A semantic based method is presented to analyze malicious behavior in software, with more precise description of function call based attacks, and flow sensitive, context sensitive and path sensitive inter-procedure analysis ability. Experiments on malicious and benign programs show that it is effective to identify malicious behavior in software.

A novel recognition algorithm is proposed. Compared with previous works, the algorithm is deterministic rather than heuristic, and it does not use complicated data structures. The new algorithm is more accurate than typical current approaches; furthermore, the new method has been applied to several real-world binaries, and experimental results validate such theoretical analysis.