or multiple clients provides the requested service. Based on this
characteristic, there is a high probability that flow with the
same information on 3 tuple (Destination IP, Destination Port,
and Protocol) occurred through the same application.
Accordingly, it is presumed in this paper that when the IP
(Destination IP) and port (Destination Port) of a particular
server are consistent, the same service is provided to client,
which will be referred to as having server-client correlation [9].