A common service traffic attribution method, comprising: Obtaining a feature of a packet in traffic, wherein the feature comprises a ciphertext feature, and the ciphertext feature comprises any one or more of a sequence, a length, and a transmission direction of an encrypted packet, wherein a sequence of an encrypted packet is a location in which a single packet appears in one data stream, or a sequence of an encrypted packet is location in which a single packet appears in a sequence of a plurality of packets, a length of an encrypted packet is either obtained from a field in the packet or calculated in real time, and a transmission direction of an encrypted packet includes an uplink direction or a downlink direction; analyzing the traffic based on the feature, to obtain an identification result that comprises a location of each service and a type of service to which the traffic belongs, wherein the location of a service is time point at which the service is identified, wherein the type of service to which the traffic belongs comprises a start service, an exclusive service, and a common service in the traffic, and wherein the start service is a service invoked in an application startup phase, the exclusive service is a service invoked by only one application, and the common service is a service invoked by two or more applications; and receiving the identification result and determining based on a start service and an exclusive service an application to which traffic of a common service belongs, wherein an identification time of the common service is between an identification time of a start service A and an identification time of a start service B to an application, wherein the application is an application that invokes an exclusive service whose identification time is between the identification time of the start service A and the identification time of the start service B, the start service A is any identified start service, and the start service B is a first start service whose identification time is after the identification time of the start service A. Obtaining a feature of a packet in traffic, wherein the feature comprises a ciphertext feature, and the ciphertext feature comprises any one or more of a sequence, a length, and a transmission direction of an encrypted packet, wherein a sequence of an encrypted packet is a location in which a single packet appears in one data stream, or a sequence of an encrypted packet is location in which a single packet appears in a sequence of a plurality of packets, a length of an encrypted packet is either obtained from a field in the packet or calculated in real time, and a transmission direction of an encrypted packet includes an uplink direction or a downlink direction; analyzing the traffic based on the feature, to obtain an identification result that comprises a location of each service and a type of service to which the traffic belongs, wherein the location of a service is time point at which the service is identified, wherein the type of service to which the traffic belongs comprises a start service, an exclusive service, and a common service in the traffic, and wherein the start service is a service invoked in an application startup phase, the exclusive service is a service invoked by only one application, and the common service is a service invoked by two or more applications; and receiving the identification result and determining based on a start service and an exclusive service an application to which traffic of a common service belongs, wherein an identification time of the common service is between an identification time of a start service A and an identification time of a start service B to an application, wherein the application is an application that invokes an exclusive service whose identification time is between the identification time of the start service A and the identification time of the start service B, the start service A is any identified start service, and the start service B is a first start service whose identification time is after the identification time of the start service A.