二进制代码逆向分析是恶意代码检测与处理的关键环节，恶意代码功能结构复杂、对抗手段先进、爆发规模大且变种速度快等特征对逆向分析技术提出各种挑战。本项目旨在利用动静协同和机器学习等方法和技术，通过实现二进制代码特征的自动智能捕捉、恶意代码机理的自动深度分析以及恶意代码的智能判定，来实现恶意代码逆向分析的自动化和智能化。重点将从基于函数属性智能识别的代码功能结构关系和基于数据流跟踪的行为依赖关系这两方面研究入手，设计代码特征自动采集方法；研究针对功能、渗透和对抗机理的深度分析方法，结合所提取的反映恶意代码相似性和差异性的有效特征，构建共享知识库；以此为基础，设计高效、精确、跨平台的恶意代码特征融合算法，建立普适、智能的恶意代码家族划分和同源判定的机制。通过本项目研究，最终建立一套恶意代码深度分析方法体系，并研制相关的原型工具进行验证评估，从而有效提升恶意代码的分析检测能力。

Reverse analysis of binary code is critical to detect and handle malicious software/code (malware). Current malware volume is growing very fast with complex function structures and advanced code obfuscation. But most new malware are variants of the existing malware. These facts challenge significantly reverse analysis techniques. This project aims to automate malware reverse analysis in an intelligent way, by making collection of binary code features, in-depth analysis of malware behaviors、malware detection automatic and intelligent. The detailed research includes obtaining code function structure based on function attribute identification and obtaining behavior dependency based on tracking data flow. We aim to propose a method for capturing kinds of binary code features. We then carry out in-depth analysis of functionalities, penetration features and code obfuscation. Based on features which could effectively reflect the similarity and difference of malware, we build a shared knowledge database. Finally, we design an effective and cross-platform mechanism for malware feature fusion, and establish a universal model of malware family detection and homology determination. Through this project, we eventually establish an in-depth malware analysis system, and develop related prototype tools for verification and evaluation, effectively improving the ability of malware analysis and detection.