Cross-level data flow tracking method based on windows platform

The invention relates to a cross-level data flow tracking method based on a windows platform. The method includes the steps: acquiring API (application program interface) information for data exchangebetween a kernel state and a user state of a windows operation system; running a program to be analyzed and executing an instruction of the program to be analyzed; traversing processes in the operation system and acquiring a process with the name consistent with that of a process of the program to be analyzed, and marking the process as a monitored process; marking data generated by executing themonitored process as monitored data of the user state; marking kernel data mapped after input as monitored data of the kernel state if corresponding input parameters are the monitored data of the user state in the API calling process of the program to be analyzed; tracking and analyzing data flow of the monitored data of the user state and the monitored data of the kernel state, and accordingly judging whether the program