This application discloses a method, apparatus and storage medium for application identification. A network device performs flow behavior feature analysis according to a flow table to obtain a plurality of services. Each service includes one IP address and one port identifier, and one application may usually include a group of services. Therefore, the network device clusters the plurality of services according to the flow table and a domain name table, to obtain a plurality of application types. Each application type includes a plurality of services. Each application type corresponds to one application. Further, the network device may determine a label corresponding to each of the plurality of application types, the label identifying an application to which a data flow belongs.