Symbolic AI, logics, and formal ontologies have been widely utilized, also in the context of cybersecurity, to accurately represent relevant domains of discourse and provide necessary system capabilities for data integration, analytics, and reasoning in support of enhanced situational awareness and decision-making. Applications include threat detection and response, cyber threat intelligence, vulnerability management, and risk and threat assessment.
In this context, the design, development, use, and maintenance of (cybersecurity) ontologies have traditionally been regarded as intellectually demanding, cumbersome, time-consuming, and requiring multidisciplinary collaboration — all of which significantly raise the entry barrier.
The rapid advancement of Large Language Models (LLMs) has enabled machines to understand, generate, and reason with human language, assisting humans in complex information processing, knowledge extraction, and decision-making.
This thesis will investigate how LLMs can support the design, development, and maintenance of cybersecurity ontologies by automating the extraction, structuring, and annotation of domain knowledge from unstructured text.
This approach aims to reduce the time, effort, and multidisciplinary coordination traditionally required, thereby accelerating ontology development for threat intelligence, vulnerability management, generation of security advisories and incident reports, and risk assessment, and enabling faster, more adaptive cybersecurity decision-making.