IRSKG: Unified Intrusion Response System Knowledge Graph Ontology for Cyber Defense

Benjamin A. Blakely; Damodar Panigrahi; Shaswata Mitra; Subash Neupane; Sudip Mittal

REVIEW 4 major objections 6 minor 20 references

IRSKG: Unified Intrusion Response System Knowledge Graph Ontology for Cyber Defense

T0 review · 4 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes IRSKG, a unified property-graph ontology that represents enterprise system logs, Rules of Engagement, and ML model input data in one schema, claiming this streamlines onboarding of new enterprise systems for autonomous…

desk verdict A plausible but unvalidated ontology for intrusion response data; the design is worth a look, the effectiveness claims are not. read the letter →

arxiv 2411.15672 v1 pith:OULA2RKG submitted 2024-11-23 cs.CR cs.AIcs.LG

Damodar Panigrahi , Shaswata Mitra , Subash Neupane , Sudip Mittal , Benjamin A. Blakely This is my paper · ORCID

classification cs.CRcs.AIcs.LG

keywords IntrusionResponseSystemKnowledgeGraphOntologyCyberDefenseAutonomousIntelligentCyber-defenseAgentRulesofEngagementNeuralNetworkProperty

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes IRSKG, a unified ontology for Intrusion Response Systems (IRS) that represents enterprise system logs, administrator-defined Rules of Engagement, and ML model input data in a single property-graph schema. The claim is that this unification streamlines onboarding of new enterprise systems as data sources for Autonomous Intelligent Cyber-defense Agents, cutting preprocessing complexity and response time. The authors argue that because logs, rules, and model inputs share one graph, machine learning models can be trained directly on the graph and a compromised system can be restored to its desired state autonomously while keeping decisions explainable. A case study on a network infrastructure management system implements the schema in Neo4J using Graylog entries and a router-denial rule, and transforms the graph into GNN training input.

What carries the argument

The central mechanism is the IRSKG ontology, a property-graph schema where a graph is $G=(V,E)$, each vertex is $V_i=\{L(V_i),P(V_i)\}$ with a label and property dictionary, and each edge is $E_{i,j}=\{L(E_{i,j}),P(E_{i,j})\}$. A rule is written as $R_i=\{V_a(R_i),E(R_i),V_b(R_i)\}$, encoding 'who can do what on which resource' with a constraint property such as 'deny'. To produce ML model input, vertex counts are set as $P_{\text{count}}(V_i)=\deg(V_i)$, edge counts as $P_{\text{count}}(E_{i,j})=P_{\text{count}}(V_i)+P_{\text{count}}(V_j)$, and a deny constraint is translated into a large negative count (e.g., $-1000000$) so a GNN learns to ignore the forbidden edge. This machinery turns heterogeneous logs and rules into a single graph that an ML model can consume directly.

What would settle it

Inspect a real enterprise system that plays multiple roles, such as a server that is both a web front end and a database backend, and attempt to represent its logs and Rules of Engagement under IRSKG's rule that each enterprise system has precisely one template shared by all instances. If the single template cannot express both roles without adding ad hoc properties or duplicating the system as two instances, the unification claim fails for that case. Alternatively, measure integration effort with and without IRSKG on a fixed set of heterogeneous logs and check whether preprocessing steps and response latency actually decrease.

Watch

Extended reading notes

Core claim

The central discovery is the IRSKG schema itself: a Labeled Property Graph ontology that captures the three data senses an IRS needs—enterprise system logs, Rules of Engagement (RoEs), and response computation model input—under one set of graph notations. The paper claims this is the first unified knowledge graph ontology for IRS systems, and it demonstrates the schema by representing Graylog network logs, a deny rule on a router, and the resulting graph neural network input in Neo4J. The intended consequence is faster onboarding, brisker rules management, and faster input transformations for continuously training response models, all while remaining adaptable to an evolving threat landscape.

Load-bearing premise

The claim rests on the assumption that a single unified graph schema can represent every enterprise system's logs, rules, and model inputs without loss, and specifically that each enterprise system can be captured by exactly one template shared by all its instances; if real systems need multiple templates or lose information under unification, the promised reduction in preprocessing complexity does not follow.

