If it was unable to extract User-Agent even after comparing
with information on flow that was created a minute ago, the
information of existing flow analyzed and the information of
current flow such as Destination IP, Destination Port and
Protocol are compared. Signature-based HTTP application
analysis system performs analysis on the flow information
analyzed previously, while also saving the 5 tuple and User-
Agent information in a file format and comparing with flow
that is not possible to analyze due to the absence of User-Agent
field in the saved information. When saving information as the
file, linked list is used to remove redundant contents to save as
the file. Table 2 shows the result of extracting User-Agent
when the 3 tuple information on flow analyzed and the 3 tuple
information of current flow are consistent.