The result shown in Table 1 confirmed that User-Agent is
the same when information on 5 tuple is consistent. If User-
Agent cannot be extracted despite this process, analysis is
performed based on server-client correlation. This process is
explained in details in Section 3.2. The information on User-
Agent extracted in this way is sent for analysis to signature-
based HTTP application analysis system [7], as introduced
earlier.