## 3 Results
### Ontology and Knowledge Graph Construction
The authors intended to validate their proposed framework empirically in future studies. [PERSON] et al. [50] constructed an ontology for threat actor type characterization and threat actor type inference based on the Threat Agent Library (TAL). They utilized controlled vocabularies to characterize threat actors and their operations and enhanced the CTI with higher contextual information. With the proposed structure, they aimed to reduce human bias in classification and decision-making situations by encoding domain knowledge within the ontology. The efficiency of the constructed ontology was demonstrated through a use case analysis in which they attempted to automatically infer actor types. [PERSON] and [PERSON] [10] proposed an ontology-based CTI analysis leveraging the catalogued concepts of STIX [8] to provide important threat information based on reported security alerts. The effectiveness of the approach was tested in a cyber threat monitoring scenario. In another relevant study [51], the same authors developed an ontology structure for cyber risk monitoring by integrating CTI into cybersecurity solutions and aligning STIX-provided concepts. An existing ontology designed for Security Information Event Management (SIEM) was also extended. The aim was to provide a common understanding of objects, concepts, and relationships in the cybersecurity domain through descriptive logic. The proposed framework was tested on a use case involving cyber risk monitoring. The works reviewed above are related to the construction of ontologies or KGs in 2020 and 2021 and are summarized in Table 2. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Reference** & **Year Published** & **Brief Summary** & **Domain** \\ \hline
[44] & 2020 &
\begin{tabular}{c} Proposed a STIX-based network security KG ontology \\ modeling method for the analysis of the concepts of \\ network security knowledge. \\ \end{tabular} & Network Security \\ \hline
[45] & 2020 &
\begin{tabular}{c} Proposed an enriched cybersecurity KG by merging \\ information about malware behavior data. \\ \end{tabular} & CTI \\ \hline
[23] & 2020 &
\begin{tabular}{c} Proposed MALOnt, an ontology for malware threat \\ intelligence. \\ \end{tabular} & Malware Threat Intelligence \\ \hline
[46] & 2020 &
\begin{tabular}{c} Constructed a KG that stores CTI regarding various \\ medical devices. \\ \end{tabular} & Vulnerabilities of Medical Devices in IoT \\ \hline
[25] & 2021 &
\begin{tabular}{c} Proposed an ontology for XSS attacks. \\ \end{tabular} & XSS Attacks \\ \hline
[49] & 2021 &
\begin{tabular}{c} Proposed an ontology-based framework with logical \\ inference for the detection of cyber attacks. \\ \end{tabular} & Cyber Attacks and Incidents \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Works relevant to ontology or KG construction from 2020 to 2021. Records are arranged in ascending order based on their publication year and alphabetically by author name when the publication years of two or more papers coincide. [PERSON] et al. [52] designed a novel semantic-based methodology for cloud-native cyber incident response. They leveraged ontologies and KGs to facilitate the retrieval and analysis of data referring to security challenges within the cloud environment. The model was evaluated by running sample cypher queries on the Neo4j graph database based on the authors' developed graph model from various data sources and Amazon services. [PERSON] et al. [53] presented the results from a questionnaire investigating the use of standards and sharing practices of CTI. They proposed the Semi-Automated CTI (ACT) data model based on objects and relationships to address the challenges of automation. The model uses a back-end based on Apache Cassandra and Elasticsearch. An Apache TinkerPop graph engine enables graph querying with Gremlin. Object types from STIX [8], the Detection Maturity Model, the Diamond Model, and OSINT were used to populate the ontology.