TRAFFIC ANALYSIS METHOD, PUBLIC SERVICE TRAFFIC ATTRIBUTION METHOD AND CORRESPONDING COMPUTER SYSTEM

摘要

This application provides a traffic analysis method and apparatus, and a computer system. The method includes: obtaining a plaintext feature and a ciphertext feature of a packet in traffic, where the ciphertext feature includes a length feature of an encrypted field in the packet; and analyzing the traffic based on the plaintext feature and the ciphertext feature, to identify a service or an application to which the traffic belongs. The method may be used for service identification or application identification. The ciphertext feature is introduced in traffic analysis, so that traffic identification accuracy is improved in a packet encryption scenario. In addition, this application further provides a common service traffic attribution method and apparatus, and a computer system. A start service and/or an exclusive service of an application are/is identified, and common service traffic is attributed to a corresponding application, thereby improving application traffic attribution accuracy, and providing a basis for a subsequent service, for example, application traffic charging.