KR101852506B1 - Apparatus and method for identifying terminal information - Google Patents

Abstract

According to the present invention, a packet collector collects IP packets transmitted from a terminal, and the terminal identification unit maintains and maintains operating system information included in IP packets collected by the packet collector, Time, and window scale factor, and the address translation identification unit identifies whether the retention time is reduced by identifying whether the network address translation apparatus is used or not, and analyzes the type of the terminal and the network address translation It can be easily implemented because the terminal information such as the passing state of the device can be identified and the complexity is lower than that of the conventional method of viewing the linearity and the execution overhead of the terminal and the address conversion identification system can be reduced.
In addition, the present invention can be utilized not only as to whether or not to use the network address translation apparatus, but also as a basic data for providing service for each terminal by identifying the terminal type.

Description

[0001] APPARATUS AND METHOD FOR IDENTIFYING TERMINAL INFORMATION [0002]

The present invention relates to a terminal information identification system and a method thereof, and more particularly, to a terminal information identification system and a terminal information identification system for identifying terminal information such as a type of terminal and a network address translation device via packet analysis .

Network Address Translation (NAT) provides a function for allowing a plurality of terminals to share a single line.

Through this, a number of terminals can be connected with a small number of public IPs to partially solve IPv4 address exhaustion problem.

In addition, since the network address translation device changes the source IP of the packet sent from the terminal to the public IP and transmits it to the outside, the address of the terminal can not be known from the outside.

This provides the advantage of protecting internal terminals from unauthorized external access.

In recent years, as the spread of mobile devices such as smart phones and pads has become popular, the use of network address translation devices capable of connecting a large number of terminals to limited lines is also increasing.

In addition, due to the increase of Internet of things (ioT) such as u-health, connected car, IPTV and home network, the frequency of use of network address translation devices is rapidly increasing .

However, the increased use of such network address translation devices may lead to increased traffic to the line, which may degrade network quality of other users or interfere with network utilization.

Increasing investment in network equipment to prevent such performance and quality degradation leads to unnecessary economic losses.

In addition, some malicious users may be able to paralyze the entire circuit by attacks such as virus distribution and DDoS attack.

In addition, since the network address translation device is difficult to identify the information of the terminal from the outside, it is possible to attack such that an attacker masquerades as another ordinary user and intercepts information of another person or transmits wrong information.

Therefore, in order to solve the problems of the network address translation apparatus, it is necessary to identify the terminal using the network address translation apparatus.

In this regard, a conventional method for detecting whether or not a network address translation apparatus is available includes a method of obtaining information of a terminal by inserting an identifier into the terminal and a method of using the analysis of the received packet.

A method of inserting an identifier is a method of sending a frame such as a script or an applet to a response of a received packet.

This method is transmitted to the terminal, the browser of the terminal executes the frame, and as a result, the terminal information is fetched. Through this, it is determined whether or not the terminal uses the private IP, and the network address translation device is detected.

This method has the disadvantage that it can be executed only when insertion or execution of a frame or code is allowed in the browser of the terminal, while it can greatly increase the detection accuracy because it inquires the terminal whether to use the network address translation device directly.

On the other hand, the analysis of the received packet identifies the terminal by analyzing the characteristics of the packet transmitted from the terminal, and is a method that operates regardless of the characteristics of the terminal because there is no modification or insertion of the terminal.

The received packet analysis method includes a method using a linear increase in the ID (identification) field value of the IP header, a method using the linear increase property of the source port of the TCP header, and a method using the linearity of the timestamp value to be.

This method is advantageous in that it can operate without inserting commands or codes into the terminal because it analyzes the packets sent from the terminal.

However, a complicated algorithm for linearity analysis of each value is needed, and the complexity of the algorithm is also increasing as the characteristics of each field are changed recently.

In particular, as shown in FIG. 1, the ID is set to an arbitrary number in order to prevent the attacker's packet from being spoofed, so that the linearity is maintained only within the TCP session.

Also, as shown in FIG. 2, the source port may interfere with detection of source port number change due to the port forwarding function of the network address translation device, and the time stamp may be inactivated depending on the type of the operating system.

On the other hand, Prior Art 1 (Japanese Patent Laid-Open Publication No. 2016-40863) is a technology for separately identifying a terminal and a terminal by confirming an operating system (OS) and browser version information of the terminal using a user agent.

