11. A method, comprising: receiving a candidate file from a client; obtaining a basic information associated with the candidate file through analyzing the candidate file; encrypting the candidate file; storing the basic information associated with the candidate file to a database and storing the encrypted candidate file to a file server; receiving a file checking task from a file checking device, wherein the file checking task comprises at least a storage address of the candidate file and the basic information associated with executing the candidate file; obtaining the candidate file using the storage address associated with the candidate file; executing the candidate file based at least in part on the basic information associated with executing the candidate file; generating a monitored action record based at least in part on monitoring the execution of the candidate file, wherein the monitored action record comprises an action associated with one or more of the following: a file creation function, a file deletion function, an information changing function, a registration table creation function, and a registration table value setting function; and sending the candidate file to the file checking device, wherein receipt of the candidate file causes the file checking device to: determine a determined set of actions included in the monitored action record that matches one or more action types included in a preset malicious action set; and determine whether the candidate file is a malicious file based at least in part on the determined set of actions.
11. A method, comprising: receiving a candidate file from a client; obtaining a basic information associated with the candidate file through analyzing the candidate file; encrypting the candidate file; storing the basic information associated with the candidate file to a database and storing the encrypted candidate file to a file server; receiving a file checking task from a file checking device, wherein the file checking task comprises at least a storage address of the candidate file and the basic information associated with executing the candidate file; obtaining the candidate file using the storage address associated with the candidate file; executing the candidate file based at least in part on the basic information associated with executing the candidate file; generating a monitored action record based at least in part on monitoring the execution of the candidate file, wherein the monitored action record comprises an action associated with one or more of the following: a file creation function, a file deletion function, an information changing function, a registration table creation function, and a registration table value setting function; and sending the candidate file to the file checking device, wherein receipt of the candidate file causes the file checking device to: determine a determined set of actions included in the monitored action record that matches one or more action types included in a preset malicious action set; and determine whether the candidate file is a malicious file based at least in part on the determined set of actions. 14. The method of claim 11 , wherein the candidate file is obtained from a file server that is identified at least in part by the storage address.