APPARATUS FOR DETECTING A PERIODICITY, A METHOD THEREOF AND A RECORDING MEDIUM THEREOF

• US 20150029892A1
• Filed: 07/28/2014
• Published: 01/29/2015
• Est. Priority Date: 07/26/2013
• Status: Abandoned Application

• Current Assignee: Ideaware Inc.
• Original Assignee: Ideaware Inc.
• Inventors: CHA, Yang Myung
• Application Number:
  US14/444,033
• Publication Number:
  US 20150029892A1
• Time in Patent Office: Days
• US Class Current: 370/253
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route

Abstract

A device for detecting periodicity includes a collection unit for collecting or capturing a plurality of packets for mutually transceiving between a plurality of wireless terminal and a plurality of servers through a communication network; a preprocessing unit for connecting the packets and packet collection or capture time information collected or captured by the collection unit to each wireless terminals IP and servers IP/PORT and mapping the connected them; a modeling processing unit for processing at least one data modeling and grouping for each packet generation patterns, for the mapped packets; a pattern detection unit for detecting similar data models within the margin of defined error as repetition generation pattern types by mutual lengths between a plurality of data models grouped for each packet generation pattern; and a periodicity detection unit for determining periodic section when the detected repetition generation pattern types are successively generated above n times and the sections successively generated above n times occupy above predetermined rate for total sections.

Claims

1. A device for detecting periodicity, comprising:

a collection unit for collecting or capturing a plurality of packets for mutually transceiving between a plurality of wireless terminal and a plurality of servers through a communication network;

a preprocessing unit for processing a mapping by connecting the packets collected or captured by the collection unit and packet collection time information or packet capture time information to each wireless terminal'"'"'s IP and server'"'"'s IP/PORT;

a modeling processing unit for grouping for each packet generation pattern by processing at least one data modeling for the mapped packets;

a pattern detection unit for detecting repetition generation pattern types from a plurality of data models grouped for each packet generation pattern, using similar data models within the margin of defined error by mutual lengths of the data models; and

a periodicity detection unit for determining periodic sections when the detected repetition generation pattern types are successively generated above n times or time intervals of the sections successively generated above n times occupy above a predetermined rate to a total time.

2. The device for detecting periodicity according to claim 1, further comprising a Keep Alive determination unit for determining the periodic section as Keep Alive periodic section based on at least one of whether the ports of the packets changing which stored into the slots present in the periodic sections, the number of the packets to be transceived, and the sizes of the packets to be transceived.

3. The device for detecting periodicity according to claim 2, wherein the Keep Alive determination unit determines the periodic section as the Keep Alive periodic section when the ports of the packets stored into the slots present in the periodic sections are not changing or the number of the packets to be transceived is below predetermined number or the sizes of the packets to be transceived are constant.

4. The device for detecting periodicity according to claim 1, further comprising a polling determination unit for determining the periodic section as polling periodic section based on the ports of the packets stored into the slots present at the periodic sections.

5. The device for detecting periodicity according to claim 3, wherein the polling determination unit determines the periodic section as polling periodic section when the ports of the packets stored into the slots present at the periodic sections are successively changed.

6. The device for detecting periodicity according to claim 1, wherein the preprocessing unit filters network control packets of a plurality of packets to be collected or captured by the collection unit and excludes the filtered packets, and the network control packets include at least one of TCP connection packets, network connection termination packets, resetting packets, and acknowledgement packets.

7. The device for detecting periodicity according to claim 1, wherein the data modeling processing unit processes data modeling using at least one of a polling model grouping for a period of changing ports of the wireless terminals, a time model grouping the packets included in predefined time interval, and a region model grouping according to packet generation distribution.

8. The device for detecting periodicity according to claim 1, further comprising a check unit for checking domain names suitable for an IP of the servers corresponding to the periodic section using IP and domain name tables derived by DNS protocol analysis.

9. The device for detecting periodicity according to claim 1, wherein the mutual lengths are any one of the sum of time difference between the last packet of the previous data model and the first packet of the current data model and time difference between the first packet and last packet that belong to the current data model, time difference between the last packet of the previous data model and the first packet of the current data model or time difference between the first packet and last packet that belong to the current data model.

10. A method for detecting periodicity, comprising:

collecting or capturing a plurality of packets for mutually transceiving between a plurality of wireless terminal and a plurality of servers through a communication network;

mapping the packets and packet collection or capture time information collected or captured by the collection unit to each wireless terminal'"'"'s IP and server'"'"'s IP/PORT by connecting them;

processing at least one data modeling by grouping for each packet generation patterns, for the mapped packets;

detecting similar data models within the margin of defined error as repetition generation pattern types by mutual lengths between a plurality of data models grouped for each packet generation pattern; and

determining periodic sections when the detected repetition generation pattern types are successively generated above n times or a sum of time intervals of the repetition generation pattern types successively generated above n times occupy above a predetermined rate for total time.

11. The method for detecting periodicity according to claim 10, further comprising determining the periodic section as Keep Alive periodic section based on at least one of changing of the ports of the packets stored into the slots present at the periodic sections, the number of the packets to be transceived, and the sizes of the packets to be transceived.

12. The method for detecting periodicity according to claim 11, wherein the determining the periodic section as the Keep Alive periodic section includes determining the periodic section as the Keep Alive periodic section when the ports of the packets stored into the slots present at the periodic section are not changing or the number of the packets to be transceived is below predetermined number or the sizes of the packets to be transceived are constant.

13. The method for detecting periodicity according to claim 10, further comprising determining the periodic section as polling periodic section based on the ports of the packets stored into the slots present at the periodic section.

14. The method for detecting periodicity according to claim 13, wherein the determining the periodic section as polling periodic section includes determining the periodic section as polling periodic section when the ports of the packets stored into the slots present at the periodic sections are successively changed.

15. The method for detecting periodicity according to claim 10, further comprising:

filtering network control packets of a plurality of packets to be collected or captured; and

excluding the filtered packets.

16. The method for detecting periodicity according to claim 15, wherein the network control packets include at least one of TCP connection packets, network connection termination packets, resetting packets, and acknowledgement packets.

17. The method for detecting periodicity according to claim 10, wherein the grouping for each packet generation patterns include processing data modeling using at least one of a polling model grouping for a period of changing ports of the wireless terminals, a time model grouping the packets included in predefined time interval, and a region model grouping according to packet generation distribution.

18. The method for detecting periodicity according to claim 10, further comprising checking domain names suitable for an IP of the servers corresponding to the periodic section using IP and domain name tables derived by DNS protocol analysis.

19. The method for detecting periodicity according to claim 10, wherein the mutual lengths are any one of the sum of time difference between the last packet of the previous data model and the first packet of the current data model and time difference between the first packet and last packet that belong to the current data model, time difference between the last packet of the previous data model and the first packet of the current data model or time difference between the first packet and last packet that belong to the current data model.

20. A computer-readable recording medium for recording programs for causing a computer to execute the method described in claim 10.