1. A method for recognizing a network behavior of a program, the method comprising: during the program's access to a network, acquiring, by a processor, application layer data in a current network behavior of the program; determining, by the processor, whether the application layer data includes an unknown protocol; if protocols in the application layer data are all known protocols, identifying, by the processor, the current network behavior of the program as a network behavior of a recognizable program; acquiring, by the processor, feature information in the application layer data in the network behavior of the recognizable program, the feature information comprising partial codes in the application layer data, a data packet in the application layer data, or a segment of data in the data packet in the application layer data; sending, by the processor, the feature information to a cloud server, the cloud server determining whether the network behavior of the recognizable program is the network behavior of a malicious program according to the feature information, and returning a result; and if the application layer data includes the unknown protocol, identifying, by the processor, the current network behavior of the program as a network behavior of a suspicious program.