US Patent 11706254 Method and apparatus for identifying encrypted data stream

A method includes parsing a handshake message of an encrypted data stream according to a secure encrypted transmission protocol corresponding to the encrypted data stream, to obtain a plurality of fields included in the handshake message, determining, from a plurality of rule sets and based on the plurality of fields, a rule set that matches the handshake message, and determining, based on a mapping relationship between the matched rule set and an application, an application corresponding to the encrypted data stream.