Structural and Semantic Analysis of a Cybersecurity Knowledge Graph: Network Topology, Community Detection, and Embedding Insights for Cybersecurity Education
Maleerat Maliyaem
Information Security Education Journal, Vol. 13, No. 1, 2026.
DOI: https://doi.org/10.6025/isej/2026/13/1/20-34
Link: https://www.dline.info/isej/fulltext/v13n1/isejv13n1_2.pdf
Abstract:
Cybersecurity education and threat intelligence increasingly require structured, interpretable frameworks
to manage complex and heterogeneous security data. This study introduces AISecKG, a comprehensive
cybersecurity knowledge graph dataset comprising 1,460+ entities and 726 semantic relations, designed to
bridge the gap between theoretical ontology construction and practical application. Employing a layered
architecture, we systematically analyze the graph's structural and semantic properties through network
topology metrics, community detection, and embedding techniques. Network analysis reveals a sparse,
hierarchical topology with a density of 0.0018 and an average clustering coefficient of 0.0227, indicating
specialized relational patterns rather than dense interconnections. Centrality metrics identify Nmap and
firewall as critical hub and bridging nodes, facilitating knowledge propagation across offensive and defensive
domains. Application of the Louvain algorithm uncovers 20 distinct functional communities, ranging from
network scanning to intrusion detection, confirming the graph's modular organization. Furthermore, TransE
and Node2Vec embeddings successfully capture relational and structural semantics, effectively separating
offensive tools, defensive mechanisms, and infrastructure components in vector space. These findings validate
AISecKG's utility for downstream machine learning tasks, including entity classification and similarity search,
while demonstrating its potential to enhance adaptive cybersecurity education. By transforming fragmented
security data into actionable, semantically rich intelligence, this research addresses critical implementation
gaps and offers a scalable, interpretable framework for both academic training and operational threat
analysis.