KR101027862B1 - System and method for analyzing embedded data - Google Patents

Abstract

PURPOSE: An embedded data analysis system and method thereof are provided to visually supply an analysis block and a connection state of the analysis block by generating a connection state that an object file is connected to an analysis block. CONSTITUTION: An input unit(110) receives an object file, an analysis block for analyzing the object file, and an input signal from a user. The object file is extracted from an embedded system. A process unit(120) generates a connection state in which the object file is connected to the analysis block based on an input signal. An analysis unit(130) generates analysis result information about the object file.

Description

Embedded Data Analysis System and Method {System and Method for Analyzing Embedded Data}

Embodiments of the present invention relate to an embedded data analysis system and method, and more particularly, to a system and method for analyzing embedded data extracted from an embedded system.

Recently, with the development of information industry and mobile computing technology, embedded systems such as mobile communication terminals, personal digital assistants (PDAs), tablet PCs, e-books, portable multimedia players (PMPs), navigation, etc. Are being developed a lot. Embedded systems, including such mobile communication terminals, have developed a variety of applications that go beyond the simple transfer of simple information such as voice information, and can install a variety of applications to meet the needs of users and use the data associated with them. . The range of the data includes personal information stored in the terminal such as schedule management, SMS transmission and reception history, user-generated data such as pictures and videos that can be generated using a camera mounted on most mobile communication terminals, and mobile communication service providers. It includes embedded data including various contents and programs such as e-books, ringtones, MP3s, and games downloaded from a server.

Embedded data in such an embedded system is easy to carry, fast access time, and has a storage means such as flash memory that requires low power. In an embedded system, communication applications such as telephone, SMS (SHORT MESSAGING SERVICE), MMS (MULTIMEDIA MESSAGING SERVICE), multimedia applications such as photos and videos, and various other user applications are controlled by the operating system (OS: OPERATING SYSTEM) of the embedded system. It is running. Each application requires space in an appropriate storage means in order to be driven in the embedded system. When the application is driven, a predetermined area of the storage means, for example, a RAM area of a memory, is allocated and driven by the operating system. That is, the recording and deletion of the embedded data generated by the application uses the storage means provided in the embedded system.

Such sudden damage or loss of embedded data in an embedded system requires serious confusion and legal disputes and payment of costs throughout life, and thus the importance of recovering the embedded data is increasing, resulting in damage or loss of embedded system. There is an increasing need for technology to extract and track embedded data that allows for easy recovery of data and for users to easily retrieve or view the recovered embedded data.

In addition, with the development of computer programming, user needs for convenience of an interface for using a program are increasing.

Accordingly, the present specification proposes a device / method for analyzing new embedded data and a device / method for visually providing an analysis tool for analyzing embedded data.

Embedded data analysis system according to an embodiment of the present invention is a target file to be analyzed from the embedded data extracted from the embedded system, at least one analysis block for analyzing the target file and the target file and the at least one analysis An input unit configured to receive an input signal of a connection relationship between blocks from a user, a processor configured to generate a connection state between the target file and the at least one analysis block based on the input signal, and based on the connection state, It includes an analysis unit for generating analysis result information on the target file.

According to another embodiment of the present invention, an embedded data analysis system includes an analysis block display area and the target file for displaying at least one analysis block for analyzing a target file to be analyzed among embedded data extracted from an embedded system; A screen configuration unit constituting a screen including an analysis setting display area for displaying the at least one analysis block and a connection relationship between the target file and the at least one analysis block, the target file from a user, and the at least one analysis An input unit configured to receive a block and an input signal for the connection relationship, and a controller configured to control the screen configuration unit such that a connection state of the target file and the at least one analysis block based on the connection relationship is displayed in the analysis setting display area. Include.

Embedded data analysis method according to an embodiment of the present invention is a target file to be analyzed from the embedded data extracted from the embedded system, at least one analysis block for analyzing the target file and the target file and the at least one analysis Receiving an input signal for a connection relationship between blocks from a user, generating a connection state to which the target file and the at least one analysis block are connected based on the input signal, and based on the connection state, Generating analysis result information on the target file.

