1. A server, comprising: a white list, said white list storing legitimate program features or legitimate program behaviors; a processor coupled with a memory, said processor executing the following software programs stored in the memory: a first software program, said first software program receiving a program feature or a program behavior of an unknown program to be detected using spider or web crawler sent from a client; a second software program, said second software program comparing the program feature or the program behavior of the detected program with the legitimate program features or the legitimate program behaviors stored in the white list; and a third software program, said third software program obtaining a legitimacy information of the unknown program based on the comparison result and feeding the legitimacy information back to the client; a fourth software program, said fourth software program establishing an associated relationship between a program behavior and another program behavior as well as between a program feature and a corresponding program feature; a fifth software program, said fifth software program updating the white list based on the associated relationship; wherein said fifth software program updates the white list by: when a certain program behavior is included in the white list, including in the white list a program feature corresponding to the certain program behavior, and also including other program behaviors and program features having the associated relationship with the certain program behavior in the white list; or when a certain program feature is included in the white list, including in the white list a program behavior corresponding to the certain program feature, and also including other program behaviors and program features having the associated relationship with the certain program feature in the white list.