11. The method of claim 10 further comprising: intercepting text changing operations performed by the application program to change text of the GUI window.
11. The method of claim 10 further comprising: intercepting text changing operations performed by the application program to change text of the GUI window. 12. The method of claim 11 wherein receiving the text content comprises: performing optical character recognition (OCR) on a painted portion of a graphical user interface (GUI) window of the application program to receive a first portion of the text content; intercepting text changing operations performed by the application program to change text of the GUI window to receive a second portion of the text content; and providing the first portion and second portion of the text content to a learning model to obtain the classification and find that the application program belongs to the antivirus category.