However, it does not matter what kind of terminal (classification of mobile, PC, etc.) is used in the prior art 1. Further, since the user agent field to be used is only used in the HTTP protocol, There is a disadvantage that the IoT terminals can not be identified.

Next, there is Prior Art 2 (Domestic Registration No. 10-1532877) in which information such as a model name and a communication company of a terminal is acquired using a user agent and used for an advertisement service,

Prior art 2 such as the smart phone includes a model name and a communication company information only for a terminal to which a communication chip is attached, and thus the object is limited.

In the prior art 2, it is described that one of the model name of the terminal and the affiliated communication company information should be obtained, and there is a part to check the OS version, but it is limited to the iphone.

In addition, since the user agent is used only in the HTTP protocol, there is a problem that the IoT terminals that do not use the browser can not be identified.

Next, there is Prior Art 3 (Korean National Publication No. 10-2016-0058300) which utilizes different TTL values of each OS for terminal identification.

The prior art 3 uses the TTL only for the terminal identification purpose, and the utilization method is limited, and the use of the router is not identified.

Next, there is Prior Art 4 (Domestic Registration No. 10-1480438) which utilizes a change in the TTL value to determine whether or not the router has passed.

The prior art 4 has a disadvantage in that it can only be estimated whether the terminal is connected to the router, and the type of the terminal connected to the router can not be confirmed.

Japanese Patent Laid-Open No. 2016-40863 Domestic Registration No. 10-1532877 Korean Publication No. 10-2016-0058300 Domestic Registration No. 10-1480438

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and it is an object of the present invention to provide a terminal information identification system and method for identifying terminal information such as a type of terminal and a network address translation device via packet analysis .

According to an aspect of the present invention, there is provided an IP packet transmission system including: a packet collector for collecting IP packets transmitted from a terminal; And a terminal identification unit for identifying the terminal type using the operating system information and the holding time included in the IP packet collected by the packet collector.

In addition, the terminal identification unit according to an aspect of the present invention identifies the operating system information of the user agent field as a computer terminal if the IP packet is an HTTP packet, and identifies the mobile terminal as a mobile terminal if the IP packet is an HTTP packet.

In addition, the terminal identification unit according to an aspect of the present invention identifies the IP header as a Windows-based computer terminal if the IP header is not an HTTP packet and the IP header is maintained longer than the first retention time reference value.

If the IP header is not equal to or smaller than the first retention time reference value in the case where the IP packet is not an HTTP packet, the terminal identification unit may use a window scale factor included in the TCP header of the IP packet Thereby identifying the terminal type.

The terminal identification unit of the present invention identifies a Linux-based computer terminal if the window scale factor is greater than the first window scale reference value, and identifies the mobile terminal if the window scale factor is not greater than the first window scale reference value.

In addition, the terminal identification unit according to an aspect of the present invention includes: a user agent extractor for extracting a field value from a user agent field when an IP packet is an HTTP packet; A retention time extractor for extracting retention time from the IP header when the IP packet is not an HTTP packet; And a terminal identifier that identifies the terminal type using the operating system according to the field value of the user agent field extracted by the user agent extractor and the retention time extracted by the retention time extractor.

The terminal identifier may further include a window scale extractor for extracting a window scale factor included in a TCP header when the IP packet is not an HTTP packet, Based computer terminal if it is larger than the time reference value, and if the hold time is equal to or smaller than the first hold time reference value, the terminal type is identified using the window scale factor.

According to another aspect of the present invention, there is further provided an address conversion identification unit for determining whether to use the network address translation apparatus by reducing the maintenance period of the IP packet collected by the packet collector.

In another aspect of the present invention, the address translation identification unit includes: a terminal type receiver for receiving a terminal type from the terminal identification unit; And if the terminal type received by the terminal type receiver is a window-based computer terminal, the use of the network address translation device is determined to be use if the IP header of the IP packet has a shorter maintenance period than a value obtained by subtracting 1 from the first sustain period reference value, When the terminal type is a Linux-based computer terminal and a mobile terminal, it is determined that the use of the network address translation device is used if the IP header of the IP packet has a shorter maintenance period than a value obtained by subtracting 1 from the second sustain period reference value .

According to another aspect of the present invention, there is provided a mobile communication system including a packet collector for collecting IP packets transmitted from a terminal; And a terminal identification unit for identifying the terminal type using the retention time and the window scale factor included in the IP packet collected by the packet collector.

In another aspect of the present invention, the terminal identification unit identifies the IP header of the IP packet as a window-based computer terminal if the IP header has a retention time greater than the first retention time reference value, The terminal type is identified by using the window scale factor included in the TCP header of the IP packet.

