A user behavior analysis, UBA, based data mining method, the method is applied in a client/server, C/S, networking mode, comprising: obtaining to-be-processed data, wherein the to-be-processed data comprises multiple records, each record comprises application information and remote end triplet information having a correspondence relationship therebetween, and the remote end triplet information comprises a transmission protocol, a IP address of a server, and a port of a server; performing clustering processing on records with same remote end triplet information and same application information in the to-be-processed data, and according to the records with the same remote end triplet information and the same application information in the to-be-processed data, calculating a service load amount corresponding to the remote end triplet information and the application information to obtain a clustering result including the remote end triplet information, the application information, and the service load amount that have a correspondence relationship therebetween; according to the service load amount or a proportion of the service load amount, selecting remote end triplet information and application information that have high reliability and have a correspondence relationship therebetween from the clustering result; and sending the remote end triplet information and the application information that have high reliability and have a correspondence relationship therebetween to a deep packet inspection, DPI subsystem; wherein the service load amount comprises a traffic aggregate amount, the traffic aggregate amount being an amount of traffic accumulated in the records with the same remote end triplet information and the same application information, or a number of connections, the number of connections being a number of the records with the same remote end triplet information and the same application information. obtaining to-be-processed data, wherein the to-be-processed data comprises multiple records, each record comprises application information and remote end triplet information having a correspondence relationship therebetween, and the remote end triplet information comprises a transmission protocol, a IP address of a server, and a port of a server; performing clustering processing on records with same remote end triplet information and same application information in the to-be-processed data, and according to the records with the same remote end triplet information and the same application information in the to-be-processed data, calculating a service load amount corresponding to the remote end triplet information and the application information to obtain a clustering result including the remote end triplet information, the application information, and the service load amount that have a correspondence relationship therebetween; according to the service load amount or a proportion of the service load amount, selecting remote end triplet information and application information that have high reliability and have a correspondence relationship therebetween from the clustering result; and sending the remote end triplet information and the application information that have high reliability and have a correspondence relationship therebetween to a deep packet inspection, DPI subsystem; wherein the service load amount comprises a traffic aggregate amount, the traffic aggregate amount being an amount of traffic accumulated in the records with the same remote end triplet information and the same application information, or a number of connections, the number of connections being a number of the records with the same remote end triplet information and the same application information.