KR101423975B1 - System and method for managing network traffic using monitoring and filtering policy - Google Patents

Abstract

The present invention relates to a system and method for managing network traffic using a monitoring and filtering policy, and more particularly, to a system and method for monitoring network traffic using monitoring and filtering policies, By filtering the packets according to the received filtering policy, it is possible to quickly and easily detect traffic of additional traffic for data communication (for example, session holding data) or a malicious user that can increase the load on the communication network, Can be filtered.

Description

TECHNICAL FIELD [0001] The present invention relates to a system and method for managing network traffic using monitoring and filtering policies,

The present invention relates to a system and method for managing network traffic using a monitoring and filtering policy, and more particularly, to a system and method for monitoring network traffic using monitoring and filtering policies, By filtering the packets according to the received filtering policy, it is possible to quickly and easily detect traffic of additional traffic for data communication (for example, session holding data) or a malicious user that can increase the load on the communication network, To a network traffic management system using the monitoring and filtering policy and a method thereof.

2. Description of the Related Art In recent years, various applications have emerged as user terminals such as smart phones and tablet PCs are activated. Among them, an application that requires a function to receive or send a packet, such as a messenger, or an application that transmits data to a specific server is increasing. However, it is not possible to monitor unnecessary or malicious traffic by monitoring the traffic generated by all applications in the network of the current carrier.

The application in the form of a messenger must always transmit the location of the user terminal on which the application is mounted to the server for the packet forwarding function. That is, the server must know the location of the user terminal for packet transmission. To this end, the session between the user terminal and the corresponding server must be maintained so that the location information of the user terminal can be periodically or temporarily transmitted to the corresponding server. In order to maintain such a session, session maintenance data (e.g., a keep alive message, a heartbeat message, etc.) irrelevant to actual message delivery should be periodically exchanged between the user terminal and the server . Since data for sending and receiving session data is independently performed for each application, when a large number of messenger applications are installed or operated in one terminal, a load on a network system of a communication provider is sometimes generated.

There is also an application in which data is leaked from an arbitrary user terminal in the absence of a user and the data is leaked to a malicious user's server. It is necessary to detect and control the data traffic of the user terminal in order to quickly find out and to block such data traffic in advance.

SUMMARY OF THE INVENTION The present invention has been made in order to solve the above problems, and it is an object of the present invention to provide a method and apparatus for detecting a packet of an application on the side of a user terminal according to a monitoring policy and transmitting traffic statistical information on the detected packet, A monitoring and filtering policy capable of quickly and easily detecting traffic of a traffic for data communication (for example, session holding data) or a malicious user that can increase the load on the communication network and filtering the traffic on the user terminal side And a method thereof.

To this end, the system according to the first aspect of the present invention includes: a network traffic management apparatus for generating a monitoring policy and a filtering policy and transmitting the generated monitoring policy and filtering policy to a user terminal to manage network traffic; And a control unit that detects and classifies packets generated in the application of the user terminal according to a monitoring policy received from the network traffic management apparatus by application or destination address and generates traffic statistical information for the detected packet, And a traffic control device for filtering packets in a kernel area of the user terminal according to a filtering policy received from the network traffic management device.

According to a second aspect of the present invention, there is provided an apparatus comprising: a packet collection unit for collecting packets generated in an application of a user terminal by port numbers in the user terminal; A packet monitoring unit for classifying packets collected according to a monitoring policy among the collected packets by application or destination address and detecting the classified packets in a kernel area of the user terminal; A traffic management unit for generating traffic statistical information through analysis of the detected packet, transmitting the statistical information to the network traffic management apparatus, and receiving a filtering policy from the network traffic management apparatus; And a packet filtering unit for filtering a packet of an application corresponding to the received filtering policy or a packet having a blocking destination address included in the filtering policy in a kernel area of the user terminal.

Wherein the traffic management unit comprises: a traffic information generation unit for generating traffic statistical information through analysis of the detected packet and transmitting the generated traffic statistical information to the network traffic management device; A policy setting unit setting the monitoring policy and the filtering policy to the packet monitoring unit and the packet filtering unit, respectively; A policy DB for storing the monitoring policy and the filtering policy; A traffic information DB for storing the generated traffic statistical information; And a filtering DB for storing packet information of the filtered packet.

The packet monitoring unit monitors packets of an application using a predetermined registered port or an unregistered port among the collected packets by port number.

