# MALOnt: An Ontology for Malware Threat Intelligence

arXiv: https://arxiv.org/abs/2006.11446 · HTML: https://mlsanity.com/paper/2006.11446/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Jun 2020.

## Built on by (most cited first, 8 of 8)

- [Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTI](https://mlsanity.com/paper/2211.01753/) (2022)
- [CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Models](https://mlsanity.com/paper/2410.21060/) (2024)
- [CyNER: A Python Library for Cybersecurity Named Entity Recognition](https://mlsanity.com/paper/2204.05754/) (2022)
- [TINKER: A framework for Open source Cyberthreat Intelligence](https://mlsanity.com/paper/2102.05571/) (2021)
- [TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Construction](https://mlsanity.com/paper/2607.05001/) (2026)
- [TRACE-CTI: Auditable Post-Extraction Governance of TTP Claims with Knowledge Graphs](https://mlsanity.com/paper/2607.24563/) (2026)
- [Ontology-driven Knowledge Graph for Android Malware](https://mlsanity.com/paper/2109.01544/) (2021)
- [Knowledge mining of unstructured information: application to cyber-domain](https://mlsanity.com/paper/2109.03848/) (2021)

## Abstract (arXiv)

Malware threat intelligence uncovers deep information about malware, threat actors, and their tactics, Indicators of Compromise(IoC), and vulnerabilities in different platforms from scattered threat sources. This collective information can guide decision making in cyber defense applications utilized by security operation centers(SoCs). In this paper, we introduce an open-source malware ontology - MALOnt that allows the structured extraction of information and knowledge graph generation, especially for threat intelligence. The knowledge graph that uses MALOnt is instantiated from a corpus comprising hundreds of annotated malware threat reports. The knowledge graph enables the analysis, detection, classification, and attribution of cyber threats caused by malware. We also demonstrate the annotation process using MALOnt on exemplar threat intelligence reports. A work in progress, this research is part of a larger effort towards auto-generation of knowledge graphs (KGs)for gathering malware threat intelligence from heterogeneous online resources.