A Graph-Based Ontology for Automotive Cyber Threat Intelligence Integration and TARA Evidence Retrieval

Threat Analysis and Risk Assessment (TARA) in automotive cybersecurity requires connecting cyber threat intelligence (CTI) with the architecture and technical context of the system under evaluation. However, relevant evidence is dispersed across heterogeneous repositories whose records do not directly establish automotive applicability or correspondence with regulatory threat categories. This paper presents an OWL 2 DL ontology linking structured CTI with automotive system concepts, selected ISO/SAE 21434 TARA concepts, UN Regulation No. 155 threat categories, and STRIDE classifications. A Neo4j implementation combines deterministic ingestion of CAPEC, CWE, and CVE/NVD records and their explicit cross-references with large-language-model-assisted candidate annotations for automotive relevance and contextual classification. Evaluation comprises ontology consistency checking with HermiT, competency-question assessment, and comparison with a human-curated automotive reference. HermiT reported no inconsistency or unsatisfiable classes. Of the 59 CAPEC Meta patterns in the reference, the evaluated output selected 52 as automotive-relevant (88.1%); label overlap was highest for technology domain (50/59) and STRIDE (49/59) and lowest for UN R155 threat categories (27/59). A headlamp proof of concept demonstrates node-centric retrieval of candidate regulatory threats, attack patterns, weaknesses, and vulnerabilities. The framework provides a semantic foundation for traceable TARA evidence preparation; product-specific applicability assessment and complete attack-path and risk analysis remain outside the demonstrated scope.