A method for determining a malicious program, comprising: decompiling an application program to obtain a code file of the application program; scanning the decompiled code file to extract a specific application programming interface, API, from the code file; determining (102, 203) call logic for calling the specific API, wherein the call logic comprises a triggering event to trigger the specific API to be called, a feedback path provided after the specific API is called, or a combination thereof; and determining (103, 204) whether the application program is a malicious program according to the call logic, characterized in that the application program is determined to be malicious when: the specific API is a function of connecting to a network to access a business for fee deductions, and the determined specific API is called having the call logic to connect to the network to access the business for fee deductions when the device is powered on to self-start without being authorized by a user for the purposes of consuming a user's network resource and a user's phone charges; or the specific API is a function of intercepting and replying a message for fee deductions and the determined specific API is called having the call logic that once the message for fee deductions is replied thereto, a user's phone charges are consumed. decompiling an application program to obtain a code file of the application program; scanning the decompiled code file to extract a specific application programming interface, API, from the code file; determining (102, 203) call logic for calling the specific API, wherein the call logic comprises a triggering event to trigger the specific API to be called, a feedback path provided after the specific API is called, or a combination thereof; and determining (103, 204) whether the application program is a malicious program according to the call logic, characterized in that the application program is determined to be malicious when: the specific API is a function of connecting to a network to access a business for fee deductions, and the determined specific API is called having the call logic to connect to the network to access the business for fee deductions when the device is powered on to self-start without being authorized by a user for the purposes of consuming a user's network resource and a user's phone charges; or the specific API is a function of intercepting and replying a message for fee deductions and the determined specific API is called having the call logic that once the message for fee deductions is replied thereto, a user's phone charges are consumed. the specific API is a function of connecting to a network to access a business for fee deductions, and the determined specific API is called having the call logic to connect to the network to access the business for fee deductions when the device is powered on to self-start without being authorized by a user for the purposes of consuming a user's network resource and a user's phone charges; or the specific API is a function of intercepting and replying a message for fee deductions and the determined specific API is called having the call logic that once the message for fee deductions is replied thereto, a user's phone charges are consumed.