1. A method performed by a computer device for detecting malicious behavior of a computer program, comprising: monitoring an action executed by the computer program running on the computer device; searching for a monitored process set associated with the monitored action within a library of monitored process sets, wherein the monitored process set includes information of at least two suspicious processes correlated with each other in creating relationships and logically embodies a common behavior of the two or more suspicious correlated processes contained therein, wherein the monitored process set includes process identifiers of the at least two suspicious processes, program files corresponding to the at least two suspicious processes, actions performed by the at least two suspicious processes, and historical records of data generated by the actions; and if the monitored process set associated with the monitored action is found, judging whether the monitored action belongs to malicious behavior by correlation analysis based on information recorded in the monitored process set found, wherein the monitored process set found, which is associated with the monitored action, includes information of a process initiating the monitored action, wherein the judging step comprises: comparing information of an object of the monitored action with the historical records in the monitored process set found, wherein the object of the monitored action is a file operated by the monitored action, wherein comparing includes comparing the file operated by the monitored action with file contents of historical files in the historical records, wherein the files being compared are all executable files, wherein comparing the file operated by the monitored action with file contents of historical files in the historical records further comprises comparing the file operated by the monitored action with contents of code areas of the historical files in the historical records, wherein comparing the file operated by the monitored action with contents of code areas of the historical files in the historical records comprises analyzing structures of two executable files being compared, to obtain program entry points of the executable files, analyzing section tables of the executable files, to find sections where the program entry points of the executable files are located, respectively, comparing sizes of the found sections of the two executable files, obtaining contents of the sections where the program entry points of the two executable files are located, to perform binary comparison, and if the contents of the sections are identical, then determining that the two executable files have the same code area: and judging whether the monitored action belongs to malicious behavior based on the comparing result.