Editorial extensions

If this is right

New enterprise systems can be onboarded by mapping their logs to the IRSKG graph schema, reducing the preprocessing work currently needed for each distinct system schema.
Rules of Engagement and live system logs live in the same graph, so an IRS constrained-action component can check a proposed response against the rules directly in the graph structure.
ML model input can be derived from the graph through simple count transformations, making it straightforward to generate training data for graph-based models such as GNNs.
Because the schema is extensible to additional structures like chat conversation logs and monitoring information, it can adapt as new data sources and threat patterns emerge.
A standardized representation of IRS data could ease collaborative information sharing across organizations and help meet regulatory audit requirements for incident detection and reporting.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Beyond the paper's explicit claims, if IRSKG matures into a shared interchange format, different AICA components from different vendors could exchange logs, rules, and model inputs without bespoke adapters—an outcome the paper gestures at but does not test.
The single-template assumption (each enterprise system has exactly one template, shared by all its instances) is likely the first point where real-world heterogeneity will stress the schema; a system playing multiple roles, such as a server acting as both web front end and database, may need template composition rather than a single template.
The count-based transformation demonstrated for GNN input is minimal; richer features such as time windows, protocol types, or port numbers could be added as vertex and edge properties without changing the schema, but the paper does not explore whether such features improve response decisions.
The strongest test of the framework would be training an actual GNN on IRSKG-transformed data and measuring whether response decisions are faster or more accurate than existing pipelines; the paper demonstrates the representation, not the trained model's performance.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short take: this is a design proposal, not an evaluation. It assembles a labeled-property-graph schema for IRS data and demonstrates it on a small Graylog/Neo4J example. The central claims about streamlining onboarding and reducing response time are asserted, not measured. The schema itself is a real contribution, albeit an incremental one, and the case study is concrete enough to be useful to someone building a similar system.

What's new: a unified graph ontology that captures system logs, RoEs, and GNN input features in one schema. The rule template mechanism (meta-template Rt, enterprise templates Rtk) is a reasonable way to enforce consistency across rule sets. The transformation of constraint rules into a large negative edge weight for GNN training is a neat trick, though it's a standard way to encode 'must not traverse' in a graph.

What it does well: the exposition is clear about the notation and the PG vs RDF choice. The case study is small but reproducible in principle; the Neo4J listings are helpful. The paper is honest about the prototype nature and lists future work.

Soft spots, in order of importance:

1. The load-bearing assumption in Section III-B4: each enterprise system has exactly one template, and all instances use it. Real enterprises have heterogeneous logs per system (syslog, Windows Event Log, app logs, container logs), so this assumption is likely to break in practice. If multiple templates or custom mappings are needed, IRSKG doesn't streamline onboarding; it just relabels the existing preprocessing problem as template authoring. The case study does not test this at all.

2. The effectiveness claims are unsupported. No measurements of onboarding time, response time, or ML training quality. No comparison to a baseline (raw logs, flat JSON, existing ontologies like UCO/STIX). The paper's own conclusion says 'faster onboarding' but there is no evidence.

3. Internal inconsistencies in the case study. Equation 4b says edge count equals sum of vertex counts, but Listing 5 stores count=2 while vertex counts are 2 each and the text says 4. Listing 4 stores count=2 but text says Pcount(Vi)=4. Equation 5 uses -1000000 but the preceding text writes -100000. These are minor if the reader squints, but they undermine the reproducibility claim. Also, the constraint transformation is described as applying to the edge count, but Listing 6 puts the -1000000 on the vertex NEP2, not the edge; Listing 7 then assigns it to the edge. Confusing.

4. The 'first ontology for IRS' claim is plausible, but they don't compare with UCO or STIX, which are the nearest standards. A paragraph acknowledging why those don't fit would strengthen the novelty argument.

Bottom line: this is a reasonable design sketch for an IRS knowledge graph. The schema is coherent enough to be reused or extended. But the paper overclaims by saying it 'streamlines' and 'allows ML models to train effectively' without any evaluation. A serious referee would send it back for either (a) a validation study that tests the one-template assumption on real enterprise systems, or (b) a clear scope reduction to 'a schema proposal with a toy demonstration.'

Who this is for: readers working on ontology design for cyber defense, or on AICA/IRS agent integration. It's not going to change anyone's research direction, but it could be a useful starting point for a tool paper.