Embedded data analysis method according to another embodiment of the present invention is an analysis block display area and the target file for displaying at least one analysis block for analyzing the target file to be analyzed of the embedded data extracted from the embedded system, Constructing a screen including an analysis setup display area for displaying the at least one analysis block and a connection relationship between the target file and the at least one analysis block, the target file from the user, the at least one analysis block, and Receiving an input signal for the connection relationship, and controlling a configuration of the screen such that a connection state of the target file and the at least one analysis block based on the connection relationship is displayed in the analysis setting display area. do.

The user receives input signals for analysis blocks and connection relationships for analyzing embedded data from the user, and generates connection states in which target files and analysis blocks are connected based on the input signals. It can be provided visually, so that the user can perform the analysis task more easily and efficiently.

1 is a view showing the configuration of an embedded data analysis system according to an embodiment of the present invention.
2 is a view showing an analysis block according to an embodiment of the present invention.
3 is a diagram illustrating a structure of an analysis block according to an embodiment of the present invention.
4 is a diagram illustrating a connection state between a target file and an analysis block according to an embodiment of the present invention.
5 illustrates a date time block including a plurality of sub analysis blocks according to an exemplary embodiment of the present invention.
6 is a diagram illustrating a configuration of an embedded data analysis system according to another embodiment of the present invention.
7 is a diagram illustrating a screen configured by an embedded data analysis system according to an embodiment of the present invention.
8 is a flowchart illustrating an embedded data analysis method according to an embodiment of the present invention.
9 is a flowchart illustrating a method of analyzing embedded data according to another embodiment of the present invention.

Hereinafter, embodiments according to the present invention will be described in detail with reference to the accompanying drawings. However, the present invention is not limited or limited by the embodiments. Like reference numerals in the drawings denote like elements.

1 is a view showing the configuration of an embedded data analysis system according to an embodiment of the present invention.

Referring to FIG. 1, an embedded data analysis system 100 according to an embodiment of the present invention includes an input unit 110, a processing unit 120, and an analysis unit 130.

The user of the embedded data analysis system 100 may extract embedded data from an embedded system to be analyzed among embedded systems including the mobile communication terminal 101 and the tablet PC 102. In addition, a target file to be analyzed may be selected from the extracted embedded data, and an input signal for the selected target file may be input to the embedded data analysis system 100.

At this time, the input unit 110 receives an input signal for a target file to be analyzed from the embedded data extracted from the embedded system including the mobile communication terminal 101, the PMP 102, and the like from a user.

The target file according to an embodiment may include basic information, call log information, phone book information, message information, electronic notebook data information, internet log information, e-mail information, user location information, wireless communication access information, and registry for an embedded system. Information, multimedia data information, and user installation program information.

Basic information on the embedded system may include a password set in the embedded system, an electronic serial number (ESN), and the like. In addition, the call log information may include a record of the time, the call number, etc. of the call using the embedded system, and a record of the contents, the call number, the receive number, the time and the date of the message transmitted / received using the embedded system. . The phone book information may include information about a phone number stored in the embedded system. In addition, the message information may include information about SMS, MMS message, origination number, reception number, transmission / reception date, time, etc. transmitted / received using the embedded system. In addition, the electronic notebook data information may include information about a schedule, anniversary, D-Day, memo, etc. recorded by the user in the embedded system. Also, the Internet log information may include log information of accessing a web page using an embedded system. In addition, the e-mail information may include information about the recipient, sender, content, etc. of the e-mail exchanged using the embedded system. In addition, the location information of the user may include information about the location left by a program such as a map or navigation. In addition, the wireless communication connection information may include information about the wireless network to which the embedded system has connected. In addition, the registry information may include at least one related information dependent on the operating system of the embedded system. In addition, the multimedia data information may include information about photos, videos, multimedia data, and the like stored in the embedded system. In addition, the user installation program information may include at least one related information left by a program downloaded and installed by a user from a communication company or a manufacturer in an embedded system.

In addition, a user of the embedded data analysis system 100 selects at least one analysis block for analyzing a target file, and inputs an input signal for the selected at least one analysis block to the embedded data analysis system 100. You can enter

At this time, the input unit 110 receives an input signal for at least one analysis block for analyzing the target file from the user.

According to an embodiment, the analysis block may receive information associated with a target file based on a connection state connected to the analysis block, and perform a preset analysis operation on the received information. In addition, based on the connection state, the result information of the analysis operation may be output to the connected analysis block or result block. That is, the analysis block according to an embodiment may be a tool object that performs an analysis operation set individually.

