Malware tracking method based on cloud safety

The invention discloses a malware tracking method based on cloud safety. The method includes: recording information of a file generated in local equipment by known to-be-tracked software to a first database, wherein the file has the same recording identification as the software; recording information of a downloaded file downloaded from the Internet to the equipment and the recording identification of the downloaded file to a second database; when software in the equipment is started, inquiring the first database and/or the second database to judge whether the software needs to be tracked or not; if so, acquiring corresponding information of the downloaded file from the second database according to known recording identification of the software so as to obtain tracking information; recording information of the file generated in the local equipment by the software to the first database, and setting recording identification of the file to be the same as the software.