1. A method for recognizing a network behavior of a program, wherein the method comprises: during the program's access to a network, acquiring application layer data in a current network behavior of the program; judging whether the application layer data includes an unknown protocol; if protocols in the application layer data are all known protocols, identifying the current network behavior of the program as a network behavior of a recognizable program; if the application layer data includes an unknown protocol, identifying the current network behavior of the program as a network behavior of a suspicious program.