Table 1 shows the basic structure of an analysis block according to an embodiment. The analysis block can have a basic execution structure based on Aztool's abstract classes, as shown in Table 1.

TABLE 1

class AzTool

{

virtual void Reset (); // initialize all state values of analysis block

virtual bool CheckValidity (); // Determine if state of analysis block is feasible

virtual void PrepareRun (); // preparatory work

virtual void Run (); // Run Analysis Block-Runs a preset analysis task for each analysis block

    RunState GetRunState (); // transfer the execution status (complete, in progress, ready) of the analysis block to other analysis blocks connected to it

}

Hereinafter, the analysis block will be described in detail with reference to FIGS. 2 and 3.

2 is a view showing an analysis block according to an embodiment of the present invention.

Referring to FIG. 2, an analysis block according to an embodiment of the present invention may be displayed in the form 200 of a tool box.

According to an embodiment, the analysis block may include a sub system block 210, a source block 215, a record block 220, a field block 225, and a message. Block 230, Function Block 235, Operator Block, Integer Block 250, String Block 260, Date Time Block 265, It may include at least one of a conditional block 270, a table block 275, an IO block 280, and a user define block 285.

Subsystem block 210 may include a subsystem 211 of a function of grouping analysis blocks and an analysis block of a loop 212 of an iterative execution function.

The source block 215 may include an analysis block of a database 217 and a record manager 218, a file 216 indicating a path or a location of a target file or a dump image to be analyzed in embedded data. have.

The record block 220 may include a record 221 that defines a target file to be analyzed and an analysis block of composite data 222.

The field block 225 may include an analysis block of a number 226, a text 227, a phone number 228, and a multimedia 229.

The message block 235 can include an analysis block of an email 231, an Html 232, and a SKT message 233.

The function block 235 includes a file finder 236, a converter 237, a type converter 238, a storage 239, a lookup 240, and The analysis block of the data coupler 241 may be included.

The integer block 250 includes a constant 251, an addition 252, a subtraction 253, a bitwise 254, a multiplication 255, and a quotient. An analysis block of 256 and the remainder 257.

The string block 260 may include an analysis block of a string finder, a string editor, a string splitter, and a sub string.

The date time block 265 includes a date generator for generating date data, a time builder for generating time data, and a date time for generating date and time data. Builder and analysis blocks of the Epoch Time of the function of converting integer data into date time data.

The condition block 270 may include an analysis block of If-Else and Switch Case.

The table block 275 is a block for analysis result information of a target file, and includes information, a call register, a phone book, a message, an e-mail, an electronic notebook, internet log information, and wireless communication. The analysis block may include access information, registry information, user location information, multimedia, and user installation program information.

The user-defined block 285 may be a block in which a user may directly set a function of the analysis block.

3 is a diagram illustrating a structure of an analysis block according to an embodiment of the present invention.

Referring to FIG. 3, the structure 300 of an analysis block according to an embodiment of the present invention may include a plurality of folders corresponding to the analysis block.

In addition, some of the plurality of folders according to an embodiment may include at least one subfolder.

Referring back to FIG. 1, a user of the embedded data analysis system 100 may select a target file and at least one analysis block and connect the target file with at least one analysis block. That is, the user may input the selection signal for the connection relationship into the embedded data analysis system 100.

In this case, the input unit 110 receives an input signal of a connection relationship between the target file and the at least one analysis block from the user.

The processor 120 generates a connection state in which a target file and at least one analysis block are connected based on the input signal.

Hereinafter, with reference to FIG. 4, the connection relationship and the connection state between the target file and the analysis block will be described in detail.

4 is a diagram illustrating a connection state between a target file and an analysis block according to an embodiment of the present invention.

Referring to FIG. 4, the connected state 400 according to an embodiment of the present invention is a state in which a target file 410, analysis blocks 420 to 480, and analysis result table block 490 corresponding to analysis result information are connected. Indicates.

That is, when the user wants to analyze the received SMS message among the embedded data of the embedded system, the user may select a target file of the received SMS message and input a signal for the SMS message to the embedded data analysis system.

In addition, the user is an analysis block for analyzing the target file of the SMS message, active / inactive block 420, translation block 430, call number block 440, type conversion block 450, date time block 460 ), The number block 470 and the text block 480 may be selected. In addition, signals for the selected analysis blocks 420 to 480 may be input to the embedded data analysis system.

