| CPC H04L 47/2441 (2013.01) [G06N 20/00 (2019.01); H04L 41/145 (2013.01); H04L 41/147 (2013.01); H04L 47/2483 (2013.01)] | 20 Claims |

|
1. A method comprising:
determining, by an electronic device in a communication system based on packet information of a current data stream and a behavior classification model, that the current data stream belongs to a first data stream class, wherein the packet information comprises one or more of a packet length, a packet transmission speed, a packet time interval, or a packet direction, and the behavior classification model is a model obtained through training based on packet information and data stream classes of a plurality of data stream samples;
determining, by the electronic device based on a target correspondence and a common feature of the current data stream, that the current data stream belongs to a second data stream class, wherein the target correspondence is a correspondence between a plurality of common features and a plurality of data stream classes; and
when the first data stream class is different from the second data stream class, obtaining, by the electronic device, correction data corresponding to the current data stream, wherein the correction data corresponding to the current data stream comprises the packet information of the current data stream and the second data stream class, and the correction data is used as a training sample to update the behavior classification model.
|