## 3 Results
### Machine Learning and Deep Learning Applications
#### 3.3.2 Other Uses of Machine Learning and Deep Learning  
[PERSON] and [PERSON] [103] sought to tackle ongoing cybersecurity issues potentially threatening Nepal by applying Random Forest (RF) and DL models to the Coburg Intrusion Detection dataset along with an ontology mapping to introduce adaptive learning into the CTI system they developed. A tool for detecting attack patterns and methods named Attack Hypothesis Generator (AHG) was developed by [PERSON] et al. [104]. AHG implements both supervised and unsupervised recommendation algorithms along with collaborative filtering. Several different algorithms were implemented: Projected Description (ProjD), Link Prediction on Projected Description (LPProjD), Projected Attack (ProjA), Collaborative Filtering (CF), and Supervised Link Prediction (SupLP). The evaluation of the tool on the ATT&CK knowledge base revealed that link prediction based on collaborative filtering with distance and topological graph features assisted the analysis more effectively regardless of the size of the examined KG. [PERSON] et al. [105] introduced RelExt, a Feed-Forward Neural Network (FFNN) used for inferring nontrivial relationships between cybersecurity-related entities based on an assessment of the similarity of their contextual vectors. Relationships that do not follow the STIX 2.0 schema are deemed meaningless. The proposed model was evaluated on a corpus of cybersecurity entities that originated from previously unseen documents and achieved 96.61% accuracy, predicting more than 700 relationships from Dark Caracal and CrossRat malware descriptions. [PERSON] et al. [106] applied multiple ML and DL algorithms in a framework they proposed for quantitatively evaluating the relevance of cybersecurity text data. A custom NER model based on Stanford's CRF Classifier and Google's Universal Sentence Encoder (USE) was used, and several classification algorithms were employed. The authors generated a cybersecurity KG consisting of over 200,000 semantic triples from the MalwareTextDB [107], the CVE repository from the NVD, and from multiple forum discussions and news feeds related to cybersecurity. The results revealed that the logistic regression classifier performed the best when assessing the significance of text data, scoring 88% in classification accuracy. [PERSON] et al. [108] applied hierarchical clustering algorithms on the MITRE KG to mine hidden patterns of cybersecurity knowledge. A dictionary of hacker groups related to  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Reference** & **Year Published** & **Brief Summary** & **Technology Used** & **Evaluation Scores** \\ \hline \multirow{4}{*}{[95]} & \multirow{4}{*}{2022} & Proposed APTKG, & \multirow{4}{*}{BiLSTM, CRF, BERT, \(\,  
cybersecurity technologies was built, to which the hierarchical clustering algorithm was applied to obtain clusters of cybersecurity technologies that shared a common hacker group feature. Experiments revealed that Peripheral Device Discovery, Data from Removable Media, and Junk Data attack methods were mostly common among different hacker groups. The authors asserted that the proposed method would be useful in predicting which technologies would be used in future cyber attacks. In another work, [PERSON] and [PERSON] [109] developed the SecKG schema. SecKG adheres to the information provided by MITRE ATT&CK and other open-source repositories. A KG that processes event logs is constructed, and a Knowledge Graph Convolutional Network (KGCN) is also employed for attack techniques prediction tasks based on each attack's neighborhood within the KG. To verify the authenticity of CTI information primarily focused on malware or cyber attacks, [PERSON] et al. [110] proposed a framework based on NLP methods for examining the provenance of retrieved entities and relationships of a relevant KG. The verification is executed according to the Uniform Resource Locator (URL), publisher, and other important features of the data.