Every time we asked this of the AIX people, they replied that you could of course sum usage by the groups that users belong to, ie they BOTH missed the point AND assumed that users only use one appl. Any time users use several appls, or there exists a corporate appl (eg e-mail), the USER_GROUP approach fails.
Once that bit of the question was understood, the expertise responded that most UNIX appls are built at least partly or even mostly with system facilities, and therefore perform some or a lot of their processing in programs ('commands') with non-unique names (ie we are unable to isolate one appl from another).
Essentially all this means you can't answer the question.