File recognition method and apparatus

The present application discloses a file recognition method and apparatus. The file recognition method comprises: determining a virus family of each malicious file sample among file samples; dividing the virus family into at least one sample group based on a quantity of malicious file samples in each virus family; separately training malicious file samples in each sample group by using different training rules, to obtain at least one file recognition model; and determining whether a to-be-recognized file is a malicious file by using the at least one file recognition model. According to the file recognition method provided by an implementation manner of the present application, different recognition models may be established for different types of malicious files, so that recognition accuracy is improved.