The invention discloses a virus library acquiring method and device, equipment, a server and a system. The method includes the following steps: obtaining a sample set, wherein samples in the sample set are malicious installation packages; extracting a group of sample characteristics from each sample to obtain a sample characteristic set, wherein the sample characteristic set includes all of the extracted sample characteristics; conducting characteristic selection on the sample characteristic set to obtain at least one group of target characteristics, wherein the target characteristics are the characteristics, meeting the first condition, in the sample characteristic set; updating the at least one group of target characteristics to a virus database.