Abstract: A method for generating an application white list is applicable to a server. The method is performed by a computing device communicably connected to the server and includes following steps: collecting a network log and a system log of the server, performing an analysis procedure to extract a plurality of application attributes from the network log and the system log with one of the application attributes being an application identifier, performing a training procedure according to the plurality of application attributes to generate a candidate rule, according to a plurality of behaviors in the network log and the system log, calculating the ratio of the number of behaviors among said plurality of behaviors that conforming to the candidate rule to a number of all of said plurality of behaviors, and storing the candidate rule to a whitelist when the ratio falls within a trust interval.