A method for identifying an encrypted data stream, wherein the method comprises: parsing one or more handshake messages of an encrypted data stream according to a secure encrypted transmission protocol corresponding to the encrypted data stream, to obtain a plurality of fields comprised in the one or more handshake messages; determining, from a plurality of rule sets and based on the plurality of fields, a rule set that matches the one or more of handshake messages, wherein each of the plurality of rule sets comprises at least one of a field rule and an order rule, the field rule is used to indicate a feature of a field, the order rule is used to indicate an order of a plurality of fields in a handshake message, and the fields in the one or more of handshake messages meet a rule in the matched rule set; and determining, based on a mapping relationship between the matched rule set and an application, the application corresponding to the encrypted data stream;; wherein the identifying of the encrypted data stream does not rely on the Server Name Indication, SNI, field or the common name field; wherein the plurality of rule sets comprise field rules and order rules, and the determining, from a plurality of rule sets and based on the plurality of fields, a rule set that matches the one or more handshake messages comprises: separately matching the plurality of fields with the field rules and the order rules in the plurality of rule sets, to determine, from the plurality of rule sets, the rule set that matches the one or more handshake messages; wherein in the order rule, a type of a field is used to indicate the field; and matching the order rule requires that a packet indicated by the order rule includes a group of fields, and types of the group of fields and an order of the types in the message are the same as those described in the order rule; otherwise, the packet does not match order rule. parsing one or more handshake messages of an encrypted data stream according to a secure encrypted transmission protocol corresponding to the encrypted data stream, to obtain a plurality of fields comprised in the one or more handshake messages; determining, from a plurality of rule sets and based on the plurality of fields, a rule set that matches the one or more of handshake messages, wherein each of the plurality of rule sets comprises at least one of a field rule and an order rule, the field rule is used to indicate a feature of a field, the order rule is used to indicate an order of a plurality of fields in a handshake message, and the fields in the one or more of handshake messages meet a rule in the matched rule set; and determining, based on a mapping relationship between the matched rule set and an application, the application corresponding to the encrypted data stream;; wherein the identifying of the encrypted data stream does not rely on the Server Name Indication, SNI, field or the common name field; wherein the plurality of rule sets comprise field rules and order rules, and the determining, from a plurality of rule sets and based on the plurality of fields, a rule set that matches the one or more handshake messages comprises: separately matching the plurality of fields with the field rules and the order rules in the plurality of rule sets, to determine, from the plurality of rule sets, the rule set that matches the one or more handshake messages; wherein in the order rule, a type of a field is used to indicate the field; and matching the order rule requires that a packet indicated by the order rule includes a group of fields, and types of the group of fields and an order of the types in the message are the same as those described in the order rule; otherwise, the packet does not match order rule. separately matching the plurality of fields with the field rules and the order rules in the plurality of rule sets, to determine, from the plurality of rule sets, the rule set that matches the one or more handshake messages; wherein in the order rule, a type of a field is used to indicate the field; and matching the order rule requires that a packet indicated by the order rule includes a group of fields, and types of the group of fields and an order of the types in the message are the same as those described in the order rule; otherwise, the packet does not match order rule.