The invention discloses a method and a device for identifying the malicious message. The method comprises the following steps: aggregation degree of each type of same message characteristics at each dimension of training information sources in each analysis period are identified; if the aggregation degree of the type of the same message characteristics at one dimension is higher than or equal to an aggregation threshold value corresponding to the dimension, the same message characteristics, of which the aggregation degree is larger than or equal to the aggregation threshold value, are extracted and added to a malicious message characteristic set; message characteristics positioned at other dimensions and included in a message, to which each of the same message characteristics of the aggregation degree, larger than or equal to the aggregation threshold value corresponding to the dimension, belongs are extracted from the message, and added to the malicious message characteristic set; when an information resource input by a user is detected, a message, to which a malicious message characteristic included in the information source belongs, is identified as a malicious message if a message characteristic included in the information source belongs to the malicious message characteristic set according to judgment. Through the adoption of the method, the identification rate of malicious messages can be improved.