{"id":"https://openalex.org/W7163183567","doi":"https://doi.org/10.48550/arxiv.2606.01208","title":"Schema-Agnostic Knowledge Graph Construction via Hybrid Ontology Discovery for Cyber Threat Intelligence","display_name":"Schema-Agnostic Knowledge Graph Construction via Hybrid Ontology Discovery for Cyber Threat Intelligence","publication_year":2026,"publication_date":"2026-05-31","ids":{"openalex":"https://openalex.org/W7163183567","doi":"https://doi.org/10.48550/arxiv.2606.01208"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.01208","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01208","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.01208","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137633951","display_name":"Seonwoo Kim","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kim, Seonwoo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137642116","display_name":"Jinwoo Kim","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kim, Jinwoo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053010968","display_name":"\uac15\ub300\uaddc","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kang, Daegyu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137693236","display_name":"Daeseong Kim","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kim, Daeseong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5030456600","display_name":"Insup Lee","orcid":"https://orcid.org/0000-0003-2672-1132"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lee, Insup","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.41370001435279846,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.41370001435279846,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11719","display_name":"Data Quality and Management","score":0.0722000002861023,"subfield":{"id":"https://openalex.org/subfields/1803","display_name":"Management Science and Operations Research"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10215","display_name":"Semantic Web and Ontologies","score":0.05400000140070915,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ontology","display_name":"Ontology","score":0.5911999940872192},{"id":"https://openalex.org/keywords/schema","display_name":"Schema (genetic algorithms)","score":0.5425000190734863},{"id":"https://openalex.org/keywords/semantic-web","display_name":"Semantic Web","score":0.424699991941452},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.41100001335144043},{"id":"https://openalex.org/keywords/knowledge-graph","display_name":"Knowledge graph","score":0.3714999854564667},{"id":"https://openalex.org/keywords/knowledge-representation-and-reasoning","display_name":"Knowledge representation and reasoning","score":0.3693000078201294},{"id":"https://openalex.org/keywords/data-integration","display_name":"Data integration","score":0.3515999913215637},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.3034999966621399}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7908999919891357},{"id":"https://openalex.org/C25810664","wikidata":"https://www.wikidata.org/wiki/Q44325","display_name":"Ontology","level":2,"score":0.5911999940872192},{"id":"https://openalex.org/C52146309","wikidata":"https://www.wikidata.org/wiki/Q7431116","display_name":"Schema (genetic algorithms)","level":2,"score":0.5425000190734863},{"id":"https://openalex.org/C2129575","wikidata":"https://www.wikidata.org/wiki/Q54837","display_name":"Semantic Web","level":2,"score":0.424699991941452},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.41100001335144043},{"id":"https://openalex.org/C2987255567","wikidata":"https://www.wikidata.org/wiki/Q33002955","display_name":"Knowledge graph","level":2,"score":0.3714999854564667},{"id":"https://openalex.org/C161301231","wikidata":"https://www.wikidata.org/wiki/Q3478658","display_name":"Knowledge representation and reasoning","level":2,"score":0.3693000078201294},{"id":"https://openalex.org/C72634772","wikidata":"https://www.wikidata.org/wiki/Q386824","display_name":"Data integration","level":2,"score":0.3515999913215637},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.336899995803833},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.32179999351501465},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3034999966621399},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3000999987125397},{"id":"https://openalex.org/C120567893","wikidata":"https://www.wikidata.org/wiki/Q1582085","display_name":"Knowledge