Abstract: Through studying software network behavior, a new system model for analyzing the software network behavior based on dynamic binary analysis and message semantics analysis was proposed. The system consisted of dynamic binary analysis module, message semantics analysis module and network behavior analyzer. With the dynamic binary analysis, the Application Programming Interface (API) functions and system functions called by software could be obtained; by using the dynamic taint analysis, the message semantics could be extracted. The experimental results show that, combining the dynamic binary analysis and message semantics extraction can be used for analyzing the software network behavior.

Key words: dynamic binary analysis, dynamic taint analysis, message semantics extraction, Application Programming Interface (API)

摘要： 通过对软件网络行为的研究，提出了通过结合动态分析软件行为技术和网络消息语义解析技术对软件网络行为进行分析的系统模型。系统主要由动态二进制分析模块、消息语义解析模块和网络行为分析模块组成。通过动态二进制分析，利用行为监控和劫持机制，获取软件对于应用程序编程接口(API)函数和系统函数的调用情况；通过动态污点分析，对消息语义进行解析。实验验证表明，软件行为和消息语义解析的结合可以用于分析软件网络行为。

关键词: 动态二进制分析, 动态污点分析, 消息语义解析, 应用程序编程接口