JP7014696B2 - Devices, methods and systems that estimate running applications in terminals - Google Patents

Description

The present invention relates to a technique for estimating a running application in a terminal.

In recent years, users can install and use various application programs (AP (Application Program)) on their smartphones.
In addition, with the spread of wireless communication infrastructure capable of high-speed and large-capacity communication, the use of applications involving data communication in terminals is rapidly increasing. Such applications include video / chat, phone calls, images, games, maps and the like.
Increased use of applications that involve data communication causes overload and congestion on wireless communication infrastructure. Therefore, wireless communication carriers need to accurately grasp the application usage status of a large number of users and flexibly invest in wireless communication infrastructure.

Under these circumstances, measuring what applications many users use on their smartphones on a daily basis has become an important issue not only from the perspective of carriers but also from the perspective of marketing. It's coming.

Conventionally, as an estimation method of a running application, there are a "terminal data utilization method" and a "network data utilization method".
The "terminal data utilization method" estimates the running application by using the control log of the memory of the terminal, the CPU, etc., and the context extraction result by various sensor information.
For example, there is a technique of saving the location information acquired by the terminal and the start history of an arbitrary application and estimating the start of the application in the future (see, for example, Patent Document 1).
In addition, the application being started using all terminal information such as system information (CPU, memory, Bluetooth (registered trademark), WiFi information, OS setting, battery information) in the terminal, GPS, accelerometer, call information, SMS information, etc. There is also a technique for estimating (see, for example, Non-Patent Document 2). In this case, the estimation accuracy of about 79% to 87% is achieved.

The "network utilization method" is estimated based on the amount of communication traffic transmitted from the terminal. Specifically, the running application is estimated using the communication traffic in the transport layer and the network layer in the OSI reference model. Since the running application is estimated from the communication traffic of each terminal that can be collected on the communication infrastructure side, the burden on the user side terminal is not lost. In addition, the communication infrastructure operator can comprehensively analyze the running application in the terminal communicating with the own communication network.
For example, there is also a technique of learning the destination IP address at the time of communication in each application and the payload of the transmitted packet as a feature fingerprint to estimate the running application (see, for example, Non-Patent Document 3).
There is also a technique for estimating the running application by learning the DNS information and the communication traffic at the time of communication of the running application as a feature fingerprint (see, for example, Patent Document 2). For example, it is possible to estimate a running application for a data packet at the network layer.
Further, there is also a technique for identifying an application by learning only the TCP header information at the time of starting the application (see, for example, Non-Patent Document 4). According to this technique, it has been confirmed that an application that is started frequently achieves an estimation accuracy of 88% and that the accuracy does not decrease even after several days have passed since the training data.

Japanese Unexamined Patent Publication No. 2005-198345 JP-A-2015-149695

Q. Wang, A. Yahyavi, B. Kemme, and W. He, “I know what you did on your smartphone: Inferring app usage over encrypted data traffic,” 2015 IEEE Conf. Commun. Network Security, CNS 2015, pp. 433? 441, 2015. Shin, C., Hong, J.-H., and Dey, A.K. Understanding and prediction of mobile application usage for smart phones. In Proc. Of UbiComp’12, ACM (2012), 173? 182 S. Dai, A. Tongaonkar, X. Wang, A. Nucci, and D. Song, “NetworkProfiler: Towards automatic fingerprinting of Android apps,” Proc. --IEEE INFOCOM, pp. 809? 817, 2013. HF Alan and J. Kaur, “Can Android Applications Be Identified Using Only TCP / IP Headers of Their Launch Time Traffic?” In Proc. 9th ACM Conf. Secur. Priv. Wirel. Mob. Networks --WiSec '16, New York, NewYork, USA: ACM Press, 2016, pp. 61-66 ..

According to the terminal data utilization method described above, it is necessary to collect the data of the terminal owned by the user, so that the cooperation of the user is indispensable. In particular, it is difficult to estimate a running application on a comprehensive wireless communication infrastructure from the viewpoint of privacy protection and workload.
In addition, according to the network data utilization method described above, it is necessary to capture and analyze all TCP packets and IP packets that are input and output to and from the own communication network every day, and the introduction cost is high due to huge capital investment. There are challenges.
Further, as in Non-Patent Document 1, a technique capable of eavesdropping even an encrypted packet has appeared, so that the network data utilization method in the same layer has a risk of privacy infringement.

Therefore, an object of the present invention is to provide a device, a program, and a method for estimating a running application in a terminal, in which analysis of data packets by a wireless communication operator is low cost and the risk of privacy infringement is reduced. do.

