Rogue program sample classification method and device

The invention discloses a rogue program sample classification method and device. The method comprises the following steps: carrying out dynamic clustering on rogue program samples to obtain a dynamic clustering result of the rogue program samples; carrying out static clustering on the rogue program samples to obtain a static clustering result of the rogue program samples; and screening the dynamic clustering result according to the static clustering result, and forming a rogue program sample database based on the screened dynamic clustering result. With the adoption of the rogue program sample classification method and device disclosed by the invention, the accuracy of classifying the rogue program samples can be improved.