The present invention relates to an instrumentation based program behavior acquisition and structural analysis method. The program behavior acquisition and structural analysis method comprises the following steps of: step 1. static analysis: performing control flow analysis, data flow analysis and library function analysis on a program, performing analysis on functions of the program, determining a scope of each function of the program, analyzing a structure of the program, determining an initial instrumentation position of the program, and performing a first-pass instrumentation; step 2. program behavior extraction: performing simulation execution on the program subjected to the first-pass instrumentation, extracting a program behavior in a library function running process according to a flag bit of a pile function, and storing the program behavior into a behavior library; and step 3. program behavior analysis: performing partitioning on structural characteristics shown in a program running process according to a structural partitioning rule, and performing a second-pass instrumentation, and finally performing compiling to obtain an executable file. The instrumentation based program behavior acquisition and structural analysis method provided by the present invention has an excellent software behavior acquisition ability and structural analysis ability.