1. A server, comprising: one or more processors; one or more memories having program instructions stored thereon that are executable by the one or more processors to cause the server to perform the operations comprising: recording a black/white list in a database, which black/white list including different program features and corresponding program behaviors; receiving at least one of a program behavior and a program feature of a program from a client; comparing the received program feature/program behavior with the recorded program feature/program behavior in the database, and making a determination on the program based on the comparison result; feeding back the determination result to the client; and establishing an associated relationship between a first program and a second program based on their program features and their program behaviors; based on the program features and the corresponding program behaviors thereof in the black/white list, performing an analysis of unknown program features and program behaviors of the first program and the second program to update the black/white list.