According to another aspect of the present invention, there is further provided an address conversion identification unit for determining whether to use the network address translation apparatus by reducing the maintenance period of the IP packet collected by the packet collection unit.

According to another aspect of the present invention, there is provided a method of transmitting a packet, the method comprising: (A) collecting an IP packet by a packet collector; (B) identifying a terminal type using an operating system information when an IP packet collected by the packet collector is an HTTP packet; And (C) if the IP packet collected by the packet collecting unit is not an HTTP packet, the terminal identifying unit identifies the terminal type using the holding time.

In addition, the step (B) of the still further aspect of the present invention may further comprise: (B-1) extracting a field value of the user agent field when the IP packet is an HTTP packet; (B-2) if the operating system information of the extracted user agent field is an operating system for a window-based computer, the terminal identifying unit identifies the operating system information as a window-based computer terminal; (B-3) The terminal identification unit identifies a Linux-based computer terminal if the operating system information of the extracted user agent field is an operating system for a Linux-based computer; And (B-4) the terminal identification unit identifies the operating system information of the extracted user agent field as a mobile terminal if the operating system is a mobile operating system.

In the step (C) of the still further aspect of the present invention, the terminal identification unit identifies the IP packet as a window-based computer terminal if the IP header of the IP packet has a retention time greater than a first retention time reference value.

In another aspect of the present invention, (D) the terminal identification unit further includes a step of identifying a terminal type using a window scale factor if the IP header of the IP packet has a retention time that is equal to or smaller than a first retention time reference value do.

According to still another aspect of the present invention, in the step (D), the terminal identification unit identifies the terminal as a Linux-based computer terminal if the window scale factor is larger than the first window scale reference value. And (D-2) the terminal identification unit identifies the mobile terminal if the window scale factor is not greater than the first window scale reference value.

According to still another aspect of the present invention, (E) the method further includes determining whether the network address translation apparatus is used by reducing the maintenance period of the IP packet collected by the address translation identification unit.

According to another aspect of the present invention, there is provided a method of transmitting a packet, the method comprising: (A) collecting IP packets transmitted from a terminal; And (B) identifying the terminal type using the retention time and the window scale factor included in the IP packet collected by the packet collector.

According to another aspect of the present invention, in the step (B), the terminal identification unit identifies the IP packet as a window-based computer terminal if the IP header holding time is greater than a first holding time reference value; And (B-2) identifying the terminal type by using the window scale factor of the IP packet if the terminal identification part is configured to hold the IP header of the terminal with the same or less than the first holding time reference value.

Still another aspect of the present invention further includes (C) determining whether the network address translation apparatus is used by decreasing the maintenance period of the IP packet collected by the address translation identification unit.

According to the present invention, a type of a terminal can be determined through a complex comparison of a TTL (Time To Live), a WSCALE (Window Scaling Factor), and a user agent And identifies whether or not the corresponding terminal uses the network address translation device. This can be easily implemented because the complexity is low compared with the existing linearity method, and the execution overhead of the terminal and address translation identification system can be reduced.

In addition, the present invention can be utilized not only as to whether or not to use the network address translation apparatus, but also as a basic data for providing service for each terminal by identifying the terminal type.

1 is a diagram showing a random ID distribution in Windows 10 according to the prior art.
2 is a view showing an overlap distribution of a source port according to the prior art.
3 is a network configuration diagram including a terminal information identification system according to a preferred embodiment of the present invention.
4 (a) and 4 (b) are views illustrating an operating system type used in a computer in a user agent field.
5 (a) and 5 (b) are views illustrating an operating system type used in a mobile in a user agent field.
6 is a diagram showing a structure of an IP header.
7 is a diagram showing a structure of a TCP header.
8 is a diagram showing fields included in the option of the TCP header
9 is a detailed configuration diagram of the terminal and the address translation identification device of FIG.
10 is a flowchart illustrating a method of identifying a UE according to an exemplary embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings.

First, the terminology used in the present application is used only to describe a specific embodiment, and is not intended to limit the present invention, and the singular expressions may include plural expressions unless the context clearly indicates otherwise. Also, in this application, the terms "comprise", "having", and the like are intended to specify that there are stated features, integers, steps, operations, elements, parts or combinations thereof, But do not preclude the presence or addition of features, numbers, steps, operations, components, parts, or combinations thereof.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

3 is a network configuration diagram including a terminal information identification system according to a preferred embodiment of the present invention.

