Application analysis method and system based on encrypted stream

The embodiment of the invention provides an application analysis method and system based on an encrypted stream, and the method is executed by a processor, and comprises the steps: obtaining a to-be-analyzed encrypted stream; based on the to-be-analyzed encrypted stream, multi-dimensional traffic features are determined, and the multi-dimensional traffic features at least comprise one or more of a stream dimension feature, a data packet dimension feature, a host dimension feature and a session dimension feature; and determining an application type and an application behavior feature based on the multi-dimensional traffic feature. 本说明书实施例提供一种基于加密流的应用分析方法和系统，方法由处理器执行，包括：获取待分析加密流；基于待分析加密流，确定多维度流量特征，多维度流量特征至少包括流维度特征、数据包维度特征、主机维度特征以及会话维度特征中的一个或多个；基于多维度流量特征，确定应用类型及应用行为特征。