A method for determining security information of an unknown file in a cloud security system is provided. The method includes: a cloud security serving end receives file security querying information reported by a cloud client end when a preconfigured monitoring point is triggered, wherein the file security querying information comprises identifier information and behavior information of a file; creates a behavior sequence of the file within a lifecycle according to the file security querying information of the file, analyzes the behavior sequence of the file within the lifecycle, and determines file security information of the file according to an analyzed result.