Review
Hybrid‑Threat Intelligence: A Critical Review of Semantic Integration Challenges and the Role of the HIPSTer Ontological Framework


This work is licensed under a Creative Commons Attribution 4.0 International License.
Copyright
The authors shall retain the copyright of their work but allow the Publisher to publish, copy, distribute, and convey the work.
License
Journal of Intelligent Communication (JIC) publishes accepted manuscripts under Creative Commons Attribution 4.0 International (CC BY 4.0). Authors who submit their papers for publication by Journal of Intelligent Communication (JIC) agree to have the CC BY 4.0 license applied to their work, and that anyone is allowed to reuse the article or part of it free of charge for any purpose, including commercial use. As long as the author and original source is properly cited, anyone may copy, redistribute, reuse and transform the content.
Received: 30 December 2025; Revised: 18 March 2026; Accepted: 24 March 2026; Published: 9 May 2026
Contemporary hybrid threats employ coordinated campaigns across information, cyber, and physical domains, maintaining plausible deniability while exploiting institutional vulnerabilities. This review conducts a scoping analysis following the PRISMA ScR framework (Preferred Reporting Items for Systematic Reviews and Meta-Analyses—Extension for Scoping Reviews) to evaluate Open Source Intelligence (OSINT), Social Media Intelligence (SOCMINT), and Natural Language Processing (NLP) capabilities relevant to hybrid threat detection. We systematically assess these technologies against a 12-point operational requirements framework derived from documented Russian and Chinese military OSINT methodologies and influence operation tradecraft. The analysis incorporates high-Technology Readiness Level (TRL) European initiatives to ground capability assessments in operational experience. While individual analytical disciplines are technically advanced, current defensive systems remain siloed and lack the cross-domain reasoning necessary to correlate technical cyber indicators with coordinated narrative manipulation. Requirements for cross-platform correlation and adversarial adaptation show only prototype stage coverage. Our findings reveal a persistent “semantic gap”: defensive systems collect extensive data but lack integrated semantic reasoning across domains and languages. To address this, we examine ontology-based approaches as architectural solutions, positioning the ‘Hybrid Information Psychological Societal Threats handling system’ (HIPSTer) framework as an illustrative case. HIPSTer specifically targets the multilingual nature of hybrid threats—particularly in Russian and Chinese contexts—achieving TRL-4 validation through high-efficiency semantic vectors and formal reasoning across diverse language benchmarks. Finally, the review analyzes how European regulations—including the General Data Protection Regulation (GDPR), AI Act, and Network and Information Systems Directive 2 (NIS2)—shape operational architectures through compliance by design imperatives. We conclude by outlining a prioritized research agenda to advance European hybrid threat detection toward operational maturity.
Keywords:
Hybrid Threats OSINT SOCMINT NLP Cyber Threat Intelligence Ontological Framework HIPSTerReferences
- European Commission. Eighth progress report on the implementation of the 2016 Joint framework on countering hybrid threats and the 2018 Joint communication on increasing resilience and bolstering capabilities to address hybrid threats. Available online: https://defence-industry-space.ec.europa.eu/system/files/2025-01/SWD_Annual-Progress-Report-2024.PDF (accessed on 26 November 2025).
- European Parliament. Motion for a Resolution. Available online: https://www.europarl.europa.eu/doceo/document/B-10-2025-0437_EN.pdf (accessed on 26 November 2025).
- Ivkova, V.S.; Opirskyi, I.R. Research of Existing OSINT Tools and Approaches in the Context of Personal and State Information Security. Comput. Syst. Netw. 2025, 7, 143–159. DOI: https://doi.org/10.23939/csn2025.01.131
- Dover, R. SOCMINT: A Shifting Balance of Opportunity. Intell. Natl. Secur. 2020, 35, 216–232. DOI: https://doi.org/10.1080/02684527.2019.1694132
- Zapata Rozo, A.; Díaz-López, D.; Pastor-Galindo, J.; et al. An NLP‐Based Framework to Spot Extremist Networks in Social Media. Complexity 2024, 2024, 3380488. DOI: https://doi.org/10.1155/2024/3380488
- ENISA Threat Landscape 2025. Available online: https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025_0.pdf (accessed on 26 November 2025).
