A method and apparatus for uploading files are disclosed. The method includes: upon receiving a scanning instruction, obtaining unknown files on a client and putting the unknown files in a file upload queue; scanning unknown files in the file upload queue to obtain a risk coefficient for each unknown file; sorting in descending order the unknown files in the file upload queue based on the risk coefficient of the unknown files; and uploading the unknown files in the file upload queue in order to a server. The unknown files in the file upload queue are sorted so that the most suspicious files are uploaded first to ensure that the server will timely receive the most suspicious files, which greatly improves the efficiency of cloud servers in collecting suspicious files.