Recommendation: accept for peer review in a workshop or system-oriented venue, but require the authors to either add measurements or cut the effectiveness claims. I'd send it to a second referee, not desk-reject it.

Referee Report

4 major / 6 minor

Summary. The paper proposes IRSKG, a Property Graph-based ontology schema intended to unify three kinds of data used by an Intrusion Response System (IRS): enterprise system logs, administrator-defined Rules of Engagement (RoEs), and input data for IRS machine-learning models. The schema is defined with graph-theoretic notation and demonstrated on a Network Infrastructure Management System case study using Graylog log entries, Neo4J artifacts, and a planned Graph Neural Network input representation. The abstract and introduction make broad claims that IRSKG streamlines onboarding of new systems, enables effective ML training, and supports autonomous recovery with explainability, and the paper states it is the first unified IRS knowledge graph ontology.

Significance. If the central claims were established, IRSKG would be a useful contribution: a single schema for heterogeneous sources feeding an IRS has clear value for reducing preprocessing and enabling shared threat-response representations. The paper gives a reasonable initial ontology design and explicitly discusses the choice of Property Graphs over RDF. It also avoids circularity: the ontology is defined rather than fitted to data, and the only hand-set number is the large negative constraint weight. However, the significance is currently limited because the empirical claims in the abstract are not supported by measurements: there is no onboarding comparison, no ML training result, and no recovery or explainability demonstration, and the case study contains internal inconsistencies in the computed model-input features.

major comments (4)

[Section IV-C, Eq. (4), Listings 4-5] The computational-model input demonstration is internally inconsistent. Equation (4b) defines Pcount(E_i,j) as Pcount(V_i) + Pcount(V_j); the text says Pcount(V_i)=4 for each vertex and Pcount(E_1,2)=4, but Listing 4 stores count=2 for each vertex and Listing 5 stores count=2 for the edge. If the vertex counts are 4, Eq. (4b) would give an edge count of 8, not 4 or 2. Since this section is the only evidence for the claim that IRSKG allows ML models to train effectively, the contradiction is load-bearing and must be resolved.
[Section III-B4 and Abstract] The central claim that IRSKG 'streamlines the onboarding of new enterprise systems' rests on the unvalidated assumption stated in Section III-B4: 'Each enterprise system has precisely one enterprise system template. All instance of enterprise system uses the same system template.' Many real systems emit multiple log stream types or use different templates in different subsystems, and the paper gives no procedure or evidence for folding those cases into a single template. Without a comparison of onboarding effort, or at least an explicit treatment of multi-template systems, the claimed reduction in preprocessing complexity is not established.
[Abstract and Section IV] The abstract claims that IRSKG 'allows machine learning models to train effectively and recover a compromised system to its desired state autonomously with explainability,' but the case study in Section IV stops at graph storage and feature assignment. No GNN is trained, no recovery scenario is executed, and no explainability output is produced. These claims should either be supported by experiments or substantially weakened to claims about the representational schema.
[Section III-C, Eq. (5), Listings 6-7] The negative-constraint transformation is applied to inconsistent graph elements. Equation (5) assigns Pcount(V_i) = -1000000 to the vertex whose label is 'any', but Listing 6 sets the count for the router vertex NEP2, while Listing 7 and the final text paragraph assign the -1000000 value to the edge COMM2. The rule, the vertex, and the edge should be aligned in the formal equation and in the implementation listings.

minor comments (6)

[Section III-B2 heading] The heading 'Rule Symantic' should be 'Rule Semantics'.
[Listings 5 and 7] The Neo4J JSON objects contain two 'start' keys in the relationship representation; the second key should be 'end' if the listing is meant to show a valid start-end relationship.
[Listing 1 caption] The caption says the source is 192.168.0.100, but the raw entries show 192.168.1.100; the address should be consistent.
[Equations (1c) and (2d)] Equations (1c) and (2d) contain unmatched closing parentheses after the property-set brace; the notation should be cleaned up.
[Section IV-C text and Listing 4 caption] The statement that the IPs 'appear twice' in Listing 1 is ambiguous and conflicts with the surrounding text that they each appear in four endpoint roles; this should be clarified once the count semantics are fixed.
[Section II-B and IV] The paper uses 'Y ARA' instead of 'YARA' in the file-format list, and 'revolutionary' in the Introduction is promotional language that should be replaced with a neutral characterization.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: IRSKG is an ontology-proposal paper whose graph transformations are defined from raw logs and an explicitly labeled hyper-parameter, not derived from fitted inputs or self-cited uniqueness theorems.