- Chen, C.; Shu, K. Can LLM-Generated Misinformation Be Detected? arXiv preprint 2024, arXiv.2309.13788. DOI: https://doi.org/10.48550/arXiv.2309.13788
- Yadav, A.; Kumar, A.; Singh, V. Open-Source Intelligence: A Comprehensive Review of the Current State, Applications and Future Perspectives in Cyber Security. Artif. Intell. Rev. 2023, 56, 12407–12438. DOI: https://doi.org/10.1007/s10462-023-10454-y
- Ellaky, Z.; Benabbou, F.; Matrane, Y.; et al. A Hybrid Deep Learning Architecture for Social Media Bots Detection Based on BiGRU-LSTM and GloVe Word Embedding. IEEE Access 2024, 12, 100278–100294. DOI: https://doi.org/10.1109/ACCESS.2024.3430859
- Perrina, F.; Marchiori, F.; Conti, M.; et al. AGIR: Automating Cyber Threat Intelligence Reporting with Natural Language Generation. arXiv preprint 2023, arXiv.2310.02655. DOI: https://doi.org/10.48550/arXiv.2310.02655
- European Commission. Sustainable Autonomy and Resilience for LEAs Using AI against High Priority Threats. Available online: https://cordis.europa.eu/project/id/101021797 (accessed on 26 November 2025).
- Ministry of the Armed Forces. Disinformation, a Weapon of War. Available online: https://www.defense.gouv.fr/en/news/disinformation-weapon-war (accessed on 26 November 2025).
- Mykolas Romeris University. Creation of Information Security and Information Threats’ Detection, Analysis, Research and Education Ecosystem (NAAS). Available online: https://www.mruni.eu/en/creation-of-information-security-and-information-threats-detection-analysis-research-and-education-ecosystem-naas-nr-01-2-1-lvpa-v-835-03-000-nr-01-2-1-lvpa-v-835-03/ (accessed on 9 December 2025).
- Dragos, V.; Forrester, B.; Rein, K. Is Hybrid AI Suited for Hybrid Threats? Insights from Social Media Analysis. In Proceedings of the 2020 IEEE 23rd International Conference on Information Fusion, Rustenburg, South Africa, July 2020; pp. 1–7.
- Tricco, A.C.; Lillie, E.; Zarin, W.; et al. PRISMA Extension for Scoping Reviews (PRISMA-ScR): Checklist and Explanation. Ann. Intern. Med. 2018, 169, 467–473. DOI: https://doi.org/10.7326/M18-0850
- Borisov, I. Maskirovka—The Art of Deception à La Russe. RMT 2024, 192–207. DOI: https://doi.org/10.55535/RMT.2024.4.12
- Kalensky, J.; Osadchuk, R. How Ukraine Fights Russian Disinformation: Beehive vs Mammoth. Available online: https://www.hybridcoe.fi/wp-content/uploads/2024/01/20240124-Hybrid-CoE-Research-Report-11-How-UKR-fights-RUS-disinfo-WEB.pdf (accessed on 25 December 2025).
- Kling, J.; Toepfl, F.; Jürgens, P. Entertainment Interspersed with Propaganda: How Non-Legacy-News Accounts Deliver Explicitly Political Content to Mass Audiences on Russia’s Most Popular Social Network VK. Inf. Commun. Soc. 2025, 28, 1252–1269. DOI: https://doi.org/10.1080/1369118X.2024.2420029
- Kruglova, L.A.; Shchepilova, G.G. Russian TV Channels and Social Media in the Transformation of the Media Field. Online Media Glob. Commun. 2025, 4, 371–386. DOI: https://doi.org/10.1515/omgc-2025-0010
- Eady, G.; Paskhalis, T.; Zilinsky, J.; et al. Exposure to the Russian Internet Research Agency Foreign Influence Campaign on Twitter in the 2016 US Election and Its Relationship to Attitudes and Voting Behavior. Nat. Commun. 2023, 14, 62. DOI: https://doi.org/10.1038/s41467-022-35576-9
- Cochran, E.S. China’s “Three Warfares”: People’s Liberation Army Influence Operations. Int. Bull. Polit. Psychol. 2020, 20.
