Characteristic extraction method and device

The invention discloses a characteristic extraction method and device. The characteristic extraction method comprises obtaining a group of black sample files and white sample files from an application program layer of an intelligent terminal operating system; performing resolution on every file to obtain information structures of functions contained in every file and calculating a check code of every function; determining whether the files comprise the functions corresponding to the check codes or not so as to perform statistics on the number of times of every function appearing in the black sample files and the white sample files; extracting out the black sample characteristics according to the functions which only appear in the black sample files and do not appear in the white sample files and extracting out the white sample characteristics in the same way. Accordingly, the statistics of the number of times of every function check code appearing in the files is performed through analysis and calculation on the obtained black sample files and white sample files and the functions which only appear in the black sample files and do not appear in the white sample files serve as the basis of the extraction of the black sample characteristics.