A data stream classification model updating method is disclosed. Determining, based on packet information of a current data stream and a behavior classification model, a first data stream class corresponding to the current data stream; determining, based on a target correspondence and a common feature of the current data stream, a second data stream class corresponding to the current data stream, where the target correspondence is a correspondence between a plurality of common features and a plurality of data stream classes; and if the first data stream class is different from the second data stream class, obtaining correction data corresponding to the current data stream, where the correction data includes the packet information of the current data stream and the second data stream class, and the correction data is used as a training sample to update the behavior classification model.