According to the present invention, it is an estimation device that estimates a running application for a terminal wirelessly communicating with a base station.
As a learning stage, it has a machine learning engine that builds a learning model using teacher data with the communication log of the wireless data link as the explanatory variable and the running application identifier as the objective variable.
As an estimation stage
It has a communication log concatenation means for concatenating communication logs in which data packets of wireless data links in terminals are divided.
The machine learning engine is characterized in that it inputs a communication log linked by a communication log linking means and outputs a running application identifier in a terminal.

According to another embodiment of the estimation device of the present invention.
It is also preferable that the communication log of the wireless data link is the amount of wireless traffic to the base station and / or the connection time.

According to another embodiment of the estimation device of the present invention.
It is also preferable that the radio traffic amount includes both the up traffic amount and the down traffic amount.

According to another embodiment of the estimation device of the present invention.
It is also preferable that the communication log linking means concatenates adjacent communication logs for data packet fragmentation (MRCS: Multi Records Combined into a Session) due to communication interruption of the wireless data link.

According to another embodiment of the estimation device of the present invention.
It is also preferable that the communication log concatenating means concatenates adjacent communication logs for the data packet split (SSMR: Session Split into Multiple Records) based on the handover that the base station captured by the terminal is changed.

According to the present invention, for a terminal that is in wireless communication with a base station, it is a program that makes a computer mounted on a device that estimates a running application function.
As a learning stage, the communication log of the wireless data link is used as an explanatory variable, and the teacher data with the running application identifier as the objective variable is used to function as a machine learning engine that builds a learning model.
As an estimation stage
It functions as a communication log concatenation means for concatenating communication logs in which data packets of wireless data links in terminals are divided.
The machine learning engine is characterized in that the computer functions to input the communication log linked by the communication log linking means and output the running application identifier in the terminal.

According to the present invention, it is a method of estimating a running application in a device that has acquired a communication log of a wireless data link in a terminal that is wirelessly communicating with a base station.
The device is
As a learning stage, it has a machine learning engine that builds a learning model using teacher data with the communication log of the wireless data link as the explanatory variable and the running application identifier as the objective variable.
As an estimation stage
The first step of concatenating the communication log in which the data packet of the wireless data link in the terminal is divided,
With the second step, the machine learning engine inputs the communication log linked by the first step and outputs the running application identifier in the terminal .
It is characterized by executing .

According to the estimation device, program and method of the present invention, it is possible to estimate a running application in a terminal in which analysis of data packets by a wireless communication operator is low cost and the risk of privacy infringement is reduced.

It is a system block diagram in this invention. It is explanatory drawing which shows the learning stage of the machine learning engine in this invention. It is explanatory drawing which shows the characteristic of the communication log for each application. It is explanatory drawing which shows the estimation stage of the machine learning engine in this invention. It is a flowchart which shows the process of a communication log connection part. It is explanatory drawing which shows the concatenation of the data packet of the radio data link which was divided by the Dormant. It is explanatory drawing which shows the concatenation of the data packet of the radio data link divided by the handover.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

FIG. 1 is a system configuration diagram in the present invention.

According to the system of FIG. 1, the terminal 2 is, for example, a smartphone, and can install and start an application desired by the user. Further, the terminal 2 establishes a wireless data link with the base station 3 and communicates with the application server 4 via the base station 3 according to the behavior of the application. At that time, the data packet of the wireless data link is transmitted and received between the terminal 2 and the base station 3.

Here, the terminal 2 differs in the behavior of the data packet of the wireless data link transmitted / received to / from the base station 3 depending on the application being activated. For example, in the case of a chat service application, a small amount of traffic data packets are transmitted and received intermittently. On the other hand, in the case of a video service application, a large amount of traffic data packets are continuously transmitted and received. Communication logs (CDRs: Call Detail) of such wireless data links
Records) can be acquired by the base station 3 operated by the telecommunications carrier.

The estimation device 1 of the present invention is installed as a communication business facility, and receives a communication log of a wireless data link between a terminal 2 and a base station 3 from a base station 3. In order to acquire the communication log of the wireless data link, it is not necessary to start a separate application on the terminal 2 or to send the communication log to the estimation device 1 by the terminal 2 itself.
The estimation device 1 of the present invention can estimate the running application in the terminal 2 based on the communication log of the wireless data link transmitted / received between the terminal 2 and the base station 3. In particular, by using the communication log of the wireless data link, it is possible to reduce the cost of analyzing the data packet by the wireless communication operator and reduce the risk of privacy infringement.

According to FIG. 1, the estimation device 1 has a machine learning engine 10, a communication log connecting unit 11, and a terminal management database 12. These functional components can be realized by executing a program for operating the computer mounted on the estimation device 1. In addition, the processing flow of these functional components can be understood as a method of estimating a running application on a terminal.