In addition, the user may connect between the target file of the SMS message and the selected analysis blocks 420-480. In other words, the user may input a signal of a connection relationship between the target file and the analysis block to the embedded data analysis system. In this case, the embedded data analysis system may generate a connection state 400 to which the target file 410, the analysis blocks 420 to 480, and the analysis result table block 490 corresponding to the analysis result information are connected.

Referring back to FIG. 1, the analysis unit 130 generates analysis result information on the target file based on the generated connection state.

According to one side of the present invention, the analysis unit 130 may perform the analysis work sequentially or in parallel in the order in which at least one analysis block is connected to the target file.

Also, when the target file includes at least one record, the analysis unit 130 may generate analysis result information in at least one record unit.

The record represents a set of correlated information among the information about the embedded system. At this time, the field represents individual information included in the record. For example, when analyzing information on the phone book of the embedded data (that is, when the phone book file is the target file), the information on the phone book may include information on a name, a number, a picture, and the like. At this time, the information about the name, the information about the number, the information about the picture forms a separate field, and a set of information about the name, information about the number, and information about the picture may form one record ( For example, (Kim Chul-soo, 010-1234-5678) may form the first record, and (Kim Young-hee, 010-8765-4321) may form the second record).

The analysis unit 130 according to an embodiment may extract a field at a predetermined position with respect to a record input to the analysis block, using information preset in the analysis block, and generate analysis result information on the extracted field. .

According to one side of the present invention, the embedded data analysis system 100 may further include a generation unit 140.

In this case, the generation unit 140 may generate at least one analysis block. That is, a user of an embedded data analysis system may directly design a function for analyzing embedded data, and the generation unit 140 may generate an analysis block having a designed function.

Referring back to FIG. 4, the embedded data analysis system according to an embodiment of the present invention may analyze the target file 410 for the received SMS message. At this time, the embedded data analysis system, active / inactive block 420, call number block 440, date time block 460, number block 470 and text block 480 connected to the target file 410 Information about the received SMS message may be transmitted.

According to one side of the present invention, the embedded data analysis system may analyze the target file 410 for the received SMS message in record units.

For example, the received SMS message may include at least one record including information on the reception number, the origination number, the content of the message, and the reception time. In this case, the embedded data analysis system may analyze information on a reception number, information on a calling number, information on a message content, and reception time on a record basis.

The active / inactive block 420 may determine whether information on the received received SMS message is active or inactive (delete). In addition, the active / inactive block 420 may transmit the determination result to the conversion block 430. The conversion block 430 may convert the determination result into a string. In addition, the conversion block 430 may transmit the determination result converted into the character string to the analysis result table block 490.

Calling number block 440 may extract the calling number from the information on the received SMS message. In addition, the calling number block 440 may transmit the extracted calling number to the type conversion block 450. The type conversion block 450 may convert the extracted caller number into a string. In addition, the calling number block 440 may transmit the calling number converted into a character string to the analysis result table block 490.

The date time block 460 may extract the date and time when the SMS message was received from the information on the received SMS message. In addition, the date time block 460 may transmit the extracted date and time information to the analysis result table block 490.

According to an embodiment, the date time block 460 may be a composite data block including a plurality of sub analysis blocks. Hereinafter, a date time block including a plurality of sub analysis blocks will be described in detail with reference to FIG. 5.

5 illustrates a date time block including a plurality of sub analysis blocks according to an exemplary embodiment of the present invention.

Referring to FIG. 5, the date time block 500 according to an embodiment of the present invention may include a plurality of sub analysis blocks.

At this time, the sub-analysis block 510 may receive information (for example, information on a received SMS message) input to the date time block 500. In addition, the sub analysis block 520 may transmit information on the date and time analyzed by the plurality of sub analysis blocks included in the date time block 500 to another analysis block connected to the date time block 500. .

Referring back to FIG. 4, the number block 470 may extract the length of a string of messages from the information on the received SMS message. In addition, the number block 470 may transmit the length of the string of the extracted message to the text block 480. The text block 480 may extract the string of the message and convert the format of the extracted string of the message. In addition, the text block 480 may transmit a string of the converted message to the analysis result table block 490.

