & & \\ \cline{3-5}  & & & & \\ \cline{3-5}  & & & & \\ \hline \multirow{10}{*}{[114]} & \multirow{6}{*}{2022} & \multicolumn{2}{c}{Proposed a GNN} & \multicolumn{2}{c}{Entity Classification (Link Prediction)} \\  & & & & MR \(=201\) (\(223\)) \\ \cline{3-5}  & & & & MRR \(=0.316\) (\(0.345\)) \\ \cline{3-5}  & & & & & Hits@1 \(=0.232\) (\(0.267\)) \\ \cline{3-5}  & & & & Hits@3 \(=0.369\) (\(0.394\)) \\ \cline{3-5}  & & & & Hits@10 \(=0.607\) (\(0.625\)) \\ \hline \multirow{10}{*}{[115]} & \multirow{6}{*}{2022} & \multicolumn{2}{c}{Proposed a Ciap} & \multirow{6}{*}{Link prediction, NN} & \multirow{6}{*}{Macro F1-score \(=74.87\%\)} \\  & & & & \\ \cline{3-5}  & & & & \\ \cline{3-5}  & & & & \\ \cline{3-5}  & & & & \\ \hline \multirow{10}{*}{[116]} & \multirow{6}{*}{2023} & \multicolumn{2}{c}{Examined the} & \multirow{6}{*}{RL, CQL} & \multirow{6}{*}{Hits@10 \(>65\%\) for different malware families} \\  & & & & \\ \cline{3-5}  & & & & \\ \cline{3-5}  & & & & \\ \hline \multirow{10}{*}{[117]} & \multirow{6}{*}{2023} & \multicolumn{2}{c}{Proposed a CTI} & \multirow{6}{*}{Link prediction} & \multirow{6}{*}{-} \\  & & & & \\ \cline{3-5}  & & & & \\ \cline{3-5}  & & & & \\ \cline{3-5}  & & & & \\ \cline{3-5}  & & & & \\ \hline \multirow{10}{*}{[118]} & \multirow{6}{*}{2024} & \multicolumn{2}{c}{Proposed EGNN} & \multirow{6}{*}{GNN} & \multirow{6}{*}{hit@10: 0.532, 0.548, 0.324, 0.958} \\  & & & & & \\ \cline{3-5}  & & & & & \\ \cline{3-5}  & & & & & \\ \cline{3-5}  & & & & \\ \cline{3-5}  & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Works related to various ML and DL applications on ontologies/KGs other than entity and relationship extraction. Records are arranged in ascending chronological order based on publication year and alphabetically by author name when the publication years of two or more papers coincide (continuation of Table 7). towards building novel ontologies. Despite observing a trend towards specialization over time (Tables 1-4), where ontologies and KGs focusing on specific subdomains such as malware [23], medical devices within IoT environments [46], cloud-based platforms [52, 63], and smart-homes [54] are developed, there are other works that continue to develop more general CTI ontologies, highlighting the large amount of knowledge yet to be encoded. A rise in studies that move beyond building knowledge bases and focus on creating functional frameworks capable of managing real-time tasks [24, 28, 41, 61] is also observed. In addition, the constructed frameworks can be benefited from the advanced inference methods proposed in works such as [PERSON] and [PERSON] [71], [PERSON] and [PERSON] [38], and [PERSON] et al. [83], resulting in mechanisms capable of handling fuzzy and probabilistic knowledge [76].