[Machine learning engine 10]
The machine learning engine 10 is a learning model constructed from teacher data. The machine learning engine 10 can estimate the running application by machine learning using the communication log of the wireless data link generated by the behavior of the running application as a feature quantity.

FIG. 2 is an explanatory diagram showing a learning stage of the machine learning engine in the present invention.

According to FIG. 2, the teacher data is as follows.
Explanatory variable: Wireless data link communication log Objective variable: Running application ID
A communication log is a collection of multiple data packets on a wireless data link. Specifically, it is the "upstream wireless traffic amount", "downlink wireless traffic amount", and "connection time" (connection start time-connection disconnection time) of the data packet of the wireless data link.

For example, there are the following types of running applications.
Video service application Chat service application Call service application Image service application Game service application Map service application

The machine learning engine 10 is specifically a classifier as follows.
Support vector machine: A pattern recognition model that uses supervised learning, and is a learning algorithm that can be applied to classification and regression.
KNN (K Nearest Neighbor): A learning algorithm that plots training data on a vector space, acquires arbitrary K pieces in order of proximity to unknown data, and estimates the class to which the data belongs by majority vote.
Decision tree: A predictive model that draws conclusions about the target value of a certain item from the observation results of that item. Internal nodes correspond to variables, and branches to child nodes indicate possible values for that variable. The leaf (end point) represents the predicted value of the objective variable with respect to the variable value represented by the route from the root.
Random Forest: A group learning algorithm that uses a decision tree as a weak learner.
Naive Bayes: A supervised learning algorithm based on Bayes' theorem.
Neural network: A learning algorithm that mathematically models the neurons of the human cranial nerve system.

FIG. 3 is an explanatory diagram showing the characteristics of the communication log for each application.

According to FIG. 3, the communication log of the wireless data link generated by the behavior of the running application represents a feature amount (uplink wireless traffic amount, downlink wireless traffic amount, connection time). For example, in the case of a chat service application, the amount of uplink radio traffic and the amount of downlink radio traffic are small, and the connection time is short. On the other hand, for example, in the case of a video service application, the amount of uplink wireless traffic and the amount of downlink wireless traffic are large, and the connection time is long.

FIG. 4 is an explanatory diagram showing an estimation stage of the machine learning engine in the present invention.

The machine learning engine 10 inputs a predetermined number of continuous communication logs (explanatory variables) in the wireless data link generated by the running application in the terminal 2.
Then, the machine learning engine 10 outputs the running application identifier (objective variable) in the terminal 2 by using the learning model constructed in advance.
According to FIG. 4, for example, the application ID of the video service is output to the communication log of the wireless data link having a large amount of uplink radio traffic and a large amount of downlink radio traffic and a long connection time.

According to FIG. 1 described above, the estimation device 1 is represented to receive the communication log of the radio data link from the base station 3, but the radio generated in the estimation device 1 by the running application in the terminal. The database in which the communication log of the data link is stored may be stored in advance.

[Terminal management database 12]
The terminal management database 12 stores the running application identifier estimated by the machine learning engine 10 in association with the terminal.

[Communication log connection unit 11]
The communication log connecting unit 11 concatenates the communication logs in which the data packets of the wireless data link are divided, and outputs the concatenated communication logs to the machine learning engine 10.

In a wireless data link, the following two division phenomena may occur for a data packet.
(1) Data packet fragmentation due to communication interruption (dormant) of wireless data link (MRCS: Multi Records Combined into a Session)
(2) Data packet split (SSMR: Session Split into Multiple Records) due to handover that the base station captured by the terminal is changed.

Even if a data packet of a wireless data link is generated due to the behavior of a running application, if the data packet is divided by the influence of the wireless data link, it is difficult to estimate the running application from the communication log. That is, the division of the communication log of the wireless data link causes a significant decrease in the determination accuracy because the correct communication log for each application cannot be acquired.

Here, the communication log connecting unit 11 outputs to the machine learning engine 10 while connecting the communication logs generated by the division phenomenon in the wireless data link. As a result, the machine learning engine 10 can estimate the running application identifier without considering the division of the communication log.

FIG. 5 is a flowchart showing the processing of the communication log connecting unit.

The communication log connecting unit 11 inputs a continuous communication log (explanatory variable) in the wireless data link generated by the running application in the terminal 2.
The division of the data packet is confirmed by the presence or absence of RIT (Record Interval Time) recorded in the communication log of the data packet. If the occurrence of RIT is recognized, the communication logs are linked by MRCS (Multi Records Combined into a Session).

