A data mining method, apparatus, and system are provided. The method includes: obtaining to-be-processed data, where the to-be-processed data includes records, and each record includes application information and remote end triplet information; performing clustering processing on records with same remote end triplet information and same application information, and according to the records with the same remote end triplet information and the same application information, calculating a service load amount corresponding to the remote end triplet information and the application information to obtain a clustering result including the remote end triplet information, the application information, and the service load amount; according to the service load amount or a proportion of the service load amount, selecting remote end triplet information and application information that have high reliability from the clustering result; and sending the remote end triplet information and application information that have high reliability to a deep packet inspection (DPI) subsystem.