Abstract:In this paper, a novel method is presented to solve these problems. This method processes the X86 executable programs statically, so it has a higher code coverage than dynamic methods. Besides, it employs a data flow analysis method to identify the jump targets for indirect jumps. It also utilizes optimized tainting mark rules based on the operation semantic of branch conditions. Experiments on 103 real malwares and 7 benign softwares show that the proposed method has the following advantages: For Trojan-spy program detection, it can reduce the false negatives caused by the explicit-flow-sensitive method, and it is effective in dealing with information steal behaviors triggered by some particular conditions. For benign program analysis, it can reduce most of the tainted branches that should be tracked in the original implicit-flow-sensitive method without optimization.