An application detection method includes running one or more applications in various application scenarios on one or more user devices for a predetermined time period, capturing network traffic data generated by the one or more applications, labelling the network traffic data according to an application scenario of the one or more applications and with respect to a user device of the one or more user devices, determining an active application usage time in relation to the application scenario during the predetermined time period based on the labelling, training a machine learning model to estimate the active application usage time based on the determining, and using the machine learning model to estimate the active application usage time on the one or more user devices.