The final application identifier is created in the form of
combining the application identifier extracted, as shown in
Figure 1, with regular expression type pattern. The created
signature has regular expression type form and it also has the
advantage of being able to analyze same patterns with the same
application without having to newly create signature even if the
OS of client application or its version changes. Application is
analyzed by matching the created signature and User-Agent
that exists in HTTP traffic. In study [7], data during 7 days
were collected to conduct analysis, which showed about 93.3%
analysis rate (completeness) among the entire HTTP traffic.