1. A method for normalizing behavior of a computer system, comprising: obtaining a calling instruction; obtaining, based on the calling instruction, information of a first code segment called by the calling instruction from a non-transitory memory device; establishing a code segment calling data structure, where establishing the code segment calling data structure is a dynamic process, wherein a second code segment, where the calling instruction is located, is taken as a node, and a calling relations set up by the calling instruction between the second code segment initiating the calling instruction and the first code segment called by the calling instruction is taken as a calling path, wherein the code segment calling data structure comprises a plurality of sub-data structures, where each of the plurality of sub-data structures comprises a plurality of nodes and a plurality of calling paths, and the plurality of nodes are one-by-one coupled by the plurality of calling paths; obtaining a sub-data structure associated with a current operation request from a code segment calling data structure, and determining, based on the sub-data structure, an initiator, an operation method, and an operation object of the current operation request; obtaining a rule for normalizing behavior of the computer system, the rule being determinable and adaptable based on a variety of considerations; and determining whether the current operation request is permissible by determining if the initiator and at least one of the operation method and the operation object satisfy the rule.