## 3 Results
### Ontology and Knowledge Graph Construction
The ontology creation process required a broad understanding of the applied environment and technologies along with the extension of threat sources with anomalies captured by physical and logical sensors. Standardized methodologies such as the OQuaRE framework [67] were used to evaluate the quality of the ontology to ensure its conformance to both functional and non-functional requirements. The OWL-based ontology integrates CTI and risk-management information and relates concepts through SWRL rules to improve system threat and risk assessment. [PERSON] et al. [24] proposed an event-based threat intelligence ontology for threat detection and response scenarios. The ontology uses the semantics of events to reorganize the elements of threat intelligence and simplifies the expression hierarchy, further improving the degree of structure. Additionally, the ontology combines the skeleton method with Formal Concept Analysis to ensure semi-automated construction and greater efficiency and formalization to assist in automated correlation analysis. The ontology was evaluated and validated through an example of specific instance data. [PERSON] et al. [68] introduced the Attack and Defense Analysis of the Cybersecurity Ontology (ADACO) model, constructed by integrating data originating from multiple cybersecurity databases. Threat scenarios within the Threat Evolution Prediction Algorithm (TEPA) are represented as KGs, combining structural and textual features of entities for enhanced performance. TEPA enables the automatic detection of threats at device nodes and the correlation and mapping of multi-source information. The model also allows for the dynamic inference of threat evolution process, rendering the algorithm capable of making threat predictions. Table 4 summarizes the works related to ontology and KGs construction that were published in 2023. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Reference** & **Year Published** & **Brief Summary** & **Domain** \\ \hline
[62] & 2023 &
\begin{tabular}{c} Constructed a Unified Ontology encompassing APT techniques, \\ weaknesses, vulnerabilities, and defense countermeasures. \\ \end{tabular} & APT \\ \hline
[63] & 2023 &
\begin{tabular}{c} Presented a security ontology for cloud, edge and on-premises \\ environments and used it to determine the most appropriate security \\ mechanisms. \\ \end{tabular} & CTI \\ \hline
[64] & 2023 &
\begin{tabular}{c} Proposed OBSQL, an ontology for detecting blind SQL weaknesses. \\ \end{tabular} & Blind SQL Injection \\ \hline
[65] & 2023 &
\begin{tabular}{c} Defined an ontology for the description of different types of anomalies and \\ proposed an approach that merges the ontology with previously developed \\ models for CTI. \\ \end{tabular} & Risk Management \\ \hline
[24] & 2023 &
\begin{tabular}{c} Proposed an event-based threat intelligence ontology for threat detection \\ and response scenarios. \\ \end{tabular} & CTI \\ \hline
[68] & 2023 &
\begin{tabular}{c} Introduced the ADACO model, constructed by integrating data from \\ multiple cybersecurity databases. \\ \end{tabular} & CTI \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Works relevant to ontology or KG construction published in 2023. Records are arranged in an ascending alphabetical order.