The invention discloses a method of tracing software abnormal behaviors based on a software functional layer. The method includes: firstly, capturing system call sequences of software functions, and figuring out a standard operating sequence of each software function state sequence; secondly, adopting software functions as points of interest of program slices, and establishing a program slicing criterion of each software function; thirdly, establishing software function transferring charts during normal software operation; and finally, acquiring a test sequence of each software function in the testing sequences, matching with the test sequence with the standard operating sequence, and detecting software abnormal behaviors. According the method, higher-layer software state models can be extracted on the basis of system call, software modeling is performed according to software function transferring manners, whether or not the software functions are abnormal can be judged by detecting errors of function state sequences, program slices are made on software abnormal behaviors, and the purpose of software tracing is achieved; reasons for software abnormal behaviors are found out from the root, and control of software behavior creditability is improved.