The analysis result table block 490 may store a determination result converted into a received string, a caller number converted into a string, extracted date and time information, a caller number converted into a string, and a text string of a converted message. . In addition, the embedded data analysis system according to an embodiment may output the information stored in the analysis result table block 490 to a display device connected to the embedded data analysis system or a display unit (not shown) included in the embedded data analysis system. .

6 is a diagram illustrating a configuration of an embedded data analysis system according to another embodiment of the present invention.

Referring to FIG. 6, the embedded data analysis system 600 according to an exemplary embodiment may include a screen configuration unit 610, an input unit 620, and a control unit 630.

The screen configuration unit 610 may configure a screen including an analysis block display area and an analysis setting display area.

The screen according to an embodiment may be a screen displayed on a display device connected to the embedded data analysis system 600 or a display unit (not shown) included in the embedded data analysis system 600.

The analysis block display area may be an area for displaying at least one analysis block for analyzing a target file, which is an analysis target, of embedded data extracted from an embedded system.

In addition, the analysis setting display area may be an area for displaying a target file, at least one analysis block, and a connection relationship between the target file and the at least one analysis block.

According to an aspect of the present invention, the screen configuration unit 610 is a data structure display area for displaying the structure of the embedded data screen, a binary display area for displaying the file contents of the embedded data in a binary form, at least one analysis The screen may be configured to further include at least one of a block structure display area for displaying a structure of a block and a block property display area for displaying properties of at least one analysis block.

Hereinafter, the screen configured by the screen configuration unit 610 will be described in detail with reference to FIG. 7.

7 is a diagram illustrating a screen configured by an embedded data analysis system according to an embodiment of the present invention.

Referring to FIG. 7, a screen 700 according to an embodiment of the present invention may include an analysis block display area 710, an analysis setting display area 720, a data structure display area 730, a binary display area 740, The block structure display area 750 and the block property display area 760 may be included.

The analysis block display area 710 may be an area in which at least one analysis block is displayed. According to an embodiment, the analysis block display area 710 may display an analysis block displayed in the form of a tool box of FIG. 2. According to an embodiment, the user of the embedded data analysis system selects an analysis block to be used from among at least one analysis block displayed on the analysis block display area 710, and uses the selected analysis block as the analysis setting display area 720. You can drag and drop with.

The analysis setting display area 720 may be an area where a target file selected by a user and an analysis block are displayed. In addition, according to an embodiment, when the user connects the target file and the analysis block, the connection state in which the target file and the analysis block are connected may be further displayed on the analysis setting display area 720.

The data structure display area 730 may be an area in which the structure of the embedded data extracted from the embedded system is displayed.

The binary display area 740 may be an area in which file contents of the embedded data extracted from the embedded system are displayed in binary form.

The block structure display area 750 may be an area in which the structure of at least one analysis block is displayed.

The block attribute display area 760 may be an area where attributes of each of at least one analysis block are displayed.

Referring back to FIG. 6, the input unit 620 may receive an input signal for a target file, at least one analysis block, and a connection relationship between the target file and the at least one analysis block from a user.

The controller 630 may control the screen configuration unit 610 to display a connection state to which a target file based on a connection relationship and at least one analysis block is connected in the analysis setting display area.

For example, when a user drags a text block among at least one analysis block and drops it into the analysis setting display area, the controller 630 may control the screen configuration unit 610 to display the text block in the analysis setting display area. Can be.

8 is a flowchart illustrating an embedded data analysis method according to an embodiment of the present invention.

Referring to FIG. 8, in the embedded data analysis method according to an exemplary embodiment, an input signal for a target file, at least one analysis block, and a connection relationship between the target file and at least one analysis block may be input from a user. 810.

A user may extract embedded data from an embedded system to be analyzed among embedded systems including a mobile communication terminal and a tablet PC. In addition, a target file to be analyzed may be selected from the extracted embedded data, and an input signal for the selected target file may be input.

At this time, the embedded data analysis method receives from the user an input signal for the target file to be analyzed among the embedded data extracted from the embedded system including the mobile communication terminal, tablet PC, and the like.

The target file according to an embodiment may include basic information, call log information, phone book information, message information, electronic notebook data information, internet log information, e-mail information, user location information, wireless communication access information, and registry for an embedded system. Information, multimedia data information, and user installation program information.

