A program file classification method , comprising: obtaining (S310), by a classification server, behavior information respectively corresponding to at least two behaviors executed by a program file at runtime, wherein each piece of behavior information comprises a behavior identifier and a path related during execution of a corresponding behavior, wherein each of the at least two behaviors is an Application Programming Interface, API, call of the program file to an operation system at runtime, the API call is one of file reading, file writing, memory allocation, network input, network output, a hardware device operation, system configuration reading, system configuration writing, and a registry operation, and the path comprises M levels of directories of a file, a file name and a file name extension, or S levels of subkeys of a registry; performing (S320), by the classification server, normalization processing on the path in each piece of behavior information, wherein the normalization processing is used to reduce path diversity; generating (S330), by the classification server, a feature vector according to at least two pieces of behavior information obtained after the path normalization processing, wherein each element in the feature vector corresponds to one piece of behavior information obtained after the path normalization processing, values of elements corresponding to same behavior information obtained after the path normalization processing are the same, and the same behavior information is behavior information that has a same behavior identifier and a same path obtained after the normalization processing; and determining (S340), by the classification server, according to the feature vector, a category to which the program file belongs. obtaining (S310), by a classification server, behavior information respectively corresponding to at least two behaviors executed by a program file at runtime, wherein each piece of behavior information comprises a behavior identifier and a path related during execution of a corresponding behavior, wherein each of the at least two behaviors is an Application Programming Interface, API, call of the program file to an operation system at runtime, the API call is one of file reading, file writing, memory allocation, network input, network output, a hardware device operation, system configuration reading, system configuration writing, and a registry operation, and the path comprises M levels of directories of a file, a file name and a file name extension, or S levels of subkeys of a registry; performing (S320), by the classification server, normalization processing on the path in each piece of behavior information, wherein the normalization processing is used to reduce path diversity; generating (S330), by the classification server, a feature vector according to at least two pieces of behavior information obtained after the path normalization processing, wherein each element in the feature vector corresponds to one piece of behavior information obtained after the path normalization processing, values of elements corresponding to same behavior information obtained after the path normalization processing are the same, and the same behavior information is behavior information that has a same behavior identifier and a same path obtained after the normalization processing; and determining (S340), by the classification server, according to the feature vector, a category to which the program file belongs. <EOS>