# Cyber Threat Intelligence Model: An Evaluation of Taxonomies, Sharing Standards, and Ontologies within Cyber Threat Intelligence

arXiv: https://arxiv.org/abs/2103.03530 · HTML: https://mlsanity.com/paper/2103.03530/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Mar 2021.

## Built on by (most cited first, 8 of 8)

- [Review of Generative AI Methods in Cybersecurity](https://mlsanity.com/paper/2403.08701/) (2024)
- [Uncovering Vulnerabilities of LLM-Assisted Cyber Threat Intelligence](https://mlsanity.com/paper/2509.23573/) (2025)
- [HBFL: A Hierarchical Blockchain-based Federated Learning Framework for a Collaborative IoT Intrusion Detection](https://mlsanity.com/paper/2204.04254/) (2022)
- [CELEST: Federated Learning for Globally Coordinated Threat Detection](https://mlsanity.com/paper/2205.11459/) (2022)
- [APT-MMF: An advanced persistent threat actor attribution method based on multimodal and multilevel feature fusion](https://mlsanity.com/paper/2402.12743/) (2024)
- [Generating Cyber Threat Intelligence to Discover Potential Security Threats Using Classification and Topic Modeling](https://mlsanity.com/paper/2108.06862/) (2021)
- [Knowledge mining of unstructured information: application to cyber-domain](https://mlsanity.com/paper/2109.03848/) (2021)
- [BEACON: Behavior-Anchored Cross-Source Knowledge Graph Construction for Cyber Threat Intelligence](https://mlsanity.com/paper/2608.28394/) (2026)

## Abstract (arXiv)

Cyber threat intelligence is the provision of evidence-based knowledge about existing or emerging threats. Benefits from threat intelligence include increased situational awareness, efficiency in security operations, and improved prevention, detection, and response capabilities. To process, correlate, and analyze vast amounts of threat information and data and derive intelligence that can be shared and consumed in meaningful times, it is required to utilize structured, machine-readable formats that incorporate the industry-required expressivity while at the same time being unambiguous. To a large extent, this is achieved with technologies like ontologies, schemas, and taxonomies. This research evaluates the coverage and high-level conceptual expressivity of cyber-threat-intelligence-relevant ontologies, sharing standards, and taxonomies pertaining to the who, what, why, where, when, and how elements of threats and attacks in addition to courses of action and technical indicators. The results confirm that little emphasis has been given to developing a comprehensive cyber threat intelligence ontology, with existing efforts being not thoroughly designed, non-interoperable, ambiguous, and lacking proper semantics and axioms for reasoning.