1. A method, comprising: receiving a candidate file from a client; obtaining a basic information associated with the candidate file through analyzing the candidate file; encrypting the candidate file; storing the basic information associated with the candidate file to a database and storing the encrypted candidate file to a file server; receiving a file checking task, wherein the file checking task comprises a storage address of the candidate file and the basic information associated with executing the candidate file; sending the file checking task to a detection device, wherein the file checking task causes the detection device to: use the storage address to acquire the candidate file from the file server; execute the candidate file based at least in part on the basic information associated with the candidate file; monitor the execution of the candidate file; and generate a monitored action record corresponding to the execution of the candidate file; receiving the monitored action record from the detection device, wherein the monitored action record comprises an action associated with one or more of the following: a file creation function, a file deletion function, an information changing function, a registration table creation function, and a registration table value setting function; determining a set of actions included in the monitored action record that matches one or more action types included in a preset malicious action set; and determining whether the candidate file is a malicious file based at least in part on the determined set of actions.
1. A method, comprising: receiving a candidate file from a client; obtaining a basic information associated with the candidate file through analyzing the candidate file; encrypting the candidate file; storing the basic information associated with the candidate file to a database and storing the encrypted candidate file to a file server; receiving a file checking task, wherein the file checking task comprises a storage address of the candidate file and the basic information associated with executing the candidate file; sending the file checking task to a detection device, wherein the file checking task causes the detection device to: use the storage address to acquire the candidate file from the file server; execute the candidate file based at least in part on the basic information associated with the candidate file; monitor the execution of the candidate file; and generate a monitored action record corresponding to the execution of the candidate file; receiving the monitored action record from the detection device, wherein the monitored action record comprises an action associated with one or more of the following: a file creation function, a file deletion function, an information changing function, a registration table creation function, and a registration table value setting function; determining a set of actions included in the monitored action record that matches one or more action types included in a preset malicious action set; and determining whether the candidate file is a malicious file based at least in part on the determined set of actions. 5. The method of claim 1 , wherein determining whether the candidate file is the malicious file based at least in part on the determined set of actions comprises determining whether matching malicious actions included in the determined set of actions exceeds a preset malicious action threshold value.