Embodiments of the present invention disclose a data mining method, apparatus, and system. The UBA-based data mining method includes: obtaining to-be-processed data, where the to-be-processed data includes multiple records, and each record includes application information and remote end triplet information having a correspondence relationship therebetween; performing clustering processing on records with same remote end triplet information and same application information in the to-be-processed data, and according to the records with the same remote end triplet information and the same application information in the to-be-processed data, calculating a service load amount corresponding to the remote end triplet information and the application information to obtain a clustering result including the remote end triplet information, the application information, and the service load amount that have a correspondence relationship therebetween; according to the service load amount or a proportion of the service load amount, selecting remote end triplet information and application information that have high reliability and have correspondence relationship therebetween from the clustering result; and sending the remote end triplet information and application information that have high reliability and have correspondence relationship therebetween to a DPI subsystem; thus DPI-based identification performance and an application identification rate can be improved.