full rationale

IRSKG is a schema-definition paper rather than a derivation paper. Its central objects (the enterprise log graph, the rule graph, and the GNN input graph) are constructed from the same raw Graylog entries and rule R1, and the only hand-set quantity is the -1000000 constraint weight, which the paper explicitly calls a data model hyper-parameter set at design time rather than a fitted or predicted value. No equation in Section III derives a predicted outcome from a fitted input, and no uniqueness theorem is invoked to force a choice. The self-citations (references [3] and [4]) are used only as background motivation for why IRS systems lag behind threats and why GNNs are a reasonable representation choice; neither citation supplies a load-bearing premise of the ontology itself. The strongest concerns in the paper, namely the one-template-per-system assumption in Section III-B4 and the inconsistency between the Section IV-C count text and Listings 4-5, are validity or reproducibility risks rather than circular reductions, because the ontology would still be exactly what it is even if those issues were corrected. Accordingly, no specific circular step is identified and the circularity score is 0.

Assumptions & free parameters 1 free parameters · 4 assumptions · 1 invented entities

The paper's central claim rests on one hand-set hyperparameter and several unverified domain assumptions about schema generality and GNN behavior. These assumptions are not tested against real enterprise systems or alternative representations.

free parameters (1)

large negative edge weight = -1000000
Used to encode 'deny' constraints in GNN input; set by hand at design time (Section III-C, Eq. 5), not derived from data.

assumptions (4)

standard math Property graph model as defined by the PG specification
Basis for IRSKG schema; standard background knowledge in graph databases.
domain assumption A single meta-template can govern all enterprise system rule templates
Section III-B4 assumes all rules comply with one meta-template, but real enterprises have heterogeneous schemas and may need multiple templates.
domain assumption Large negative edge weights cause a GNN to effectively ignore the edge
Section III-C, Eq. 5, states this without GNN training or validation; it may not hold for all architectures, normalizations, or feature scales.
domain assumption Unified graph representation reduces pre-processing complexity and response time
Central motivation in the Introduction, but no comparative evaluation or quantitative evidence is provided.

invented entities (1)

IRSKG ontology (including meta-template Rt and enterprise templates Rtk)
purpose: Unified representation of enterprise logs, RoEs, and ML model inputs
The ontology is the paper's contribution; it is only demonstrated on a toy case study with no external validation or deployment.

how reviews work

0 comments

Cite this review

Pith. "Pith review of IRSKG: Unified Intrusion Response System Knowledge Graph Ontology for Cyber Defense." pith.science (2026). https://pith.science/paper/OULA2RKG

@misc{pith2026241115672,
  author       = {Pith},
  title        = {Pith review of: IRSKG: Unified Intrusion Response System Knowledge Graph Ontology for Cyber Defense},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OULA2RKG}},
  note         = {Machine review of arXiv:2411.15672}
}

read the original abstract

Cyberattacks are becoming increasingly difficult to detect and prevent due to their sophistication. In response, Autonomous Intelligent Cyber-defense Agents (AICAs) are emerging as crucial solutions. One prominent AICA agent is the Intrusion Response System (IRS), which is critical for mitigating threats after detection. IRS uses several Tactics, Techniques, and Procedures (TTPs) to mitigate attacks and restore the infrastructure to normal operations. Continuous monitoring of the enterprise infrastructure is an essential TTP the IRS uses. However, each system serves different purposes to meet operational needs. Integrating these disparate sources for continuous monitoring increases pre-processing complexity and limits automation, eventually prolonging critical response time for attackers to exploit. We propose a unified IRS Knowledge Graph ontology (IRSKG) that streamlines the onboarding of new enterprise systems as a source for the AICAs. Our ontology can capture system monitoring logs and supplemental data, such as a rules repository containing the administrator-defined policies to dictate the IRS responses. Besides, our ontology permits us to incorporate dynamic changes to adapt to the evolving cyber-threat landscape. This robust yet concise design allows machine learning models to train effectively and recover a compromised system to its desired state autonomously with explainability.