The packet monitoring unit monitors a packet of an application using the predetermined unregistered port to extract protocol information, a destination address, and a port number.

The packet monitoring unit monitors a packet of an application using the predetermined unregistered port and extracts a destination MAC address, a destination IP address, and a destination port number for the destination address.

The packet monitoring unit extracts the protocol information, the destination address, and the port number when a socket is created by an application using the predetermined unregistered port.

The packet monitoring unit monitors a packet of an application using the predetermined unregistered port and calculates a packet generation period in which an application generates a packet.

The packet filtering unit filters a packet of an application corresponding to the filtering policy or a packet having a blocking destination address of the filtering policy using a netfilter operating in a kernel area of the user terminal.

The packet filtering unit controls a net filter for generating a handler for controlling a filtering policy operating in a kernel region of the user terminal in a user domain and performing filtering using the generated handler.

According to a third aspect of the present invention, there is provided a method comprising: receiving a monitoring policy from a network traffic management apparatus; A packet collecting step of collecting packets generated in an application of a user terminal by port numbers; A packet monitoring step of classifying packets according to the received monitoring policy by application or destination address through monitoring the collected packets and detecting the packets in a kernel area of the user terminal; A traffic information generation step of analyzing the detected packet to generate traffic statistical information; A filtering policy receiving step of transmitting the generated traffic statistical information to a network traffic management apparatus and receiving a filtering policy from the network traffic management apparatus; And filtering the packet of the application corresponding to the received filtering policy or the packet having the blocking destination address included in the filtering policy in the kernel area of the user terminal.

The packet monitoring step separates packets of an application using a pre-registered port or an unregistered port among the collected packets by port number and monitors the packets.

The packet monitoring step monitors the packets of the application using the predetermined unregistered port and extracts the protocol information, the destination address, and the port number.

The packet monitoring step monitors a packet of an application using the predetermined unregistered port and extracts a destination MAC address, a destination IP address, and a destination port number for the destination address.

The packet monitoring step may include extracting the protocol information, the destination address, and the port number when a socket is created by an application using the predetermined unregistered port.

Wherein the packet monitoring step monitors a packet of an application using the predetermined unregistered port to calculate a packet generation period in which an application generates a packet.

The packet filtering step is characterized by filtering a packet of an application corresponding to the filtering policy or a packet having a blocking destination address of the filtering policy using a netfilter operating in a kernel area of the user terminal .

The packet filtering step controls a net filter for generating a handler for controlling a filtering policy operating in a kernel area of the user terminal in the user domain and performing filtering using the generated handler.

According to the present invention, a packet of an application is detected on the side of a user terminal according to a monitoring policy, traffic statistics information on the detected packet is transmitted, and a packet is filtered according to a received filtering policy, It is possible to quickly and easily detect an incidental traffic for data communication (for example, session holding data) or a malicious user's traffic, and filter it on the user terminal side.

For example, the present invention minimizes the traffic required for registration, authentication, and keep-alive message transmission of an application for providing a push service, and transmits a message that can increase the load on the network in advance There is an effect that can be filtered.

Further, the present invention has the effect of promptly recognizing and filtering packets of an application contrary to a monitoring policy and a filtering policy, an application having a malicious purpose, or an application causing an abnormal traffic.

The present invention also provides a method of monitoring and filtering packets of an application using an unregistered port by dividing an application of a user terminal into applications using a predetermined registration port or an unregistered port, It is possible to reduce the number of necessary packets, thereby reducing the amount of operation of the user terminal.

1 is a block diagram of a network traffic management system using a monitoring and filtering policy according to an embodiment of the present invention.
FIG. 2 is a block diagram of a traffic control apparatus using a monitoring and filtering policy according to an embodiment of the present invention.
FIG. 3 is a detailed configuration diagram of an embodiment of the traffic management unit of FIG. 2 according to the present invention;
FIG. 4 is a flowchart illustrating a network traffic management method using a monitoring and filtering policy according to an embodiment of the present invention.
5 is a flowchart of a traffic control method in a traffic control apparatus according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. The configuration of the present invention and the operation and effect thereof will be clearly understood through the following detailed description. Before describing the present invention in detail, the same components are denoted by the same reference symbols as possible even if they are displayed on different drawings. In the case where it is judged that the gist of the present invention may be blurred to a known configuration, do.

1 is a block diagram of a network traffic management system using a monitoring and filtering policy according to an embodiment of the present invention.