- OSINT. Advanced OSINT for China: SOCMINT on WeChat, Weibo, and More. Available online: https://www.osint.industries/post/advanced-osint-for-china-socmint-on-wechat-weibo-and-more (accessed on 27 November 2025).
- Charon, P.; Jeangène Vilmer, J.-B. Chinese Influence Operations: A Machiavellian Moment; Institute for Strategic Research (IRSEM): Paris, France, 2021.
- Wong, C. The Diaspora and China’s Foreign Influence Activities. Available online: https://www.wilsoncenter.org/publication/diaspora-and-chinas-foreign-influence-activities (accessed on 27 November 2025).
- Finkelstein, D.; Yanovsky, S.; Zucker, J.; et al. Information Manipulation on TikTok and Its Relation to American Users’ Beliefs about China. Front. Soc. Psychol. 2025, 2, 1497434. DOI: https://doi.org/10.3389/frsps.2024.1497434
- Zhang, Y. Who Gets the Algorithm? The Bigger TikTok Danger. Available online: https://www.lawfaremedia.org/article/who-gets-the-algorithm-the-bigger-tiktok-danger (accessed on 27 November 2025).
- Silver, L.; Huang, C.; Clancy, L. Across 19 Countries, More People See the U.S. Than China Favorably—But More See China’s Influence Growing; Pew Research Center: Washington, DC, USA, 2022.
- Suryotrisongko, H.; Musashi, Y.; Tsuneda, A.; et al. Robust Botnet DGA Detection: Blending XAI and OSINT for Cyber Threat Intelligence Sharing. IEEE Access 2022, 10, 34613–34624. DOI: https://doi.org/10.1109/ACCESS.2022.3162588
- Yuan, X.; Wang, J.; Zhao, H.; et al. Empowering LLMs with Toolkits: An Open-Source Intelligence Acquisition Method. Future Internet 2024, 16, 461. DOI: https://doi.org/10.3390/fi16120461
- Bizouarn, K.M.; Abdulnabi, M.; Tan, J. OSINT and AI: A Powerful Combination for Company Vulnerability Detection. In Proceedings of the 2023 IEEE 21st Student Conference on Research and Development, Kuala Lumpur, Malaysia, 13 December 2023; pp. 246–250.
- Fauziyyah, A.K.; Adrian, R.; Alam, S. Analyzing Image Malware with OSINTs after Steganography Using Symmetric Key Algorithm. SinkrOn 2023, 8, 818–824. DOI: https://doi.org/10.33395/sinkron.v8i2.12266
- Nonum, E.O.; Avwokuruaye, O.; Ezemonye, T.M. Role of Open Source Intelligence (OSINT) in Cybersecurity and Threat Analysis. Int. J. Latest Technol. Eng. Manag. Appl. Sci. 2025, 14, 189–200. DOI: https://doi.org/10.51583/IJLTEMAS.2025.140300023
- Vacas, I.; Medeiros, I.; Neves, N. Detecting Network Threats Using OSINT Knowledge-Based IDS. In Proceedings of the 2018 14th European Dependable Computing Conference, Iasi, Romania, 10–14 September 2018; pp. 128–135.
- Shin, S.-M.; Jung, K.-H. A Comparative Study of OSINT Automation Tools. Asia-Pac. J. Converg. Res. Interchange 2024, 10, 1–13. DOI: https://doi.org/10.47116/apjcri.2024.05.01
- Lynch, T.L.; Sulzer, M.A. New Towers of Babel: A Conceptual Argument for Digital Platforms as Unstable Linguistic Constructs. In Literacies in the Platform Society; Routledge: London, UK, 2025; pp. 21–39.