Figures

Figures reproduced from arXiv: 2411.15672 by the authors.

**Figure 2.** Graph model built using Property Graph (PG), also [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** AICA Prototype - Self Adaptive-Autonomic Com [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: Illustration of IRSKG: A Graph-based model that represents enterprise system information such as System logs, [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 6.** Figure 6: A Network Management Enterprise System IRSKG [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]

**Figure 5.** Figure 5: A generalized Network System IRSKG: represents [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]

**Figure 7.** Figure 7: IRSKG for Network Management System constraint [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

**Figure 8.** Figure 8: IRSKG GNN computational model input data [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

20 extracted references · 18 canonical work pages

[1]

Autonomous intelligent cyber defense agent (aica)

A. Kott, “Autonomous intelligent cyber defense agent (aica).”

work page
[2]

Adaptation techniques for intrusion detection and intrusion response systems,

D. J. Ragsdale, C. Carver, J. W. Humphries, and U. W. Pooch, “Adaptation techniques for intrusion detection and intrusion response systems,” in Smc 2000 conference proceedings. 2000 ieee international conference on systems, man and cybernetics. ’cybernetics evolving to systems, humans, organizations, and their complex interactions’(cat. no. 0, vol. 4. IEE...

work page 2000
[3]

irs-partition: An intrusion response system utilizing deep q-networks and system partitions,

V . Cardellini, E. Casalicchio, S. Iannucci, M. Lucantonio, S. Mittal, D. Panigrahi, and A. Silvi, “irs-partition: An intrusion response system utilizing deep q-networks and system partitions,” SoftwareX, vol. 19, p. 101120, 2022

work page 2022
[4]

Use of graph neural networks in aiding defensive cyber operations,

S. Mitra, T. Chakraborty, S. Neupane, A. Piplai, and S. Mittal, “Use of graph neural networks in aiding defensive cyber operations,” arXiv preprint arXiv:2401.05680, 2024

arXiv 2024
[5]

The world of graph databases from an industry perspective,

Y . Tian, “The world of graph databases from an industry perspective,” ACM SIGMOD Record , vol. 51, no. 4, pp. 60–67, 2023

work page 2023
[6]

Cybersecurity vulnerability management: A conceptual ontol- ogy and cyber intelligence alert system,

R. Syed, “Cybersecurity vulnerability management: A conceptual ontol- ogy and cyber intelligence alert system,” Information & Management , vol. 57, no. 6, p. 103334, 2020

2020
[7]

A cyber security ontology for smart city,

T. Qamar and N. Z. Bawany, “A cyber security ontology for smart city,” International Journal on Information Technologies & Security , vol. 12, no. 3, pp. 63–74, 2020

work page 2020
[8]

An ontology-based security risk management model for information systems,

O. T. Arogundade, A. Abayomi-Alli, and S. Misra, “An ontology-based security risk management model for information systems,” Arabian Journal for Science and Engineering , vol. 45, no. 8, pp. 6183–6198, 2020

work page 2020

Show all 20 references

[9]

Combating fake cyber threat intelligence using provenance in cybersecurity knowledge graphs,

S. Mitra, A. Piplai, S. Mittal, and A. Joshi, “Combating fake cyber threat intelligence using provenance in cybersecurity knowledge graphs,” in 2021 IEEE International Conference on Big Data (Big Data) . IEEE, 2021, pp. 3316–3323

2021
[10]

Graph Database Fundamentals,

T. Developer, “Graph Database Fundamentals,” https://terminusdb.com/ blog/graph-database-fundamentals/, n.d., accessed: 2023-07-23

2023
[11]

Graph Developer’s Guide for Property Graph,

O. Developer, “Graph Developer’s Guide for Property Graph,” https://docs.oracle.com/en/database/oracle/property-graph/22.2/spgdg/ what-are-property-graphs.html, n.d., accessed: 2023-12-25

2023
[12]

The property graph database model

R. Angles, “The property graph database model.” in AMW, 2018

2018
[13]

Resource Description Framework (RDF),

D. R. W. Group, “Resource Description Framework (RDF),” https:// www.w3.org/RDF/, 2014, accessed: 2024-09-11

2014
[14]

The semantic web revisited,

N. Shadbolt, T. Berners-Lee, and W. Hall, “The semantic web revisited,” IEEE intelligent systems , vol. 21, no. 3, pp. 96–101, 2006

