14. The apparatus according to claim 1 , wherein the signature frequency table includes a field denoting an observation period of each entry.
14. The apparatus according to claim 1 , wherein the signature frequency table includes a field denoting an observation period of each entry. 15. The apparatus according to claim 14 , wherein the signature candidate extractor increases the frequency of signatures if an observation period is not elapsed and increases the frequency of a signature after initializing the frequency of a signature if an observation period is elapsed when a currently analyzing signature is present in the signature frequency table, and increases the frequency of signatures after generating and initializing an new entry for a signature when the currently analyzing signature is not present in the signature frequency table.