Basic information on the embedded system may include a password set in the embedded system, an electronic serial number (ESN), and the like. In addition, the call log information may include a record of the time, the call number, etc. of the call using the embedded system, and a record of the contents, the call number, the receive number, the time and the date of the message transmitted / received using the embedded system. . The phone book information may include information about a phone number stored in the embedded system. In addition, the message information may include information about SMS, MMS message, origination number, reception number, transmission / reception date, time, etc. transmitted / received using the embedded system. In addition, the electronic notebook data information may include information about a schedule, anniversary, D-Day, memo, etc. recorded by the user in the embedded system. Also, the Internet log information may include log information of accessing a web page using an embedded system. In addition, the e-mail information may include information about the recipient, sender, content, etc. of the e-mail exchanged using the embedded system. In addition, the location information of the user may include information about the location left by a program such as a map or navigation. In addition, the wireless communication connection information may include information about the wireless network to which the embedded system has connected. In addition, the registry information may include at least one related information dependent on the operating system of the embedded system. In addition, the multimedia data information may include information about photos, videos, multimedia data, and the like stored in the embedded system. In addition, the user installation program information may include at least one related information left by a program downloaded and installed by a user from a communication company or a manufacturer in an embedded system.

In addition, the user may select at least one analysis block for analyzing the target file and input an input signal for the selected at least one analysis block.

In this case, the embedded data analysis method receives an input signal for at least one analysis block for analyzing a target file from a user.

According to an embodiment, the analysis block may receive information associated with a target file based on a connection state connected to the analysis block, and perform a preset analysis operation on the received information. In addition, based on the connection state, the result information of the analysis operation may be output to the connected analysis block or result block. That is, the analysis block according to an embodiment may be a tool object that performs an analysis operation set individually.

The user may select a target file and at least one analysis block and connect the target file with at least one analysis block. That is, the user may input a selection signal for the connection relationship.

At this time, the embedded data analysis method receives an input signal for a connection relationship between the target file and the at least one analysis block from the user.

The embedded data analysis method generates a connection state in which the target file and the at least one analysis block are connected based on the input signal (820).

The embedded data analysis method generates analysis result information on the target file based on the generated connection state (830).

According to an aspect of the present invention, the embedded data analysis method may perform an analysis operation sequentially or in parallel in an order in which at least one analysis block is connected to a target file.

Also, in the embedded data analysis method according to an exemplary embodiment, when the target file includes at least one record, the analysis result information may be generated in at least one record unit.

The record represents a set of correlated information among the information about the embedded system. At this time, the field represents individual information included in the record. For example, when analyzing information on the phone book of the embedded data (that is, when the phone book file is the target file), the information on the phone book may include information on a name, a number, a picture, and the like. At this time, the information about the name, the information about the number, the information about the picture forms a separate field, and a set of information about the name, information about the number, and information about the picture may form one record ( For example, (Kim Chul-soo, 010-1234-5678) may form the first record, and (Kim Young-hee, 010-8765-4321) may form the second record).

The embedded data analysis method according to an embodiment may extract a field at a predetermined position with respect to a record input to the analysis block, using information preset in the analysis block, and generate analysis result information on the extracted field.

According to one aspect of the invention, the embedded data analysis method may further comprise generating at least one analysis block.

9 is a flowchart illustrating a method of analyzing embedded data according to another embodiment of the present invention.

Referring to FIG. 9, in the embedded data analysis method according to an exemplary embodiment, a screen including an analysis block display area and an analysis setting display area may be configured (910).

The screen according to an embodiment may be a screen displayed on a display device connected to an embedded data analysis system or a display unit included in an embedded data analysis system.

The analysis block display area may be an area for displaying at least one analysis block for analyzing a target file, which is an analysis target, of embedded data extracted from an embedded system.

In addition, the analysis setting display area may be an area for displaying a target file, at least one analysis block, and a connection relationship between the target file and the at least one analysis block.

According to an aspect of the present invention, an embedded data analysis method includes a data structure display area in which a screen displays a structure of embedded data, a binary display area in which a file content of embedded data is displayed in binary form, and at least one analysis block. The screen may be configured to further include at least one of a block structure display area for displaying a structure and a block property display area for displaying properties of at least one analysis block.

The embedded data analysis method may receive an input signal for a target file, at least one analysis block, and a connection relationship between the target file and the at least one analysis block from a user.