3, a network including a terminal information identification system according to an exemplary embodiment of the present invention includes terminals 100a to 100n, a network address translator (NAT) 200, a plurality of routers 300 ), A terminal information identification system 400, and a server 500.

First, the network may be configured without regard to its communication mode such as wired and wireless, and may be connected to the Internet (World Wide Web), WLAN (Wireless LAN), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access GSM (Global System for Mobile communications) communication network, and the like.

The terminals 100a to 100n are devices having a function of connecting to a network and communicating with each other, such as a personal computer (e.g., a desktop computer or a notebook computer), a workstation, a PDA, , A mobile phone, an IPTV receiver, or the like, and can be any terminal having the computing ability by mounting a microprocessor and having memory means such as an IPTV receiver.

Herein, it is assumed for convenience that the terminals 100a to 100f perform communication via the network address translation device 200 and the terminals 100g to 100n perform communication without passing through the network address translation device 200 .

Next, the network address translation apparatus 200 performs a function of converting a private IP address of the terminals 100a to 100n included in the header information of the packet into a public IP address, And a mapping table composed of mapping data between information on the address.

The plurality of routers 300 (R1 to Rn) form a transmission path between the network address translation device 200 and the server 500. [ Here, the router R1 adjacent to the terminals 100a to 100n may be referred to as an edge router.

Next, the terminal information identification system 400 includes a packet collection unit 410, a terminal identification unit 420, and an address translation identification unit 430.

The packet collection unit 410 collects IP packets transmitted from the terminals 100a to 100n to the server 500 and provides the IP packets to the terminal identification unit 420. [

If the collected IP packet is an HTTP packet, the terminal identification unit 420 identifies the type of the terminal 100a through 100n through analysis of a user agent. If the collected IP packet is not an HTTP packet, And identifies the types of the terminals 100a to 100n through analysis of a TTL (Time To Live) of the header and a window scaling factor (WSCALE) of the TCP header. At this time, a packet used for analysis of the TTL (Time To Live) of the IP header and the window scaling factor (WSCALE) of the TCP header is preferably transmitted to the terminal 100a to 100n TCP SYN packets can be used.

The address translation identification unit 430 receives the terminal type identified by the terminal identification unit 420 and receives the maintenance period of the IP header to determine whether the network address translation apparatus 200 is used.

Meanwhile, the server 500 is a device for providing various web services and the like.

The operation of the network including the terminal information identification system according to an embodiment of the present invention will now be described.

First, the packet collecting unit 410 collects IP packets transmitted from the terminals 100a to 100n to the server 500, and transmits the IP packets to the terminal identifying unit 420.

At this time, the uplink HTTP packet transmitted from the terminals 100a to 100n to the server 500 includes a user-agent field of the terminals 100a to 100n.

Here, the user agent field includes an operating system (OS) version, a browser type and version included in the user's traffic, a version of a web library used in the browser, and the like .

Generally, an HTTP packet includes an ETH (Ethernet Header), an IPH (Internet Protocol Header), a TCPH (Transmission Control Protocol Header), an HTTPH (HTTP Header), and an HTTP Body. Here, the User-agent field is included in HTTPH.

This user agent field is structured as shown in Table 1.

The user-agent field operating system Windows NT 5.1 Windows XP Windows NT 6.1 Windows 7 Windows NT 10 Windows 10 Linux-gnu LInux iPhone OS 9_3_2 iOS

Referring to Table 1, it can be seen that the operating system differs according to the field value of the user agent field.

Accordingly, the single-shot identification unit 420 extracts the user agent field from the collected upstream HTTP packets transmitted from the terminals 100a to 100n to the server 500, and then, based on the field values of the extracted user agent fields After identifying the operating system, the operating system is used to identify the type of the terminals 100a to 100n.

For example, if the field value of the extracted user agent field is iPhone OS 9_3_2, the terminal identification unit 420 identifies the type of the terminal to the iPhone, and if the field value of the extracted user agent field is Android 5.1.1, To identify the type of terminal.

Alternatively, if the field value of the user agent field is Linux_gnu, the terminal identification unit 420 identifies the type of terminal with a Linux-based computer.

In addition, if the field value of the user agent field is Window NT 5.1, Windows NT 6.1, or Windows NT 10, the terminal identification unit 420 identifies the terminal type with a window-based computer.

