1. A method for determining a malicious program, comprising: obtaining a specific application programming interface (API) within an application program; determining call logic for calling the specific API, wherein the call logic comprises a triggering event to trigger the specific API to be called, a feedback path provided after the specific API is called, or a combination thereof; and determining whether the application program is a malicious program according to the call logic.