{"id":"https://openalex.org/W4415955403","doi":"https://doi.org/10.48550/arxiv.2510.16610","title":"Structuring Security: A Survey of Cybersecurity Ontologies, Semantic Log Processing, and LLMs Application","display_name":"Structuring Security: A Survey of Cybersecurity Ontologies, Semantic Log Processing, and LLMs Application","publication_year":2025,"publication_date":"2025-10-18","ids":{"openalex":"https://openalex.org/W4415955403","doi":"https://doi.org/10.48550/arxiv.2510.16610"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2510.16610","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2510.16610","pdf_url":"https://arxiv.org/pdf/2510.16610","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2510.16610","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5068032768","display_name":"Bruno Oct\u00e1vio Horta Louren\u00e7o","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Louren\u00e7o, Bruno","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5003234860","display_name":"Pedro Ad\u00e3o","orcid":"https://orcid.org/0000-0002-4049-1954","observed_orcids":["https://orcid.org/0000-0002-4049-1954"]},"institutions":[{"id":"https://openalex.org/I121345201","display_name":"Instituto de Engenharia de Sistemas e Computadores Investiga\u00e7\u00e3o e Desenvolvimento","ror":"https://ror.org/04mqy3p58","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I121345201","https://openalex.org/I4210125590"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Ad\u00e3o, Pedro","raw_affiliation_strings":["INESC-ID and"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"INESC-ID and","institution_ids":["https://openalex.org/I121345201"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012075571","display_name":"Jo\u00e3o F. Ferreira","orcid":"https://orcid.org/0000-0002-6612-9013","observed_orcids":["https://orcid.org/0000-0002-6612-9013"]},"institutions":[{"id":"https://openalex.org/I121345201","display_name":"Instituto de Engenharia de Sistemas e Computadores Investiga\u00e7\u00e3o e Desenvolvimento","ror":"https://ror.org/04mqy3p58","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I121345201","https://openalex.org/I4210125590"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Ferreira, Jo\u00e3o F.","raw_affiliation_strings":["INESC-ID and"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"INESC-ID and","institution_ids":["https://openalex.org/I121345201"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015795874","display_name":"M\u00e1rio Monteiro Marques","orcid":"https://orcid.org/0000-0001-7153-6716","observed_orcids":["https://orcid.org/0000-0001-7153-6716"]},"institutions":[{"id":"https://openalex.org/I182534213","display_name":"Universidade do Porto","ror":"https://ror.org/043pwc612","country_code":"PT","type":"education","lineage":["https://openalex.org/I182534213"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Marques, Mario Monteiro","raw_affiliation_strings":["Faculty of Engineering , University of Porto , Portugal"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Faculty of Engineering , University of Porto , Portugal","institution_ids":["https://openalex.org/I182534213"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5041077284","display_name":"C\u00e1tia Vaz","orcid":"https://orcid.org/0000-0001-6074-3074","observed_orcids":["https://orcid.org/0000-0001-6074-3074"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vaz, C\u00e1tia","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":8,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10215","display_name":"Semantic Web and Ontologies","score":0.51419997215271,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10215","display_name":"Semantic Web and Ontologies","score":0.51419997215271,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.25679999589920044,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.1703999936580658,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cybersecurity-ontology","display_name":"cybersecurity ontology","score":0.9919999837875366},{"id":"https://openalex.org/keywords/security-logs","display_name":"security logs","score":0.8240000009536743},{"id":"https://openalex.org/keywords/knowledge-graph-construction","display_name":"knowledge graph construction","score":0.824999988079071},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9350000023841858},{"id":"https://openalex.org/keywords/threat-assessment","display_name":"threat assessment","score":0.574999988079071},{"id":"https://openalex.org/keywords/unstructured-data","display_name":"unstructured data","score":0.6610000133514404},{"id":"https://openalex.org/keywords/nis2-directive","display_name":"NIS2 Directive","score":0.8820000290870667},{"id":"https://openalex.org/keywords/interoperability","display_name":"interoperability","score":0.6610000133514404},{"id":"https://openalex.org/keywords/data-integration","display_name":"data integration","score":0.8619999885559082}],"concepts":[{"id":"https://openalex.org/C2775945657","wikidata":"https://www.wikidata.org/wiki/Q381442","display_name":"Structuring","level":2,"score":0.6984000205993652},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6370999813079834},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.6326000094413757},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5741999745368958},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5232999920845032},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.49459999799728394},{"id":"https://openalex.org/C2781252014","wikidata":"https://www.wikidata.org/wiki/Q1141900","display_name":"Unstructured