- Puleri, J. Law Enforcement and Open Source Intelligence: Evolution, Technologies, and Privacy Issues. PhD Thesis, Utica College, Utica, NY, USA, 2021.
- Galis, V.; Karlsson, B. A World of Palantir–Ontological Politics in the Danish Police’s POL-INTEL. Inf. Commun. Soc. 2024, 27, 2438–2456.
- Xiao, P.; Xie, L.; Hang, F.; et al. Advanced Technique for Firmware Security Analysis through Heterogeneous Data Fusion and Knowledge Mapping. PLoS ONE 2025, 20, e0319660. DOI: https://doi.org/10.1371/journal.pone.0319660
- Maltego. Available online: https://www.maltego.com (accessed on 27 November 2025).
- Mlinac, N. Hybrid Intelligence as a Carrier of Disinformation and Hybrid Threats in Cyberspace. Natl. Secur. Future 2025, 26, 65–98.
- Cárdenas, P.; Obara, B.; Theodoropoulos, G.; et al. Analysing Social Media as a Hybrid Tool to Detect and Interpret Likely Radical Behavioural Traits for National Security. In Proceedings of the 2019 IEEE International Conference on Big Data (Big Data), Los Angeles, CA, USA, 9–12 December 2019; pp. 4579–4588.
- Mothe, J.; Ullah, M.Z.; Okon, G.; et al. Instruments and Tools to Identify Radical Textual Content. Information 2022, 13, 193. DOI: https://doi.org/10.3390/info13040193
- Sangher, K.S.; Singh, A.; Pandey, H.M. LSTM and BERT Based Transformers Models for Cyber Threat Intelligence for Intent Identification of Social Media Platforms Exploitation from Darknet Forums. Int. J. Inf. Technol. 2024, 16, 5277–5292. DOI: https://doi.org/10.1007/s41870-024-02077-5
- Biagio, M.S.; Simoncini, S.; La Mattina, E.; et al. MARPLE: A Framework for Social Media Threat Intelligence. In Proceedings of the 2024 International Conference on Artificial Intelligence, Computer, Data Sciences and Applications (ACDSA), Victoria, Seychelles, 1–2 February 2024; pp. 1–6.
- Bimyrzakyzy, A.; Alimzhanova, Z.M. Identifying Cyberthreats through Social Media Research. Bull. Shakarim Univ. Tech. Sci. 2024, 3, 42–49. DOI: https://doi.org/10.53360/2788-7995-2024-3(15)-7 (in Kazakh)
- Arora, A.; Arora, A.; McIntyre, J. Developing Chatbots for Cyber Security: Assessing Threats through Sentiment Analysis on Social Media. Sustainability 2023, 15, 13178. DOI: https://doi.org/10.3390/su151713178
- Ronzaud, L.; Carter, J.A.; Williams, T. Summit Old, Summit New: Russia Linked Actors Leverage New and Old Tactics in Influence Operations Targeting Online Conversations about NATO Summit; Graphika: New York, NY, USA, 2023.
- Yang, K.-C.; Varol, O.; Davis, C.A.; et al. Arming the Public with Artificial Intelligence to Counter Social Bots. Hum. Behav. Emerg. Technol. 2019, 1, 48–61. DOI: https://doi.org/10.1002/hbe2.115
- Wang, G.; Liu, P.; Huang, J.; et al. KnowCTI: Knowledge-Based Cyber Threat Intelligence Entity and Relation Extraction. Comput. Secur. 2024, 141, 103824.
- Al-Yasiri, J.H.; Bin Zolkipli, M.F.; Farid, N.F.N.M.; et al. A Threat Intelligence Event Extraction Conceptual Model for Cyber Threat Intelligence Feeds. In Proceedings of the 2024 7th International Conference on Internet Applications, Protocols, and Services (NETAPPS), Kuala Lumpur, Malaysia, 6 November 2024; pp. 1–8.
