## 3 Results
### Machine Learning and Deep Learning Applications
#### 3.3.1 Deep Learning Methods in Data Extraction  
[PERSON] et al. [59] introduced TTPDrill, a tool for the automated extraction of threat actions and TTP construction from unstructured threat reports. They developed a novel ontology-based approach to map these actions to known attack patterns and techniques, enabling comprehensive understanding of the attack cycle. They utilized a text mining approach combining Natural Language Processing (NLP) and IR techniques to extract threat actions based on semantic relationships rather than syntax, enhancing the accuracy of threat action extraction. TTPDrill's use of a threat-action ontology demonstrated precise classification, achieving 84% precision and 82% recall. [PERSON] et al. [27] created a knowledge extraction pipeline for obtaining important knowledge from After-Action Reports (AARs). The pipeline is based on a custom Named Entity Recognition (NER) tool called Malware Entity Extractor (MEE). MEE utilizes Conditional Random Fields (CRF), Gibbs sampling, and Relationship Extractor (RelExt), a DL framework for predicting relationships between the extracted entities. After extraction of \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Reference** & **Year Published** & **Brief Summary** & **Tools** \\ \hline
[81] & 2019 & Demonstrated the efficiency of semantic technology within CTI use cases by using the STIX representation and the Maltego tool. & Semantics \\ \hline
[83] & 2019 & Introduced a SIEM-based KG and MalRank, a graph-based inference algorithm for maliciousness score estimation. & Graph inference algorithm \\ \hline
[66] & 2019 & Developed a model relying on ontologies to enhance the risk management capabilities of organizations. & OWL, Reasoning \\ \hline
[85] & 2020 & Developed an ontology-driven CFRaaS model for digital evidence gathering. & Description logic \\ \hline
[86] & 2021 & Proposed an APT attacks recommendation tool for attack scenario analysis and inference. & Similarity measures \\ \hline
[87] & 2022 & Proposed OnToRisk, an ontology-driven risk management analysis method. & Protege, OWL \\ \hline
[88] & 2023 & Proposed the KGaaS framework for the generation and maintenance of domain-specific KGs. & Cypher, Natural Language, RDF \\ \hline
[89] & 2023 & Developed a novel framework for cyber insurance policy suggestion. & RDF, SPARQL, IR, AI \\ \hline \hline \end{tabular}
\end{table} 
Table 5: _Cont._relevant knowledge, an AAR ontology was constructed. The authors demonstrated the efficiency of their method by comparing the quality of knowledge obtained from different AARs based on queries executed on fused KGs and non-fused KGs. A novel method for improving the NER process was proposed by [PERSON] et al [90]. Their model comprised a Bidirectional Long Short-Term Memory (BiLSTM) layer for capturing sentence-level features and a CRF layer for labeling sentence sequences. A CTI ontology was used for corrections during the NER task. The model was tested on a dataset of unstructured text data, achieving an F1-score of 85.27%. Another framework for the automation of open-source CTI management was developed by [PERSON] et al. in [91]. SECURITYKG utilizes a back-end system for data collection, knowledge extraction, and KG construction. A security ontology and NLP tools are leveraged for extraction of entities and relationships from various openly available CTI reports. The functionalities of the proposed framework are accessed through a UI. Open-CyKG, a system for obtaining information from APT reports and using them for a KG construction, was created by [PERSON] and [PERSON] [92]. The proposed system employs an attention-based Open Information Extraction architecture based on Gated Recurrent Unit (GRU) networks for the extraction of relation triples. An NER model is used to automatically annotate cybersecurity entities. The constructed KG can be used by analysts to retrieve vital information.