By introducing process algebra to analyze system call sequences, a model of description and detection concurrent behavior was presented. Firstly, control flow graphs of system (CFGs) were generated by static binary code analysis. Secondly, by analyzing CFGs, process expressions were generated. Then according to synchronization and mutex of concurrent behaviors, process expressions were rewritten by adding concurrent operation. By extending algebraic properties and algorithms, three basic elements (action, operator and process) were constructed. Finally, the CBDPA model was constructed and concurrent behavior detection methods were given. Experiments demonstrated that this method has linear space-time complexity.