- Pasupuleti, M.K. Threat Intelligence Automation Using Natural Language Processing on Dark Web Data. Int. J. Acad. Ind. Res. Innov. 2025, 5, 399–411.
- Huang, T.; Yi, J.; Yu, P.; et al. Unmasking Digital Falsehoods: A Comparative Analysis of LLM-Based Misinformation Detection Strategies. In Proceedings of the IEEE 2025 8th International Conference on Advanced Algorithms and Control Engineering (ICAACE), Shanghai, China, 21–23 March 2025; pp. 2470–2476.
- Qi, P.; Yan, Z.; Hsu, W.; et al. SNIFFER: Multimodal Large Language Model for Explainable Out-of-Context Misinformation Detection. arXiv preprint 2024, arXiv.2403.03170. DOI: https://doi.org/10.48550/arXiv.2403.03170
- Li, X.; Zhang, Y.; Malthouse, E.C. Large Language Model Agent for Fake News Detection. arXiv preprint 2024, arXiv.2405.01593. DOI: https://doi.org/10.48550/arXiv.2405.01593
- Marchiori, F.; Donadel, D.; Conti, M. Can LLMs Classify CVEs? Investigating LLMs Capabilities in Computing CVSS Vectors. arXiv preprint 2025, arXiv.2504.10713. DOI: https://doi.org/10.48550/arXiv.2504.10713
- European Commission. The General-Purpose AI Code of Practice. Available online: https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai (accessed on 5 July 2025).
- European Commission. Commission publishes the Guidelines on prohibited artificial intelligence (AI) practices, as defined by the AI Act. Available online: https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act (accessed on 9 December 2025).
- L3CE, Lithuanian Cybercrime Center of Excellence for Training, Research & Education. Available online: https://www.l3ce.eu/en/about-l3ce/ (accessed on 9 December 2025).
- National Cybersecurity State Report 2024. Available online: https://www.nksc.lt/doc/Nacionaline-kibernetinio-saugumo-ataskaita-2024.pdf (accessed on 28 November 2025). (in Lithuanian)
- National Cyber Security Exercises "Cyber Shield Opex 2024". Available online: https://www.nksc.lt/doc/KS2024_OPEX_Pratybu_ataskaita.pdf (accessed on 28 November 2025). (in Lithuanian)
- European Commission. Member States and Commission test collective cybersecurity crisis response. Available online: https://digital-strategy.ec.europa.eu/en/news/member-states-and-commission-test-collective-cybersecurity-crisis-response (accessed on 28 November 2025).
- EU Disinfo Lab. A practical toolkit for detecting, assessing, and responding to Foreign Information Manipulation and Interference (FIMI). Available online: https://www.disinfo.eu/publications/a-practical-toolkit-for-detecting-assessing-and-responding-to-fimi/ (accessed on 25 November 2025).
- EEAS. Information Integrity and Countering Foreign Information Manipulation & Interference (FIMI). Available online: https://www.eeas.europa.eu/eeas/information-integrity-and-countering-foreign-information-manipulation-interference-fimi_en (accessed on 1 December 2025).
- European Commission. European Democracy Shield and EU Strategy for Civil Society Pave the Way for Stronger and More Resilient Democracies. Available online: https://ec.europa.eu/commission/presscorner/detail/en/ip_25_2660 (accessed on 26 November 2025).
- Federal Ministry of the Interior, Building and Community. Cyber Security Strategy for Germany 2021. Available online: https://www.bmi.bund.de/SharedDocs/downloads/EN/themen/it-digital-policy/cyber-security-strategy-for-germany2021.pdf (accessed on 26 November 2025).
- AP (Dutch Data Protection Authority). AI & Algorithmic Risks: Developments in the Netherlands. Available online: https://www.autoriteitpersoonsgegevens.nl/en/themes/algorithms-ai/ai-algorithmic-risks-developments-in-the-netherlands (accessed on 26 November 2025).
