The invention relates to a malicious application detection method and 
system. The method comprises the steps of S1, performing static code scanning on a received to-be-detected application, analyzing whether the application has a malicious behavior conforming to any malicious behavior information in a malicious behavior information 
library or not based on three dimensions of right application, function call and information output, if the malicious behavior exists, marking the application as a suspected malicious application, and if the malicious behavior does not exist, marking the application as a normal application; and S2, performing application name, 
package name, signature 
certificate, 
directory structure, 
text file and image file-based 
similarity analysis between the application marked as the suspected malicious application and a malicious application sample in a malicious application sample 
library, and marking the application with the similarity conforming to a set value as a malicious application. According to the method and the 
system, the performance 
bottleneck of loading the application through a 
virtual machine for execution and analysis is avoided, the 
false alarm rate is effectively reduced, and the accuracy of identification is improved.