Behavior-based malware analysis is an important technique for automatically analyzing and detecting malware,and it has received considerable attention from both academic and industrial communities.By considering how malware behaves,we can tackle the malware obfuscation problem,which cannot be processedby traditional static analysis approaches,and we can also derive the as-built behavior specificationsand cover the entire behavior space of the malware samples.Although there have been several works focusing on malware behavior analysis,such research is far from mature,and no overviews have been put forward to date to investigate current developments and challenges.In this paper,we conduct asurvey on malware behavior description and analysis considering threeaspects: malware behavior description,behavioranalysis methods,and visualization techniques.First,existing behavior data types and emerging techniques for malware behavior descriptionare explored,especially the goals,prin-ciples,characteristics,and classifications of behavior analysis techniques proposed in the existing approaches.Second,the in-adequacies and challenges in malware behavior analysis are summarized from different perspectives.Finally,several possible directions are discussed for future research.