1, a network traffic management system 10 using a monitoring and filtering policy according to the present invention includes a traffic control device 110, a network traffic management device 200, and a service (300).

The network traffic management apparatus 200 manages network traffic between the user terminal 100 and the service providing apparatus 300. To this end, the network traffic management apparatus 200 generates a monitoring policy and a filtering policy, and transmits the generated monitoring policy and filtering policy to the traffic control apparatus 110 included in the user terminal 100 to manage traffic. Here, the network traffic management apparatus 200 can receive the traffic statistical information from the traffic control apparatus 110 and confirm the traffic statistical information of each user terminal 100. The network traffic management apparatus 200 generates a filtering policy through analysis of traffic statistical information of each user terminal 100 and transmits the filtering policy to the traffic control apparatus 110. The network traffic management apparatus 200 may collect traffic information on traffic to be managed in advance, generate a filtering policy, and transmit the generated filtering policy to the traffic control apparatus 110.

Here, the communication network refers to a network that provides a communication service between the user terminal 100, the network traffic management apparatus 200, and the service providing apparatus 300 so that they can communicate with each other through wired and wireless lines. That is, the communication network may be a wired Internet network, and may be a wireless data network (Internet network, IMS, etc.) connected through a mobile communication network (CDMA, W-CDMA or the like) or an Internet network . ≪ / RTI >

The traffic control device 110 controls traffic generated through the application 101 installed in the user terminal 100. Here, the user terminal 100 can be applied to any type of terminal capable of performing the traffic control function, such as a laptop, a smart phone, a PDA, a navigation system, a PMP, an electronic dictionary, and MP3. The traffic control apparatus 110 may perform a traffic control function through a traffic control program provided through an external system or an external storage medium based on a network.

The traffic control apparatus 110 may control the packet generated in the application of the user terminal 100 in accordance with the monitoring policy received from the network traffic management apparatus 200 in the kernel area of the user terminal 100 Or destination addresses. The traffic control apparatus 110 transmits the traffic statistical information on the detected packet to the network traffic management apparatus 200. Thereafter, the traffic control device 110 transmits a packet having a blocking destination included in the packet of the application or the filtering policy received from the network traffic management device 200 to the user terminal 100 Filter in the kernel area.

2 is a block diagram of a traffic control apparatus using a monitoring and filtering policy according to an embodiment of the present invention.

Hereinafter, each of the components of the traffic control apparatus according to the present invention will be described.

2, the traffic control apparatus 110 includes a packet collecting unit 210, a packet monitoring unit 220, a traffic managing unit 230, and a packet filtering unit 240. Here, the traffic control device 110 receives a packet generated in the application 101 installed in the user terminal 100.

The packet collecting unit 210 collects the packets generated in the application 101 installed in the user terminal 100 by dividing the packets by the port numbers in the user terminal 100.

The packet monitoring unit 220 classifies the packets collected by the packet collecting unit 210 according to the monitoring policy by application or destination address and detects the packets in the kernel region of the user terminal.

Specifically, the packet monitoring unit 220 separates packets of the application 101 using a predetermined registered port or an unregistered port among the packets collected by the packet collecting unit 210 for each transmitting port and the receiving port.

Looking at the registration port and the unregistered port, the application 101 can be divided into an application using a well-known Port or an Unknown Port. For example, an application using a predetermined registration port includes an application such as a web browser. The packet transmission / reception of an application using a predetermined registration port can be basically passed without a policy comparison. On the other hand, the packet monitoring unit 220 detects a packet according to a monitoring policy, assuming that a packet of an application using an unregistered port operates according to its own standard. Here, when the port number used by the application 101 of the user terminal 100 is registered in the network traffic management apparatus 200, the port number used by the application 101 is referred to as a registration port. The unregistered port refers to a port number not registered in the network traffic management apparatus 200.

The packet monitoring unit 220 can monitor the packet of the application 101 using the predetermined unregistered port to extract the protocol information, the destination address, and the port number. If the application using the registration port complies with the filtering policy, the packet monitoring unit 220 can reduce packets monitoring and monitoring only packets of the application 101 using the unregistered port.

At this time, the packet monitoring unit 220 can extract the protocol information, the destination address, and the port number only when the socket is generated, in the packet of the application 101 using the predetermined unregistered port. Since the application 101 has the same destination address and the same port number as the same protocol information after generating the socket with the service providing apparatus 300, it extracts the protocol information, the destination address, and the port number only at the time of socket creation, Can be reduced. Here, the packet monitoring unit 220 extracts a destination MAC address, a destination IP address, and a destination port number as a destination address.