2006
[15]

Kott, Autonomous Intelligent Cyber Defense Agent (AICA): A Com- prehensive Guide

A. Kott, Autonomous Intelligent Cyber Defense Agent (AICA): A Com- prehensive Guide. Springer Nature, 2023, vol. 87

2023
[16]

The vision of autonomic computing,

J. Kephart and D. Chess, “The vision of autonomic computing,” Com- puter, vol. 36, no. 1, pp. 41–50, 2003

2003
[17]

Pg-schema: Schemas for property graphs,

R. Angles, A. Bonifati, S. Dumbrava, G. Fletcher, A. Green, J. Hidders, B. Li, L. Libkin, V . Marsault, W. Martens et al., “Pg-schema: Schemas for property graphs,” Proceedings of the ACM on Management of Data , vol. 1, no. 2, pp. 1–25, 2023

2023
[18]

Knowledge Graphs: RDF or Property Graphs, Which One Should You Pick?

V . Vettrivel, “Knowledge Graphs: RDF or Property Graphs, Which One Should You Pick?” https://www.wisecube.ai/blog/ knowledge-graphs-rdf-or-property-graphs-which-one-should-you-pick/, 2022, accessed: 2024-09-11

2022
[19]

Graph pattern matching in gql and sql/pgq,

A. Deutsch, N. Francis, A. Green, K. Hare, B. Li, L. Libkin, T. Lin- daaker, V . Marsault, W. Martens, J. Michels et al. , “Graph pattern matching in gql and sql/pgq,” in Proceedings of the 2022 International Conference on Management of Data , 2022, pp. 2246–2258

2022
[20]

Neo4j: Graphs for Everyone,

Neo4j, “Neo4j: Graphs for Everyone,” https://github.com/neo4j/neo4j, 2007, accessed: 2024-09-11

2007

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [1]

Autonomous intelligent cyber defense agent (aica)

A. Kott, “Autonomous intelligent cyber defense agent (aica).”

work page

[2] [2]

Adaptation techniques for intrusion detection and intrusion response systems,

D. J. Ragsdale, C. Carver, J. W. Humphries, and U. W. Pooch, “Adaptation techniques for intrusion detection and intrusion response systems,” in Smc 2000 conference proceedings. 2000 ieee international conference on systems, man and cybernetics. ’cybernetics evolving to systems, humans, organizations, and their complex interactions’(cat. no. 0, vol. 4. IEE...

work page 2000

[3] [3]

irs-partition: An intrusion response system utilizing deep q-networks and system partitions,

V . Cardellini, E. Casalicchio, S. Iannucci, M. Lucantonio, S. Mittal, D. Panigrahi, and A. Silvi, “irs-partition: An intrusion response system utilizing deep q-networks and system partitions,” SoftwareX, vol. 19, p. 101120, 2022

work page 2022

[4] [4]

Use of graph neural networks in aiding defensive cyber operations,

S. Mitra, T. Chakraborty, S. Neupane, A. Piplai, and S. Mittal, “Use of graph neural networks in aiding defensive cyber operations,” arXiv preprint arXiv:2401.05680, 2024

arXiv 2024

[5] [5]

The world of graph databases from an industry perspective,

Y . Tian, “The world of graph databases from an industry perspective,” ACM SIGMOD Record , vol. 51, no. 4, pp. 60–67, 2023

work page 2023

[6] [6]

Cybersecurity vulnerability management: A conceptual ontol- ogy and cyber intelligence alert system,

R. Syed, “Cybersecurity vulnerability management: A conceptual ontol- ogy and cyber intelligence alert system,” Information & Management , vol. 57, no. 6, p. 103334, 2020

2020

[7] [7]

A cyber security ontology for smart city,

T. Qamar and N. Z. Bawany, “A cyber security ontology for smart city,” International Journal on Information Technologies & Security , vol. 12, no. 3, pp. 63–74, 2020

work page 2020

[8] [8]

An ontology-based security risk management model for information systems,

O. T. Arogundade, A. Abayomi-Alli, and S. Misra, “An ontology-based security risk management model for information systems,” Arabian Journal for Science and Engineering , vol. 45, no. 8, pp. 6183–6198, 2020

work page 2020