Provided are a method and a device for trimming a training set, and a method and a device for identifying a malicious program. The method for trimming a training set comprises: arbitrarily selecting afeature point in the training set; respectively comparing behavior characteristic represented by the selected feature point with behavior characteristics represented by feature points in first number, the feature points being closest to the selected feature point in spatial distance; if the behavior characteristic represented by the selected feature point is different from the behavior characteristic represented by at least feature points in second number in the behavior characteristics represented by feature points in the first number, trimming the selected feature point in the training set,wherein the first number is larger than the second number. In a process of training classification machine models, through comparison, feature points which have no help for improving recognition andwastes computing resources of a trainer in the training set are removed, and training efficiency of the trainer is improved.