In addition, the packet monitoring unit 220 can monitor the packet of the application 101 using the predetermined unregistered port to calculate the packet generation period. For example, when the packet generation period is set in the monitoring policy, the packet monitoring unit 220 can detect the packet of the application 101 exceeding the packet generation period.

On the other hand, the packet monitoring unit 220 does not check the payload of the application 101, but checks whether there is an incoming / outgoing packet. Accordingly, the packet monitoring unit 220 can reduce the load on the packet monitoring. If necessary, the packet monitoring unit 220 may capture the entire packet data, that is, the header and the packet payload of the packet, analyze the packet, or transmit the packet to the network traffic management apparatus 200.

Thereafter, the packet filtering unit 240 filters packets in the application area corresponding to the filtering policy or packets having the blocking destination address included in the filtering policy in the kernel area of the user terminal 100. Here, the filtering policy is received from the network traffic management apparatus 200. The packet filtering unit 240 filters a packet of the application 101 corresponding to the filtering policy or a packet having the blocking destination address of the filtering policy using a netfilter operating in the kernel area of the user terminal 101 . The packet filtering unit 240 generates a handler (e.g., iptalbes handler, libipq *) for controlling the filtering policy operating in the kernel area of the user terminal 100 in the user area and performs filtering using the generated handler You can control the netfilter.

Meanwhile, the traffic management unit 230 analyzes the packet detected by the packet monitoring unit 220 and generates traffic statistical information. The traffic management unit 230 transmits the generated traffic statistical information to the network traffic management apparatus 200.

FIG. 3 is a detailed configuration diagram of an embodiment of the traffic management unit of FIG. 2 according to the present invention.

3, the traffic management unit 230 includes a traffic information generation unit 310, a policy setting unit 320, and a data storage unit 330. The data storage unit 330 includes a policy DB 331, a traffic DB 332, and a filtering DB 333. [

The traffic information generation unit 310 generates traffic statistical information by analyzing the packets detected by the packet monitoring unit 220 by application or destination address. The traffic statistic information includes the number or size of packets per application for a certain period of time, the number or size of packets per destination address during a certain period of time, and the like.

The policy setting unit 320 sets the received monitoring policy and the filtering policy to the packet monitoring unit 220 and the packet filtering unit 240, respectively. Monitoring policies include a list of applications to monitor, protocol information to monitor, the port number to monitor, the frequency of packets to be monitored, and the destination address to monitor. The filtering policy includes a blocking application list and a blocking destination list (Blocking Destination List).

The data storage unit 330 stores traffic statistics information, traffic information, and packet information for the filtered packet generated by the traffic information generation unit 310.

Specifically, the data storage unit 330 stores the received monitoring policy and filtering policy in the policy 331. In addition, the data storage unit 330 stores traffic statistical information for each application or destination address generated by the traffic information generation unit 310 in the traffic DB 332. [ The data storage unit 330 stores the filtered packet information in the filtering DB 333 in the packet filtering unit 240.

4 is a flowchart illustrating a method of managing network traffic using a monitoring and filtering policy according to an embodiment of the present invention.

The application 101 installed in the user terminal 101 transmits a session holding packet to the service providing apparatus 300 or transmits a malicious packet (S402).

The traffic control device 110 collects packets from the application 101 installed in the user terminal 101 (S404).

Then, the traffic control device 110 monitors the collected packets according to the monitoring policy (S406).

The traffic control device 110 generates traffic statistical information using the monitoring result in the monitoring process of " S406 " and transmits the generated traffic statistical information to the network traffic management device 200 (S408).

The network traffic management apparatus 200 analyzes the traffic statistic information received from the traffic control apparatus 110 and generates a filtering policy using the analyzed result.

The network traffic management apparatus 200 transmits the generated filtering policy to the traffic control apparatus 110. [

The traffic control device 110 then filters packets of the application 101 according to the filtering policy received from the network traffic management device 200. [

The traffic control device 110 blocks the packet of the application 101 according to the received filtering policy (S416). In the process "S416 ", a process of blocking a packet is described. In step "S416 ", the traffic control apparatus 110 may block or allow the packet according to the filtering policy.

5 is a flowchart of a traffic control method in a traffic control apparatus according to an embodiment of the present invention.

