The invention provides a malicious file detection method and device. The method comprises the steps that a machine learning model is built according to structural characteristics and metadata characteristics of files of various file types obtained after unified processing; the structural characteristics and metadata characteristics of a file to be detected are obtained; a general structural characteristic model is adopted for representing the structural characteristics of the file to be detected, a general metadata characteristic model is adopted for representing the metadata characteristics of the file to be detected; the file to be detected is detected according to the machine learning model. The file to be detected is subjected to characteristic representation by adopting the general model, the files of different file types can be detected, the machine learning model does not need to be built for each file type, and the file detection efficiency is improved.