APPLICATION IDENTIFICATION METHOD, AND DATA MINING METHOD, APPARATUS, AND SYSTEM

摘要

A data mining method, apparatus, and system are provided. The user behavioranalysis (UBA)-based data mining method includes: obtaining to-be-processeddata, wherethe to-be-processed data includes multiple records, and each record includesapplicationinformation and remote end triplet information having a correspondencerelationshiptherebetween; performing clustering processing on records with same remote endtripletinformation and same application information in the to-be-processed data, andaccording tothe records with the same remote end triplet information and the sameapplication informationin the to-be-processed data, calculating a service load amount correspondingto the remote endtriplet information and the application information to obtain a clusteringresult including theremote end triplet information, the application information, and the serviceload amount thathave a correspondence relationship therebetween; according to the service loadamount or aproportion of the service load amount, selecting remote end tripletinformation and applicationinformation that have high reliability and have correspondence relationshiptherebetweenfrom the clustering resu and sending the remote end triplet information andapplicationinformation that have high reliability and have correspondence relationshiptherebetween to adeep packet inspection (DPI) subsystem; thus DPI-based identificationperformance and anapplication identification rate can be improved.