The network traffic management apparatus 200 transmits the monitoring policy to the traffic control apparatus 110 (S502). Then, the traffic management unit 230 receives the monitoring policy (S502).

The traffic management unit 230 sets the received monitoring policy in the packet monitoring unit 220 (S504).

The packet collecting unit 210 collects the packets generated in the application 101 installed in the user terminal 110 according to the port numbers and collects the collected packets. The packet monitoring unit 220 collects (S506).

The packet monitoring unit 220 checks whether there is a packet conforming to the monitoring policy through the packet monitoring in the kernel area of the user terminal 110 (S508). The packet monitoring unit 220 can classify and detect packets by application or destination address.

If there is a packet meeting the monitoring policy (S508), the traffic management unit 230 analyzes the packet detected by the packet monitoring unit 220 to generate traffic statistical information (S510).

The traffic management unit 230 transmits the generated traffic statistical information to the network traffic management apparatus 200 (S512).

The network traffic management apparatus 200 analyzes the received traffic statistical information and generates a filtering policy using the analyzed result (S514).

The network traffic management apparatus 200 transmits the generated filtering policy to the traffic control apparatus 110 (S516).

The packet filtering unit 240 filters the packet of the application 101 according to the filtering policy received from the traffic control device 110 (S518). That is, the packet filtering unit 240 filters packets in an application corresponding to the filtering policy or a packet having a blocking destination address included in the filtering policy in the kernel area of the user terminal.

Meanwhile, the present invention can be applied to various playback apparatuses by implementing the above-described data traffic control method in a software program and recording the program on a predetermined recording medium readable by a computer.

A variety of playback devices may be PCs, laptops, portable terminals, smart phones, and the like.

For example, the recording medium may be a hard disk, a flash memory, a RAM, a ROM, or the like embedded in each reproduction apparatus, or an external optical disk such as a CD-R or a CD-RW, a compact flash card, a smart media, have.

In this case, a program recorded on a computer-readable recording medium includes a monitoring policy receiving process for receiving a monitoring policy from the network traffic management apparatus; A packet collecting process of collecting packets generated in an application of a user terminal by port numbers; A packet monitoring process of classifying packets according to the received monitoring policy by application or destination address through monitoring the collected packets and detecting the packets in a kernel area of the user terminal; A traffic information generating step of analyzing the detected packet to generate traffic statistical information; A filtering policy receiving step of transmitting the generated traffic statistical information to a network traffic management apparatus and receiving a filtering policy from the network traffic management apparatus; And filtering the packet having the blocking destination address included in the packet of the application corresponding to the received filtering policy or the filtering policy in the kernel area of the user terminal.

The foregoing description is merely illustrative of the present invention, and various modifications may be made by those skilled in the art without departing from the spirit of the present invention. Accordingly, the embodiments disclosed in the specification of the present invention are not intended to limit the present invention. The scope of the present invention should be construed according to the following claims, and all the techniques within the scope of equivalents should be construed as being included in the scope of the present invention.

According to the present invention, a packet of an application is detected on the side of a user terminal according to a monitoring policy, traffic statistics information on the detected packet is transmitted, and a packet is filtered according to a received filtering policy, It is possible to quickly and easily detect traffic of traffic for data communication (for example, data for session holding) or a malicious user and filter it on the user terminal side. In this respect, it is not only the use of the related technology but also the possibility of commercialization or operation of the applied device, as it exceeds the limit of the existing technology.

10: Network traffic management system
100: user terminal
110: traffic control device 200: network traffic management device
300: Service providing apparatus 210: Packet collecting unit
220: packet monitoring unit 230: traffic management unit
240: packet filtering unit

Claims (18)