(S111) The communication log connecting unit 11 concatenates the communication logs of the data packets of the radio data link divided by the dormant.
Here, concatenation of communication logs means adding the amount of radio traffic and connection time between adjacent communication logs and merging them into one communication log.

FIG. 6 is an explanatory diagram showing the concatenation of data packets of a radio data link divided by a dormant.

According to FIG. 6, first, the data packet to be transmitted from the wireless data link by the running application of the terminal 2 is transmitted to the base station 3 as it is. The base station 3 generates a communication log from the data packet of the wireless data link, and transmits the communication log to the estimation device 1.
After that, the data packet of the wireless data link is divided by the dormant generated between the terminal 2 and the base station 3, and is transmitted to the base station 3 in the divided state. The base station 3 generates a communication log from the data packet of the divided wireless data link, and transmits the communication log to the estimation device 1. The estimation device 1 detects the division of the data packet by the dormant from the communication log and concatenates the communication log.

(S112) The communication log connecting unit 11 concatenates the communication logs of the data packets of the wireless data link divided by the handover.
Handover means that the base station 3 captured by the terminal 2 is changed.

FIG. 7 is an explanatory diagram showing the concatenation of data packets of the radio data link divided by the handover.

According to FIG. 7, at first, the data packet to be transmitted from the wireless data link by the running application of the terminal 2 is transmitted to the base station 3 as it is. The base station 3 generates a communication log from the data packet of the wireless data link, and transmits the communication log to the estimation device 1.
After that, the data packet of the wireless data link is divided by the handover generated between the terminal 2 and the plurality of base stations 3, and is transmitted to each base station 3 while being divided. Each base station 3 generates a communication log from the data packet of the divided wireless data link, and transmits the communication log to the estimation device 1. The estimation device 1 detects the division of the data packet due to the handover from the communication log, and concatenates the communication logs.

As described above in detail, according to the estimation device, the program and the method of the present invention, the analysis of the data packet by the wireless communication carrier is low cost and the risk of privacy infringement is reduced, and the terminal is being activated. The application can be estimated.

Various modifications, modifications and omissions of the above-mentioned various embodiments of the present invention within the scope of the technical idea and viewpoint of the present invention can be easily carried out by those skilled in the art. The above explanation is just an example and does not attempt to limit anything. The present invention is limited only to the scope of claims and their equivalents.

1 Estimator 10 Machine learning engine 11 Communication log connection unit 12 Terminal management database 2 Terminal 3 Base station 4 Application server

Claims (7)

An estimation device that estimates running applications for terminals that are in wireless communication with base stations.
As a learning stage, it has a machine learning engine that builds a learning model using teacher data with the communication log of the wireless data link as the explanatory variable and the running application identifier as the objective variable.
As an estimation stage
It has a communication log linking means for linking communication logs in which data packets of a wireless data link in the terminal are divided.
The machine learning engine is an estimation device, characterized in that it inputs a communication log linked by the communication log linking means and outputs a running application identifier in the terminal. The estimation device according to claim 1, wherein the communication log of the wireless data link is a wireless traffic amount and / or a connection time with respect to a base station. The estimation device according to claim 2, wherein the radio traffic amount includes both an upstream traffic amount and a downstream traffic amount. One of claims 1 to 3, wherein the communication log linking means concatenates adjacent communication logs for data packet fragmentation (MRCS: Multi Records Combined into a Session) due to communication interruption of a wireless data link. The estimation device according to item 1 . The communication log linking means is characterized in that adjacent communication logs are linked for data packet splitting (SSMR: Session Split into Multiple Records) based on a handover in which a base station captured by a terminal is changed. The estimation device according to any one of 4 to 4 . It is a program that makes the computer installed in the device that estimates the running application function for the terminal that is wirelessly communicating with the base station.
As a learning stage, the communication log of the wireless data link is used as an explanatory variable, and the teacher data with the running application identifier as the objective variable is used to function as a machine learning engine that builds a learning model.
As an estimation stage
The data packet of the wireless data link in the terminal is made to function as a communication log connecting means for connecting the divided communication logs.
The machine learning engine is a program characterized in that a computer functions to input a communication log linked by the communication log linking means and output a running application identifier in the terminal. This is a method for estimating a running application in a device that has acquired a communication log of a wireless data link in a terminal that is wirelessly communicating with a base station.
The device is
As a learning stage, it has a machine learning engine that builds a learning model using teacher data with the communication log of the wireless data link as the explanatory variable and the running application identifier as the objective variable.
As an estimation stage
The first step of concatenating the communication log in which the data packet of the wireless data link in the terminal is divided is
With the second step, the machine learning engine inputs the communication log connected by the first step and outputs the running application identifier in the terminal.
A method of estimating a running application of a device, characterized by running.

Images