1. A server, comprising: one or more processors; one or more memories having program instructions stored thereon that are executable by the one or more processors to cause the server to perform the operations comprising: recording a black/white list in a database, which black/white list including different program features and corresponding program behaviors; receiving at least one of a program behavior and a program feature of a first program from a client; comparing the received program feature/program behavior with the recorded program feature/program behavior in the database, and making a determination on the first program based on the comparison result; feeding back the determination result to the client; wherein, when the comparison result indicates that the program behavior of the first program is included into the black/white list, the black/white list is updated by: adding a program feature of the first program that corresponds to the program behavior of the first program to the black/white list, and adding a program behavior and a program feature of a second program into the black/white list based on an associated relationship between the first program and the second program; and/or when the comparison result indicates that the program feature of the first program is included into the black/white list, the black/white list is updated by: adding a program behavior of the first program that corresponds to the program feature of the first program to the black/white list, and adding the program behavior and the program feature of the second program to the black/white list based on the associated relationship between the first program and the second program.