Here, iPhone OS 9_3_2 and Android 5.1.1 are examples of mobile operating systems, Linux-gnu is an example of an operating system for Linux-based computers, Window NT 5.1, Windows NT 6.1 or Windows NT 10 is a Windows- For example. The operating system for Linux-based computers and the operating system for Windows-based computers can be collectively referred to as operating systems for computers.

In this regard, as shown in FIGS. 4 (a) and 4 (b), the operating system type (for example, windows 7 and windows XP) used in the computer is recorded in the user agent field.

Similarly, in the case of mobile, as shown in FIG. 5 (a) and FIG. 5 (b), an operating system type (for example, android, iPhone) used in a mobile is recorded in a header file.

On the other hand, the above-described identification of the terminal type using the HTTP packet is possible only when the terminals 100a to 100n are connected to the server 500 by driving the browser. This is because the user agent is only included in HTTP packets.

Alternatively, when the terminals 100a to 100n communicate with each other through a network without operating the browser, the terminal identification unit 420 determines the duration of the IP header (TTL: Time To Live) and the window scale factor of the TCP header (WSCALE: Window SCALing factor) can be used to identify the type of terminal. The TCP / IP data packet transmitted from the terminals 100a to 100n is appended to the application header required for the user data in the application layer, and the TCP header in the transmission layer is added to the TCP / An IP header is added in the network layer, and an Ethernet header is added in the data link layer.

6, the IP header includes a version field indicating the version of the IP, a header length field indicating the start of the user data, a total length, an identification, A fragment field, a fragment offset field, a time to live (TTL) field, a protocol field, a header checksum field indicating a field, a service type and a level, and a receiving and transmitting IP address .

The retention period (TTL) located in the IP header is a value for determining the validity of a packet. A packet whose value reaches 0 is no longer transmitted through the network.

This value has the same meaning as the hop count. That is, each time the packet passes through the network equipment that provides the forwarding function at the IP layer such as the router 300 or the network address translation device 200,

In addition, the maintenance period can have an initial value of up to 255, different initial values are set for different operating systems, and below (Table 2) shows such differences.

operating system TTL Windows XP 128 Windows 7 128 Windows 10 128 Linux 64 iOS 64 Android 64

Referring to Table 2, an initial value of a maintenance period is determined according to an operating system, and a value between a window operating system and another operating system (including Linux, iOS, and Android) Since the interval of the maintenance period has almost reached twice, the terminal identification unit 420 extracts the maintenance period and if it is larger than 64, the operating system can determine that the OS is the Windows operating system, It can be determined to be the terminal.

At this time, if the extracted maintenance period is equal to or smaller than 64, the terminal identification unit 420 can identify the terminal based on Linux, iOS, and Android. In order to distinguish the Linux terminal from the mobile terminal, The identification unit 420 may use the window scale factor.

7, the TCP header includes a source port field, a destination port field, a sequence number field, a response number field, An Acknowledgment Number field, a data offset field, a Reserved field, a control flag field, a window size field, a Checksum field, an Urgent Pointer field, an Options field, a padding field, The window includes a Window Scaling Factor as shown in FIG. 8 in the Options field.

The control flag field indicates a set of flag bits for controlling the TCP, and includes a flag bit indicating that the packet is a SYN packet and a flag bit indicating that the packet is an ACK packet.

The window scaling factor (WSCALE) is a value included in the option field of the TCP header, and sets the window size of the receiving RX buffer.

This value is included in the TCP SYN packet and is sent to the other machine. The window of the RX buffer moves by the size of the exponent value, waiting for the next TCP packet of the session.

The window scale factor values have different values depending on the operating system, as shown in Table 3.

operating system Window scale factor Windows XP none Windows 7 2 Windows 10 8 Linux 7 iOS 5 Android 6

Referring to Table 3, 7 is used for Linux and 6 is used for iOS and Android.

Accordingly, the terminal identification unit 420 determines whether the window scale factor is greater than 6. If the window duration factor is greater than 6, the terminal identification unit 420 determines that the terminal is a computer terminal having a Linux operating system. If the window scale factor is not greater than 6, Of the mobile terminal.

On the other hand, the address translation identification unit 430 determines whether the network address translation apparatus 200 is used by decreasing the maintenance period of the IP header.

That is, the retention period is decremented by 1 each time the packet passes through the network equipment providing the forwarding function at the IP layer such as the router 300 or the network address translation apparatus 200. [

Therefore, in the case of a packet that has passed through the network address translation apparatus 200, the packet has a smaller sustain period than that of the packet.