extraction","level":2,"score":0.2912999987602234},{"id":"https://openalex.org/C22550185","wikidata":"https://www.wikidata.org/wiki/Q7095047","display_name":"Ontology-based data integration","level":3,"score":0.28459998965263367},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.2831999957561493},{"id":"https://openalex.org/C147497476","wikidata":"https://www.wikidata.org/wiki/Q54872","display_name":"RDF","level":3,"score":0.2727000117301941},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.26989999413490295},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.265500009059906},{"id":"https://openalex.org/C101230327","wikidata":"https://www.wikidata.org/wiki/Q826165","display_name":"Web Ontology Language","level":3,"score":0.26019999384880066},{"id":"https://openalex.org/C102993220","wikidata":"https://www.wikidata.org/wiki/Q387196","display_name":"Description logic","level":2,"score":0.25450000166893005},{"id":"https://openalex.org/C78726541","wikidata":"https://www.wikidata.org/wiki/Q3882785","display_name":"Upper ontology","level":3,"score":0.2524999976158142},{"id":"https://openalex.org/C119701452","wikidata":"https://www.wikidata.org/wiki/Q5165881","display_name":"Control reconfiguration","level":2,"score":0.2515000104904175}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.01208","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01208","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.01208","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.01208","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.6521283984184265}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Cyber":[0],"threat":[1,47],"intelligence":[2,28],"(CTI)":[3],"reports":[4],"now":[5],"serve":[6],"as":[7,36,82],"essential":[8],"resources":[9],"for":[10,45,52],"capturing":[11],"adversary":[12],"tactics,":[13],"techniques,":[14],"and":[15,84,118,155,167],"procedures":[16],"observed":[17],"in":[18,164],"modern":[19],"attack":[20],"campaigns.":[21],"While":[22],"traditional":[23],"CTI":[24,54,110,185],"platforms":[25],"reduce":[26],"this":[27,103],"to":[29,76,144],"isolated":[30],"indicators":[31],"through":[32],"fixed":[33],"schemas":[34,157],"such":[35,81],"STIX,":[37,154],"ontology-based":[38],"representations":[39],"preserve":[40],"the":[41,67,123,152],"semantic":[42],"relationships":[43],"needed":[44],"structured":[46],"analysis.":[48],"However,":[49],"existing":[50,162],"approaches":[51],"ontology-aligned":[53],"extraction":[55],"face":[56],"three":[57],"challenges:":[58],"(i)":[59],"schema-specific":[60],"pipelines":[61],"that":[62,74,91,115,134,159],"require":[63],"manual":[64],"reconfiguration":[65],"whenever":[66],"schema":[68,72,168],"changes,":[69],"(ii)":[70],"prompt-based":[71],"inclusion":[73],"fails":[75],"scale":[77],"on":[78,87,151],"large":[79],"ontologies":[80],"UCO,":[83,153],"(iii)":[85],"reliance":[86],"enterprise":[88,179],"LLM":[89,176,180],"APIs":[90],"conflicts":[92],"with":[93,141,173,187],"privacy":[94],"constraints":[95],"when":[96],"integrating":[97],"sensitive":[98],"internal":[99],"incident":[100],"data.":[101],"In":[102,170],"paper,":[104],"we":[105],"present":[106],"ANCHOR,":[107],"a":[108,131,174],"schema-agnostic":[109],"knowledge":[111],"graph":[112],"construction":[113],"system":[114],"bridges":[116],"LLMs":[117],"formal":[119],"ontology":[120,129,138,165],"schemas.":[121],"At":[122],"core":[124],"of":[125],"ANCHOR":[126,160,172],"is":[127],"hybrid":[128],"discovery,":[130],"search-and-navigate":[132],"mechanism":[133],"dynamically":[135],"explores":[136],"large-scale":[137],"schemas,":[139],"combined":[140],"SHACL-based":[142],"validation":[143],"enforce":[145],"schema-compliant":[146],"type":[147],"assignments.":[148],"Experimental":[149],"results":[150],"MALOnt":[156],"show":[158],"outperforms":[161],"baselines":[163],"typing":[166,181],"compliance.":[169],"addition,":[171],"local":[175],"closely":[177],"matches":[178],"performance,":[182],"enabling":[183],"privacy-preserving":[184],"analysis":[186],"high":[188],"fidelity.":[189]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-03T00:00:00"}