Semantic integration of hybrid threat intelligence: The HiPSTer Ontological Method for cross-domain correlation in influence operations

<ns5:p>Hybrid threats exploit the interplay between informational, behavioural, psychological, and technical domains, making early detection challenging for security actors. While capabilities in Open-Source Intelligence (OSINT), Social Media Intelligence (SOCMINT), and Natural Language Processing (NLP) have advanced substantially, they remain siloed, leaving meaningful signals fragmented and limiting timely response to Foreign Information Manipulation and Interference (FIMI) campaigns. This paper presents the HiPSTer project’s methodological framework addressing this integration gap. The approach frames hybrid threat detection as structured sense-making rather than single-indicator classification, combining empirical use case reconstruction, comparative solution assessment, and ontological modelling. Its core is a semantic integration layer that combines Web Ontology Language (OWL) ontologies, Simple Knowledge Organisation System (SKOS) taxonomies, and Resource Description Framework (RDF) data integration, enabling systematic reconciliation of heterogeneous indicators while accommodating uncertainty. Assessment of nine existing solutions against 143 functionalities reveals that current platforms, while mature for foundational tasks, lack cross-domain semantic reasoning and dehumanisation detection capabilities that coordinated hybrid operations demand. The framework is evaluated through two complementary approaches: a case study demonstrating ontological reasoning over the escalation of demonisation in the Russia-Ukraine information environment, supported by query patterns that distinguish coordinated FIMI operations from organic discourse; and multilingual hate speech detection validation across English, Russian, Lithuanian, and Chinese benchmarks. A measurement model combining demonisation indicators with coordination co-indicators provides the logic for graduated threat assessment. The contribution is methodological. It outlines an approach through which hybrid threat analysis may balance analytical depth with operational usability, support explainability, and align with EU regulatory expectations under the AI Act, GDPR, and Law Enforcement Directive. All ontological artefacts, queries, indicator definitions, and visualisations are available publicly.</ns5:p>