## 3 Results
### Ontology and Knowledge Graph Construction  
[PERSON] et al. [31] constructed an ontology focusing on the representation of data extracted from security logs of web applications to improve the classification of attacks and the identification of related events. The ontology supports the extraction of semantic relations between computer attacks and intrusions in an Intrusion Detection System (IDS). [PERSON] et al. [32] introduced the Semantic Model of Automated IDSs (S-MAIDS), emphasizing the creation of an ontology for automated tuning, correlation, and response selection in Intrusion Detection and Response Systems (IDRS). S-MAIDS aims to address the limitations of current IDRS models by providing a more elaborate model that automatically captures the semantics of events, detectors, and responses in a common concept. The proposed ontology is formalized as a Web Ontology Language (OWL) ontology to ensure clarity and automation of the unification of existing IDRS models. A taxonomy model for the classification of CTI information exchange technologies was proposed by [PERSON] et al. [33]. The authors focused on categorizing the ontologies themselves, and used the proposed taxonomy model in the analysis of different CTI exchange ontologies. By using a taxonomy schema, the authors were able to decompose the ontologies in order to evaluate the dependency and interoperability within the CTI landscape. [PERSON] et al. [34] addressed the importance of a standardized representation of digital forensic information to enhance querying and analysis of digital evidence. The authors leveraged the Cyber Observable eXpression CybOX [35] to propose a new standard for representing and exchanging digital forensic information, named Digital Forensic Analysis eXpression (DFAX). DFAX defines actions associated with digital traces to improve the efficiency of forensic analysis, further supporting the representation of action patterns for categorization of behaviors and goals during digital investigations. [PERSON] et al. [36] developed a detection framework for Advanced Persistent Threats (APTs) by leveraging an APT ontology and reasoning tree patterns with ontology-based applicability conditions to systematically represent APT detection models. The ontol  
Figure 2: Amount of produced works related to CTI-related ontologies and KGs from 2013 to 2023. The significant number of conducted studies during the ongoing decade highlights the increasing popularity of semantic web technologies within the cybersecurity domain. ogy language they used was an extension of Resource Description Framework (RDFs), with additional features to promote learning and evidence representation. [PERSON] [37] described the process of creating a CTI ontology based on the Lockheed Martin kill chain model. The component and properties as well as the ontology itself were all defined according to the OWL standard. [PERSON] and [PERSON] [38] introduced an ontology-based framework for Internet of Things (IoT) security analytics, aiming to combat APTs by aligning attack kill chain phases with network semantics. The ontology creation process involved the extension of existing CTI ontologies with new concepts and their alignment with a novel IoT ontology by leveraging Protege software for ontology development and the Pellet engine for inference and consistency checking purposes. During the ontology engineering phase, the authors introduced new concepts and designed meta-ontologies for IoT, security controls, and Common Vulnerabilities and Exposures (CVE). In addition, concepts from existing ontologies were aligned and consistency tests were performed to ensure completeness. STIX-Analyzer, a threat analysis framework based on OWL, was created by [PERSON] et al. [39]. It specializes in formal specification, semantic reasoning, and contextual analysis for the derivation of network-associated threats from large volumes of shared data.