A method performed by a data processing device for identifying application information in network traffic, comprising: receiving a first identification record from a network security device, wherein the first identification record comprises an identifier of a first data stream and an identifier of an application sending the first data stream, and the identifier of the first data stream is a first 5-tuple comprising a source address, a source port, a destination address, a destination port, and a protocol identifier of the first data stream; receiving a second identification record and a correspondence table from a terminal device, wherein the second identification record comprises an identifier of a second data stream and an identifier of a process creating the second data stream, the identifier of the second data stream is a second 5-tuple comprising a source address, a source port, a destination address, a destination port, and a protocol identifier of the second data stream, and each record in the correspondence table comprises an identifier of an application running on the terminal device and an identifier of a process created by the application running on the terminal device; determining whether the identifier of the first data stream comprised in the first identification record is the same as the identifier of the second data stream comprised in the second identification record; if the identifier of the first data stream comprised in the first identification record is the same as the identifier of the second data stream comprised in the second identification record, querying whether a first association record exists in the correspondence table, wherein the first association record comprises the identifier of the application comprised in the first identification record and the identifier of the process comprised in the second identification record; and if the first association record does not exist, determining that the first identification record is an incorrect identification record. receiving a first identification record from a network security device, wherein the first identification record comprises an identifier of a first data stream and an identifier of an application sending the first data stream, and the identifier of the first data stream is a first 5-tuple comprising a source address, a source port, a destination address, a destination port, and a protocol identifier of the first data stream; receiving a second identification record and a correspondence table from a terminal device, wherein the second identification record comprises an identifier of a second data stream and an identifier of a process creating the second data stream, the identifier of the second data stream is a second 5-tuple comprising a source address, a source port, a destination address, a destination port, and a protocol identifier of the second data stream, and each record in the correspondence table comprises an identifier of an application running on the terminal device and an identifier of a process created by the application running on the terminal device; determining whether the identifier of the first data stream comprised in the first identification record is the same as the identifier of the second data stream comprised in the second identification record; if the identifier of the first data stream comprised in the first identification record is the same as the identifier of the second data stream comprised in the second identification record, querying whether a first association record exists in the correspondence table, wherein the first association record comprises the identifier of the application comprised in the first identification record and the identifier of the process comprised in the second identification record; and if the first association record does not exist, determining that the first identification record is an incorrect identification record.