Under　the　framework　of　TNC,　a　new　method　was　proposed　to　calculate　the　＂healthy　status＂　of　a　terminal　based　on　analyzing　the　real-time　characteristics　of　its　behavior　and　process　activity.　Compared　with　the　existing　method,　which　based　on　static　characteristics,　the　strategy　could　get　a　better　performance,　especially,　on　identifying　and　isolating　the　terminals　with　potential　risk.　The　experimental　result　also　shows　that　the　proposed　algorithm　has　the　capability　of　finding　and　isolating　terminals　which　are　infected　by　malicious　codes.