A method for detecting a malicious process behavior, comprising: a detection apparatus monitoring a process behavior of a process to obtain behavior information about a target process behavior; said detection apparatus sending the behavior information about said target process behavior to a server, so that said server detects said target process behavior according to the behavior information about said target process behavior so as to determine whether said target process behavior is a malicious process behavior; wherein the server determines whether the target process behavior is a malicious process behavior by matching the behavior information about the target process behavior to a behavior information about a malicious process behavior, the behavior information about the malicious process behavior being stored in a malicious behavior decision-making library; and said detection apparatus receiving first operation indication information returned by said server according to the detection result of said target process behavior; and said detection apparatus performing an operation on said target process behavior according to said first operation indication information; and wherein, the server determines that an unknown target process behavior is a malicious process behavior based on clustering analysis carried out by the server of the behavior information about at least one malicious process behavior stored in the malicious behavior decision-making library so as to obtain similar behavior information, an unknown target process behavior being a target process behavior for which the behavior information about the target process behavior does not match behavior information about each of one or more malicious process behaviors stored in the malicious behavior decision-making library, and when the server determines that the unknown target process behavior is a malicious process behavior, the server adds the behavior information about the determined target process behavior to the malicious behavior decision-making library. a detection apparatus monitoring a process behavior of a process to obtain behavior information about a target process behavior; said detection apparatus sending the behavior information about said target process behavior to a server, so that said server detects said target process behavior according to the behavior information about said target process behavior so as to determine whether said target process behavior is a malicious process behavior; wherein the server determines whether the target process behavior is a malicious process behavior by matching the behavior information about the target process behavior to a behavior information about a malicious process behavior, the behavior information about the malicious process behavior being stored in a malicious behavior decision-making library; and said detection apparatus receiving first operation indication information returned by said server according to the detection result of said target process behavior; and said detection apparatus performing an operation on said target process behavior according to said first operation indication information; and wherein, the server determines that an unknown target process behavior is a malicious process behavior based on clustering analysis carried out by the server of the behavior information about at least one malicious process behavior stored in the malicious behavior decision-making library so as to obtain similar behavior information, an unknown target process behavior being a target process behavior for which the behavior information about the target process behavior does not match behavior information about each of one or more malicious process behaviors stored in the malicious behavior decision-making library, and when the server determines that the unknown target process behavior is a malicious process behavior, the server adds the behavior information about the determined target process behavior to the malicious behavior decision-making library.