This paper proposed a method of usi

This paper proposed a method of using server-client
correlation to improve the analysis performance (completeness)
of HTTP traffic according to application. By using server-client
correlation, it was able to extract User-Agent even if User-
Agent does not exist in HTTP traffic. During this process, it
was unable to accurately identify application but also found
that the type of service provided by a server is same when
Destination IP, Destination Port and Protocol are consistent.
The analysis rate of the existing study [7] of extracting User-
Agent for analysis was 93.1%. Through the experiment, it first
performed comparison with the information on 5 tuple one
minute ago to extract User-Agent and the analysis rate
improved by about 0.9%. It also compared with the Destination
IP, Destination Port and Protocol previously analyzed and the
analysis rate improved by about 2.7%. Consequently, it showed
improvement of 3.6% with 96.7% of improved analysis rate
(completeness).