data","level":3,"score":0.4860000014305115},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.450300008058548},{"id":"https://openalex.org/C86844869","wikidata":"https://www.wikidata.org/wiki/Q2798820","display_name":"Hacker","level":2,"score":0.447299987077713},{"id":"https://openalex.org/C132964779","wikidata":"https://www.wikidata.org/wiki/Q2110223","display_name":"Raw data","level":2,"score":0.42329999804496765},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.3874000012874603},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.38530001044273376},{"id":"https://openalex.org/C207685749","wikidata":"https://www.wikidata.org/wiki/Q2088941","display_name":"Domain knowledge","level":2,"score":0.37070000171661377},{"id":"https://openalex.org/C25810664","wikidata":"https://www.wikidata.org/wiki/Q44325","display_name":"Ontology","level":2,"score":0.36320000886917114},{"id":"https://openalex.org/C6881194","wikidata":"https://www.wikidata.org/wiki/Q7449091","display_name":"Semantic technology","level":4,"score":0.33739998936653137},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3140999972820282},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.313400000333786},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3070000112056732},{"id":"https://openalex.org/C2910001868","wikidata":"https://www.wikidata.org/wiki/Q458","display_name":"European union","level":2,"score":0.3027999997138977},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2964000105857849},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.29600000381469727},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.29490000009536743},{"id":"https://openalex.org/C90312973","wikidata":"https://www.wikidata.org/wiki/Q7449052","display_name":"Semantic data model","level":2,"score":0.27790001034736633},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.2685999870300293},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.26350000500679016},{"id":"https://openalex.org/C528167355","wikidata":"https://www.wikidata.org/wiki/Q258307","display_name":"National security","level":2,"score":0.2581000030040741},{"id":"https://openalex.org/C105002631","wikidata":"https://www.wikidata.org/wiki/Q4833645","display_name":"Subject-matter expert","level":3,"score":0.25540000200271606}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2510.16610","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2510.16610","pdf_url":"https://arxiv.org/pdf/2510.16610","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2510.16610","doi":"https://doi.org/10.48550/arxiv.2510.16610","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2510.16610","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2510.16610","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2510.16610","pdf_url":"https://arxiv.org/pdf/2510.16610","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G1740015287","display_name":null,"funder_award_id":"10.54499/UIDB/50021/2020","funder_id":"https://openalex.org/F4320334779","funder_display_name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia"},{"id":"https://openalex.org/G2441341484","display_name":"Instituto de Engenharia de Sistemas e Computadores, Investiga\u00e7\u00e3o e Desenvolvimento em Lisboa","funder_award_id":"UIDB/50021/2020","funder_id":"https://openalex.org/F4320334779","funder_display_name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia"}],"funders":[{"id":"https://openalex.org/F4320334779","display_name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia","ror":"https://ror.org/00snfqn58"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4415955403.pdf","grobid_xml":"https://content.openalex.org/works/W4415955403.grobid-xml"},"referenced_works_count":6,"referenced_works":["https://openalex.org/W2607049741","https://openalex.org/W2726952220","https://openalex.org/W2903263309","https://openalex.org/W4390962401","https://openalex.org/W4413259116","https://openalex.org/W4416681957"],"related_works":["https://openalex.org/W4414816529","https://openalex.org/W3043506337","https://openalex.org/W4416681957","https://openalex.org/W3000275518","https://openalex.org/W7128374655","https://openalex.org/W6889079709","https://openalex.org/W7135181290","https://openalex.org/W7214287211","https://openalex.org/W4389492806","https://openalex.org/W4283780790"],"abstract_inverted_index":{"This":[0,75],"survey":[1],"investigates":[2],"how":[3],"ontologies,":[4],"semantic":[5],"log":[6],"processing,":[7],"and":[8,23,34,56,69,87,93],"Large":[9],"Language":[10],"Models":[11],"(LLMs)":[12],"enhance":[13],"cybersecurity.":[14],"Ontologies":[15],"structure":[16],"domain":[17],"knowledge,":[18],"enabling":[19],"interoperability,":[20],"data":[21],"integration,":[22],"advanced":[24],"threat":[25],"analysis.":[26],"Security":[27],"logs,":[28],"though":[29],"critical,":[30],"are":[31],"often":[32],"unstructured":[33,73],"complex.":[35],"To":[36],"address":[37],"this,":[38],"automated":[39],"construction":[40],"of":[41],"Knowledge":[42],"Graphs":[43],"(KGs)":[44],"from":[45,72],"raw":[46],"logs":[47],"is":[48],"emerging":[49],"as":[50,84],"a":[51],"key":[52],"strategy":[53],"for":[54],"organizing":[55],"reasoning":[57],"over":[58],"security":[59],"data.":[60],"LLMs":[61],"enrich":[62],"this":[63],"process":[64],"by":[65],"providing":[66],"contextual":[67],"understanding":[68],"extracting":[70],"insights":[71],"content.":[74],"work":[76],"aligns":[77],"with":[78],"European":[79],"Union":[80],"(EU)":[81],"efforts":[82],"such":[83],"NIS":[85],"2":[86],"the":[88],"Cybersecurity":[89],"Taxonomy,":[90],"highlighting":[91],"challenges":[92],"opportunities":[94],"in":[95],"intelligent":[96],"ontology-driven":[97],"cyber":[98],"defense.":[99]},"counts_by_year":[{"year":2026,"cited_by_count":8}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2025-10-22T00:00:00"}