The embedded data analysis method may control the configuration of the screen such that the connection state to which the target file based on the connection relationship and the at least one analysis block are connected is displayed in the analysis setting display area.

For example, when the user drags a text block of the at least one analysis block and drops it to the analysis setting display area, the embedded data analysis method may control the configuration of the screen so that the text block is displayed in the analysis setting display area.

Embodiments according to the present invention can be implemented in the form of program instructions that can be executed by various computer means can be recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of the computer-readable recording medium include magnetic media such as a hard disk, a floppy disk, and a magnetic tape; optical media such as CD-ROM and DVD; magnetic recording media such as a floppy disk; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

As described above, the present invention has been described by way of limited embodiments and drawings, but the present invention is not limited to the above embodiments, and those skilled in the art to which the present invention pertains various modifications and variations from such descriptions. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the claims below but also by the equivalents of the claims.

100: embedded data analysis system
110: input unit
120: processing unit
130: analysis unit
140: generator

Claims (12)

The user inputs an input signal for a target file to be analyzed from among embedded data extracted from an embedded system, at least one analysis block for analyzing the target file, and a connection relationship between the target file and the at least one analysis block. Receiving input unit;
A processor configured to generate a connection state between the target file and the at least one analysis block based on the input signal; And
An analysis unit generating analysis result information on the target file based on the connection state
Embedded data analysis system comprising a. The method of claim 1,
The at least one analysis block
Embedded data analysis system for performing a predetermined analysis on the information associated with the target file input to the at least one analysis block. The method of claim 1,
The analysis unit
Embedded data analysis system for performing the analysis operation in sequence or in parallel in the order in which the at least one analysis block is connected to the target file. The method of claim 1,
The analysis unit
If the target file includes at least one record (Record), the embedded data analysis system for generating the analysis result information in the at least one record unit. The method of claim 1,
Generation unit for generating the at least one analysis block
Embedded data analysis system further comprising. The method of claim 1,
The at least one analysis block
Sub System Blocks, Source Blocks, Record Blocks, Field Blocks, Message Blocks, Function Blocks, Operator Blocks, Integer Blocks And at least one of a String block, a Date Time block, a Conditional block, a Table block, an IO block, and a User Define block. The method of claim 1,
The target file is
Basic information, call log information, phone book information, message information, electronic notebook data information, internet log information, e-mail information, user location information, wireless communication access information, registry information, multimedia data information and the user of the embedded system. Embedded data analysis system comprising at least one of the installer information. An analysis block display area for displaying at least one analysis block for analyzing a target file to be analyzed among embedded data extracted from an embedded system and the target file, the at least one analysis block, the target file, and the at least one A screen configuration unit constituting a screen including an analysis setting display area for displaying a connection relationship between analysis blocks;
An input unit configured to receive an input signal for the target file, the at least one analysis block, and the connection relationship from a user; And
A controller configured to control the screen configuration unit to display a connection state between the target file and the at least one analysis block based on the connection relationship on the analysis setting display area;
Embedded data analysis system comprising a. The method of claim 8,
The screen configuration unit
Above screen
A data structure display area for displaying a structure of the embedded data;
A binary display area for displaying a file content of the embedded data in binary form;
A block structure display area for displaying a structure of the at least one analysis block; And
Block attribute display area for displaying the attributes of the at least one analysis block
Embedded data analysis system to configure the screen to further include at least one of. The user inputs an input signal for a target file to be analyzed from among embedded data extracted from an embedded system, at least one analysis block for analyzing the target file, and a connection relationship between the target file and the at least one analysis block. Receiving step;
Generating a connection state to which the target file and the at least one analysis block are connected based on the input signal; And
Generating analysis result information on the target file based on the connection state;
Embedded data analysis method comprising a. An analysis block display area for displaying at least one analysis block for analyzing a target file to be analyzed among embedded data extracted from an embedded system and the target file, the at least one analysis block, the target file, and the at least one Constructing a screen including an analysis setting display area for displaying a connection relationship between analysis blocks;
Receiving an input signal for the target file, the at least one analysis block, and the connection relationship from a user; And
Controlling a configuration of the screen such that a connection state of connecting the target file and the at least one analysis block based on the connection relationship is displayed in the analysis setting display area;
Embedded data analysis method comprising a. A computer-readable recording medium having recorded thereon a program for executing the method of claim 10.

Images