Abstract: Threat intelligence analysis is a crucial means to enhance proactive defense capabilities. Research on the construction of malware knowledge graphs holds significant importance for improving malware detection capabilities. In the construction of malware knowledge graphs, the accuracy and completeness of entity and relation extraction still require further improvement. This paper proposed a method for constructing malware knowledge graphs based on a joint extraction model. Firstly, a malware ontology model was proposed for threat intelligence analysis, defining 12 types of relations to standardize the expression of key knowledge about malware. Then, a joint extraction model based on RoBERTa with whole word masking (RoBERTa-Wwm) and pointer annotation was proposed to extract malware entities and their relations, thereby constructing a graph. The experiment demonstrates that the model achieves good performance with an F1 value of up to 0.841. This study is of great significance for the automatic analysis of malware threat intelligence, laying the foundation for improving proactive defense capabilities.

Key words: malware, knowledge graph, threat intelligence, entity extraction, relation extraction