def match_signature(data, srcip, dstip):
  """Check which signature was matched most of the time

  :param data: data dictionary
  :type data: dictionary
  :param srcip: source ip
  :type srcip: string
  :param dstip: destination ip
  :type dstip: string
  :return: signature
  """
  signatures = data[srcip]['targets'][dstip]['signature']
  max_value = max(signatures.values())
  match = []
  for signature in signatures:
    if signatures[signature] == max_value:
        match.append(signature)
  if len(match) > 0:
    signature = match[0]

  else:
    signature = "everything"

  return signature