- ENISA. ENISA NIS360 2024 Report: A Comprehensive Look at Cybersecurity Maturity and Criticality of NIS2 Sectors. Available online: https://www.enisa.europa.eu/news/enisa-nis360-2024-report (accessed on 26 November 2025).
- European Union Agency for Cybersecurity (ENISA). 2024 Report on the State of Cybersecurity in the Union; European Union Agency for Cybersecurity: Heraklion, Greece, 2024.
- Council of the European Union. Council Conclusions on the Future of Cybersecurity: Implement and Protect Together. Available online: https://data.consilium.europa.eu/doc/document/ST-10133-2024-INIT/en/pdf (accessed on 26 November 2025).
- Bružė, E.; Paskauskas, R.A.; Matulytė, R.; et al. Integration of Hybrid Threat Intelligence: The HiPSTer Ontological Method for Cross-Domain Correlation in Influence Operations. Open Res. Eur. 2026, in press.
- European Union. Regulation (EU) 2016/679 of the European Parliament and of the Council. Available online: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504 (accessed on 15 December 2025).
- European Union. Directive (EU) 2016/680 of the European Parliament and of the Council. Available online: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016L0680 (accessed on 17 December 2025).
- European Union. Regulation (EU) 2024/1689 of the European Parliament and of the Council. Available online: https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng (accessed on 17 December 2025).
- European Union. Directive (EU) 2022/2555 of the European Parliament and of the Council. Available online: https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng (accessed on 17 December 2025).
- European Union. Case C-634/21, SCHUFA Holding (Scoring). Available online: https://eur-lex.europa.eu/eli/C/2024/913/oj/eng?utm_source=copilot.com (accessed on 17 December 2025).
- European Union. CJEU, 27 February 2025, CK v Magistrat der Stadt Wien and Dun & Bradstreet Austria GmbH, Case C-203/22. Available online: https://www.julia-project.eu/database/case-law/319 (accessed on 17 December 2025).
- ENISA. Multilayer Framework for Good Cybersecurity Practices for AI. Available online: https://www.enisa.europa.eu/publications/multilayer-framework-for-good-cybersecurity-practices-for-ai (accessed on 7 December 2025).
- GitHub. Hybrid-Threat Intelligence: The HIPSTer Ontological Framework. Available online: https://github.com/SecOntologyLab/hipster-ontology (accessed on 1 December 2025).
- Paskauskas, R.A. A Preliminary Ontology for 5G Network Resilience: Hybrid Threats, Risk Reduction, Compliance. In Proceedings of the 2025 IEEE International Conference on Cyber Security and Resilience (CSR), Chania, Greece, 4–6 August 2025; pp. 490–497.
- Paskauskas, R.A. Countering Hybrid Threats: Towards an Ontology for Securing 5G Networks. In Computer and Communication Engineering; Neri, F., Du, K.-L., San-Blas, A.-A., et al., Eds.; Springer Nature Switzerland: Cham, Switzerland, 2025; 2192, pp. 104–121.
- Paskauskas, R.A. Decoding 5G Security: Toward a Hybrid Threat Ontology. Open Res. Eur. 2025, 4, 34. DOI: https://doi.org/10.12688/openreseurope.16916.3
- Paskauskas, R.A. ENISA: 5G Design and Architecture of Global Mobile Networks; Threats, Risks, Vulnerabilities; Cybersecurity Considerations. Open Res. Eur. 2022, 2, 125. DOI: https://doi.org/10.12688/openreseurope.15219.3
- Yadav, N.; Gopinathan, D. Semantic Exploring and Analysis on Visualization of Research Articles Based on Knowledge Graphs. In Proceedings of the 2023 Second International Conference on Informatics (ICI), Noida, India, 23–25 November 2023.
- Novian. Novian’s Consolidated Revenue Increased 2.4% in 2024 to EUR 38.9 Million. Available online: https://novian.io/news/novians-consolidated-revenue-increased-2-4-in-2024-to-eur-38-9-million/ (accessed on 28 November 2025).

Download
