An apparatus for detecting a terminal security status, wherein the apparatus is a sandbox, the sandbox is arranged at a gateway and is located at a junction between a private network and a public network, and a terminal is located in the private network, and the apparatus comprises: a dynamic behavior result generation module, configured to: receive a file from a firewall that is arranged at the gateway, and run the file in the apparatus to generate a dynamic behavior result, wherein the dynamic behavior result comprises a behavior sequence that is generated according to a chronological order of occurrence of behaviors, behaviors in the behavior sequence belong to different behavior types, and the behavior types comprise creating a file, modifying a registry, configuring a domain name, resolving an address, connecting to a network, loading a process, and adding a user; a dynamic behavior analysis module, configured to determine, according to the dynamic behavior result generated by the dynamic behavior result generation module, whether the file comprises an advanced persistent threat; and an indicator of compromise generator, configured to: if the dynamic behavior analysis module determines that the file comprises the advanced persistent threat, obtain a stable behavior feature in the dynamic behavior result, generate a corresponding indicator of compromise according to the stable behavior feature, and send the indicator of compromise to the terminal, wherein the stable behavior feature is a behavior always existing in a behavior sequence that is generated each time after the file is run; characterised in that the indicator of compromise generator is configured to implement the following steps to obtain a stable behavior feature in the dynamic behavior result: running the file in the apparatus twice, to separately obtain a behavior sequence that is obtained after each time of running, so as to obtain a first behavior sequence and a second behavior sequence; determining identical behaviors that exist in the first behavior sequence and the second behavior sequence, wherein the identical behaviors are behaviors that are the same in terms of behavior types and behavior content; and obtaining a set formed by the identical behaviors in the first behavior sequence and the second behavior sequence, and use the set as the stable behavior feature. a dynamic behavior result generation module, configured to: receive a file from a firewall that is arranged at the gateway, and run the file in the apparatus to generate a dynamic behavior result, wherein the dynamic behavior result comprises a behavior sequence that is generated according to a chronological order of occurrence of behaviors, behaviors in the behavior sequence belong to different behavior types, and the behavior types comprise creating a file, modifying a registry, configuring a domain name, resolving an address, connecting to a network, loading a process, and adding a user; a dynamic behavior analysis module, configured to determine, according to the dynamic behavior result generated by the dynamic behavior result generation module, whether the file comprises an advanced persistent threat; and an indicator of compromise generator, configured to: if the dynamic behavior analysis module determines that the file comprises the advanced persistent threat, obtain a stable behavior feature in the dynamic behavior result, generate a corresponding indicator of compromise according to the stable behavior feature, and send the indicator of compromise to the terminal, wherein the stable behavior feature is a behavior always existing in a behavior sequence that is generated each time after the file is run; characterised in that the indicator of compromise generator is configured to implement the following steps to obtain a stable behavior feature in the dynamic behavior result: running the file in the apparatus twice, to separately obtain a behavior sequence that is obtained after each time of running, so as to obtain a first behavior sequence and a second behavior sequence; determining identical behaviors that exist in the first behavior sequence and the second behavior sequence, wherein the identical behaviors are behaviors that are the same in terms of behavior types and behavior content; and obtaining a set formed by the identical behaviors in the first behavior sequence and the second behavior sequence, and use the set as the stable behavior feature. running the file in the apparatus twice, to separately obtain a behavior sequence that is obtained after each time of running, so as to obtain a first behavior sequence and a second behavior sequence; determining identical behaviors that exist in the first behavior sequence and the second behavior sequence, wherein the identical behaviors are behaviors that are the same in terms of behavior types and behavior content; and obtaining a set formed by the identical behaviors in the first behavior sequence and the second behavior sequence, and use the set as the stable behavior feature.