A network traffic management apparatus for generating a monitoring policy and a filtering policy and transmitting the generated monitoring policy and filtering policy to a user terminal to manage network traffic; And
The method of claim 1, further comprising: collecting packets generated in an application of a user terminal by port numbers in the user terminal, classifying packets according to a monitoring policy received from the network traffic management apparatus by application or destination address, Generates a traffic statistic information for the detected packet, and transmits the packet statistic information to the network traffic management apparatus, and transmits a packet of an application corresponding to the filtering policy received from the network traffic management apparatus, A traffic control device for filtering a packet having an address in a kernel area of the user terminal
A network traffic management system using monitoring and filtering policies. A packet collecting unit for collecting the packets generated in the application of the user terminal by the port numbers in the user terminal;
A packet monitoring unit for classifying packets collected according to a monitoring policy among the collected packets by application or destination address and detecting the classified packets in a kernel area of the user terminal;
A traffic management unit for generating traffic statistical information through analysis of the detected packet, transmitting the statistical information to the network traffic management apparatus, and receiving a filtering policy from the network traffic management apparatus; And
A packet filtering unit for filtering a packet of an application corresponding to the received filtering policy or a packet having a blocking destination address included in the filtering policy in a kernel area of the user terminal,
And a monitoring and filtering policy including the monitoring and filtering policy. 3. The method of claim 2,
The traffic management unit,
A traffic information generation unit for generating traffic statistical information through analysis of the detected packet and transmitting the generated traffic statistical information to the network traffic management apparatus;
A policy setting unit setting the monitoring policy and the filtering policy to the packet monitoring unit and the packet filtering unit, respectively;
A policy DB for storing the monitoring policy and the filtering policy;
A traffic information DB for storing the generated traffic statistical information; And
A filtering DB for storing packet information on the filtered packet,
The traffic control apparatus comprising: 3. The method of claim 2,
The packet monitoring unit,
Wherein the monitoring unit separates packets of an application using a predetermined registration port or an unregistered port among the collected packets by port numbers. 5. The method of claim 4,
The packet monitoring unit,
And extracts protocol information, a destination address, and a port number by monitoring packets of an application using the predetermined unregistered port. 6. The method of claim 5,
The packet monitoring unit,
Monitoring a packet of an application using the predetermined unregistered port, and extracting a destination MAC address, a destination IP address, and a destination port number for the destination address. 6. The method of claim 5,
The packet monitoring unit,
And extracts the protocol information, the destination address, and the port number when a socket is created by an application using the predetermined unregistered port. 5. The method of claim 4,
The packet monitoring unit,
Wherein the monitoring unit monitors a packet of an application using the predetermined unregistered port to calculate a packet generation period in which an application generates a packet. 3. The method of claim 2,
Wherein the packet filtering unit comprises:
Wherein a packet of an application corresponding to the filtering policy or a packet having a blocking destination address of the filtering policy is filtered using a Netfilter operating in a kernel area of the user terminal. 10. The method of claim 9,
Wherein the packet filtering unit comprises:
Wherein the control unit controls the net filter to generate a handler for controlling a filtering policy operating in a kernel area of the user terminal in a user area and perform filtering using the generated handler. Receiving a monitoring policy from a network traffic management device;
A packet collecting step of collecting packets generated in an application of a user terminal by port numbers;
A packet monitoring step of classifying packets according to the received monitoring policy by application or destination address through monitoring the collected packets and detecting the packets in a kernel area of the user terminal;
A traffic information generation step of analyzing the detected packet to generate traffic statistical information;
A filtering policy receiving step of transmitting the generated traffic statistical information to a network traffic management apparatus and receiving a filtering policy from the network traffic management apparatus; And
A filtering step of filtering in the kernel area of the user terminal a packet of an application corresponding to the received filtering policy or a packet having a blocking destination address included in the filtering policy
A method for controlling data traffic using a monitoring and filtering policy. 12. The method of claim 11,
The packet monitoring step includes:
Wherein packets of an application using a preset registration port or an unregistered port among the collected packets are classified by port number and monitored. 13. The method of claim 12,
The packet monitoring step includes:
Wherein the protocol information, the destination address, and the port number are extracted by monitoring a packet of an application using the predetermined unregistered port. 14. The method of claim 13,
The packet monitoring step includes:
Monitoring a packet of an application using the predetermined unregistered port, and extracting a destination MAC address, a destination IP address, and a destination port number for the destination address. 14. The method of claim 13,
The packet monitoring step includes:
And extracting the protocol information, the destination address, and the port number when a socket is created by an application using the predetermined unregistered port. 13. The method of claim 12,
The packet monitoring step includes:
And monitoring the packets of the application using the predetermined unregistered port to calculate a packet generation period in which packets are generated in the application. 12. The method of claim 11,
Wherein the packet filtering step comprises:
Wherein a packet of an application corresponding to the filtering policy or a packet having a blocking destination address of the filtering policy is filtered using a Netfilter operating in a kernel area of the user terminal. 18. The method of claim 17,
Wherein the packet filtering step comprises:
Wherein the control unit controls the net filter to generate a handler for controlling a filtering policy operating in a kernel area of the user terminal in a user area and perform filtering using the generated handler.

Images