1. A method for normalizing behavior of a computer system, comprising: obtaining a calling instruction, obtaining information of a code segment to be called by the calling instruction based on the calling instruction, and establishing a code segment calling data structure, wherein the code segment calling data structure is established by taking a code segment in which the calling instruction is located as a node and taking a calling relation that is established by the calling instruction between a code segment initiating the calling instruction and the code segment to be called as a calling path, and the code segment calling data structure comprises several sub-data structures; obtaining a sub-data structure associated with a current operation request from the data structure, and determining an initiator, an operation method and an operation object of the current operation request based on the sub-data structure; and obtaining a rule for normalizing behavior of the computer system, comparing the determined initiator, the determined operation method and the determined operation object of the current operation request with the rule, and determining whether the current operation request is permissible.