## 3 Results
### Utilization of Ontologies and Knowledge Graphs
The authors concluded that CTI knowledge could be sufficiently captured by STIX, Maltego, and threat hunting and logs, demonstrating that semantic technology was more advantageous for CTI than legacy relation databases. An SIEM-based KG for relationship modeling among observed entities in proxy and DNS logs was introduced by [PERSON] et al. in [83]. In addition, the authors proposed agraph algorithm for the estimation of maliciousness score called MalRank based on the associations a node had with other entities of the KG. The performance of MalRank was evaluated on a SIEM-based KG constructed from global enterprises' SIEMs data. MalRank scored 96% in AUC, outperforming Belief Propagation [84] in malicious Internet Protocols (IPs) and domain names detection. [PERSON] and [PERSON] [66] developed a model that integrated risk intelligence along with CTI domains to demonstrate the advantages that ontologies offer in formal representation of concepts and relationships. The model consisted of different features, including data, business logic, services/applications, and visualization, and allowed for dynamic assessment of the security risks based on almost-real-time threat data to potentially refine its risk management capabilities. A Cloud Forensic Readiness as a Service (CFRaaS) ontology-driven model aiming to gather digital evidence was proposed by [PERSON] et al. [85]. The ontological approach enables the classification and graphical visualization of different types of evidence in cloud-deployable models, resulting in a simplification of the semantics between different types of evidence. [PERSON] et al. [86] contributed with a security requirements recommendation tool for ATP attacks, using the Case-Based Problem Domain Ontology designed explicitly for APT attacks. The proposed tool analyzes an attack scenario and infers adjacent attacks according to similarity scores. [PERSON] and [PERSON] [87] proposed OnToRisk, an automated cyber risk identification method integrated with information from different sources. OnToRisk relies on formal ontology concepts and relationships for analyzing organizational situations and providing suggestions for risk management. The proposed method was applied to a case study involving risk identification from software vulnerabilities, demonstrating its usefulness. A domain-agnostic KG as a Service (KGaaS) framework for generating and maintaining domain-specific KGs for intelligent agent apps was proposed by [PERSON] et al. [88]. The authors presented a reference architecture comprising graph infrastructure tools and User Interfaces (UI) for generating large KGs within the domains of healthcare, power grids, and manufacturing. Data importers and semantic scripts are included within a customized knowledge curation pipeline to ensure rapid querying methods for cyber attack detection and defense mechanisms. The works utilizing CTI ontologies or KGs in various scenarios are summarized in Table 5. \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Reference** & **Year Published** & **Brief Summary** & **Tools** \\ \hline
[69] & 2014 & Proposed an RDF metadata generation mechanism for cybersecurity information management. & RDF metadata generation \\ \hline
[71] & 2015 & Developed a reasoning mechanism for query execution when addressing different cyber situations. & Reasoning, querying \\ \hline
[9] & 2016 & Explored the overlap between different information exchange standards using ontologies and library science techniques. & Library science methods \\ \hline
[73] & 2016 & Proposed “net vulnerability”, a metric for measuring security risks of networked systems. & Novel metric \\ \hline
[75] & 2017 & Leveraged an ontology to gain knowledge about an IoT environment. & OWL \\ \hline
[76] & 2018 & Presented a novel description logic-based formalism to model fuzzy and uncertain cyber-related information. & Fuzzy logic \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Works strictly demonstrating the utilization of CTI ontologies or KGs for different purposes.