According to the software network communication behavior, a reverse analytical method based on session association was proposed in this paper. The method restored the network traffic communication session and Application Programming Interface (API) sequence session produced by software firstly, then associated the sessions restored. Through the association, a direct mapping was built between two kinds of software network behavior analytical methods based on execution trace analysis and network traffic analysis respectively. The prototype system was designed and completed. Based on the system, the function call list was extracted. The reverse analytical method based on session association makes the reverse analysis of software network behaviors fast and convenient.