## 3 Results
### Ontology and Knowledge Graph Construction
The constructed model was evaluated by assessing its usefulness, expressiveness, consistency, semantic agreement, and reasoning capability. [PERSON] and [PERSON] [54] focused on the dynamic and automated identification of ongoing attacks and evaluation of the associated risks. An IoT stack ontology was built based on an existing taxonomy of the smart home domain to encapsulate vulnerabilities, attack attributions, impact evaluations, and mitigation strategies within a smart home environment. The authors also proposed a Dynamic Risk Assessment Framework (DRAF) that leveraged the built ontology and comprised various risk modeling steps. The framework was validated in smart home testbeds spanning multiple European countries, allowing for dynamic adaptation of the risk weights used by the receptors of the model through decision-making feedback. The results revealed strong potential for automating the decision-making process while ensuring a balance between security and privacy concerns. [PERSON] et al. [26] proposed the construction of a cybersecurity ontology for storing valuable information for the assessment of system security risks. The core elements of the ontology represented devices, networks, and human actors. The entities were filled using unstructured security-related data (reports, policies, and organization-specific cyber-information). The second layer of the ontology consisted of modeling information related to vulnerabilities, threats, exploits, and threat agents stemming from public resources. The authors used the ontology they constructed for Common Vulnerability Scoring System (CVSS) score prediction by applying logistic regression, and eventually discovered knowledge gaps that were later included in the National Vulnerability Database (NVD) [55]. A MITRE ATT&CK Enterprise Matrix-based ontology using OWL standards was built by [PERSON] et al. [56]. CTI reports were parsed for extraction of essential knowledge, which was subsequently inserted into the ontology. The information extraction process was automated. Evaluation showed that the proposed rule-based information extraction method surpassed the performance of Neural Network (NN)-based methods in terms of precision. [PERSON] et al. [57] proposed AttackKG for the automated extraction of attack behavior graphs from CTI reports. The performance of AttackKG was evaluated against 7373 procedures from 179 techniques stemming from MITRE ATT&CK and 1515 CTI reports collected from different CTI sources. AttackKG outperformed other existing frameworks such as EXTRACTOR [58] and TTPDrill [59] by identifying 28.272 attack techniques with 8393 Indicators of Compromise (IoC), achieving F1-scores equal to 0.887, 0.896, and 0.789 on attack-relevant entities, dependencies, and technique identification, respectively. \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Reference** & **Year Published** & **Brief Summary** & **Domain** \\ \hline
[50] & 2021 & Presented an ontological approach for the automatic inference of threat actor types based on a standardized set of attributes. & Threat Actor \\ \hline
[10] & 2021 & Proposed a STIX-based ontological reasoning approach for potential cyber threats & CTI \\ \hline
[51] & 2021 & Constructed an ontology for cyber risk monitoring & Cyber Risk Monitoring \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._[PERSON] et al. [60] proposed TINKER, a novel framework for capturing cyber threat information through a semi-supervised approach. TINKER transforms multimodal CTI into a structured format while preserving the context of the information. It leverages ontologies and information extraction models to capture CTI and integrates different data sources by structuring them using CTI KGs. The use of CTI-KG was demonstrated in two use cases involving malware family prediction and attack target inference. [PERSON] and [PERSON] [61] advocated for the use of graph databases to monitor network logs in near-real-time by implementing a graph database easily queryable with tools such as Neo4j.