A survey on cybersecurity knowledge graph construction

The development of key technologies of knowledge graph (KG) has promoted the development of machine cognition technology, and the combination of KG and industry as well as scenario-based landing have also made breakthroughs in succession. In the field of cybersecurity, with the intelligent upgrading of defense technology, there is an urgent need for a mature and effective technical system to provide knowledge and intelligent reasoning support for the offensive and defensive games in strong adversarial and high dynamic environment. As a domain KG, cybersecurity KG (CKG) just meets this requirement. KG for cybersecurity is not a recent invention; its predecessor is the earliest semantic networks and ontologies, and the KG is small in scale and the relations are relatively simple. Through investigation, we found that most studies that explicitly mentioned CKG, still tend to construct a cybersecurity ontology first, and then extract semantic triples based on ontology. Of course, there are also some studies that try to build such a graph from a higher dimension to express the rich semantics. In order to apply mature techniques of KG construction and reasoning, we believe that the construction of CKG should also follow the Open-domain KG. Therefore, we conducted a comprehensive review and detailed comparison of CKG-related works, discussed the dilemma of CKG application, and then proposed future research opportunities for CKG. This work can help researchers keep up with recent research trends. © 2023 Elsevier Ltd