Artificial Intelligence for Threat Anomaly Detection Using Graph Databases – A Semantic Outlook

Facing the dynamic complex cyber environments, internal and external “cyber threat intelligence” (CTI), and the snowballing risk of cyberattack, knowledge graphs (KGs) show great applicability potential in “cybersecurity” (CS) because of their knowledge aggregation representation, management, and reasoning capabilities. However, while most research has focused on developing a complete knowledge graph, it remains unclear how to apply KGs to solve real challenges in cyberattack and defense scenarios. This chapter briefly overviews the CSKG basic notions, schema, and construction methodologies. A curated collection of datasets and open‐source (OO) libraries on the knowledge construction and information extraction task is necessary to foster future CS research KGs. Most of this text compares works that elaborate on the recent progress in “cybersecurity KG” (CSKG) application scenarios. Still, a comprehensive classification framework is created to describe connected results. Finally, there is a thorough look at several promising research directions by discussing existing research flaws.