Accordingly, the address translation identification unit 430 directly collects packets that have passed through the edge router R1 closest to the terminals 100a to 100n, so that the sustain period is always reduced by one or more.

At this time, since the address translation identification unit 430 has a smaller value than the one-time maintenance period when the packet is passed through the network address translation apparatus 200, the address translation identification unit 430 receives the terminal type identified by the terminal identification unit 420, Is smaller than 127 in case of Linux, IOS, and Android, and it is discriminated whether or not it has passed through the network address translation device 200. [

Since the terminals 100a to 100f pass through the network address translation device 200, the terminals 100a to 100f have a value smaller than the decremented maintenance period, and are smaller than 127 in the case of Windows, 63 in the case of Linux, The address conversion identification unit 430 can identify that the network address translation apparatus 200 has passed the network address translation apparatus 200 based on the small value.

On the contrary, since the terminals 100g to 100n do not pass through the network address translation device 200, they have the same maintenance period of 1, 127 for the window, 63 for the Linux and IOS, and 63 for the Android, The address translation identifying unit 430 can identify that the network address translating apparatus 200 has not been passed.

FIG. 9 is a detailed configuration diagram of the terminal information identifying apparatus of FIG. 3. FIG.

3 includes a user agent extractor 421, a sustain period extractor 422, a window scale extractor 423, and a terminal identifier 424, and the address The conversion identification unit 430 includes a terminal type receiver 431 and an address translation identifier 432.

 The packet collecting unit 410 collects IP packets transmitted from the terminals 100a to 100n to the server 500 and transmits the HTTP packets to the user agent extractor 421 of the terminal identifying unit 420. [

The user agent extractor 421 extracts a user agent field included in the upstream HTTP packet transmitted from the terminals 100a to 100n to the server 500 and obtains the field value.

Here, the user agent field includes an operating system (OS) version, a browser type and version included in the user's traffic, a version of a web library used in the browser, and the like .

When the user agent extractor 421 extracts the user agent field from the collected upstream HTTP packets transmitted from the terminals 100a to 100n to the server 500, the terminal identifier 424 extracts the extracted user agent fields And identifies the types of terminals 100a to 100n based on the field values of the terminals 100a to 100n.

For example, if the field value of the extracted user agent field is iPhone OS 9_3_2, the terminal identifier 424 identifies the type of the terminal to the iPhone, and if it is Android 5.1.1, Identifies the type of terminal.

Alternatively, if the field value of the user agent field is Linux_gnu, the terminal identifier 424 identifies the type of the terminal to a Linux-based computer.

In addition, if the field value of the user agent field is Window NT 5.1, Windows NT 6.1, or Windows NT 10, the terminal identifier 424 identifies the type of terminal with a window-based computer.

Meanwhile, when the collected IP packet is not an HTTP packet, the packet collecting unit 410 transmits the collected packet to the retention period extractor 422.

Then, the retention period extractor 422 extracts the TTL (Time To Live) of the IP header and provides it to the terminal identifier 424.

Depending on the operating system, the initial value of the retention period is set, and the interval between the windows operating system and other operating systems (including Linux, iOS, and Android) is almost twice as long The terminal identifier 424 can determine that the operating system is a Windows operating system if the extracted maintenance period is greater than 64, and accordingly the terminal can be determined as a computer terminal based on the Windows operating system.

At this time, if the extracted retention period is equal to or smaller than 64, the terminal identifier 424 can identify the terminal based on Linux, iOS, and Android, but can not know the terminal type more specifically.

Accordingly, the window scale extractor 4230 extracts the window scale factor in the option field of the TCP header and provides it to the terminal identifier 424.

Accordingly, the terminal identifier 424 determines whether the window scale factor is greater than 6. If the window duration factor is greater than 6, the terminal identifier 424 determines that the terminal is a computer terminal having a Linux operating system. If the window scale factor is not greater than 6, It is judged as a mobile terminal.

Meanwhile, the terminal type receiver 431 of the address translation identification unit 430 receives the terminal type transmitted from the terminal identifier 424 of the terminal identification unit 420.

Since the address conversion identifier 432 has a smaller value than the one-time maintenance period when the packet passes through the network address translation apparatus 200, the address translation identifier 432 receives the terminal type identified by the terminal identifier 424, Is smaller than 127 in the case of Linux or IOS and Android in the case of Android, it is discriminated whether or not it has passed through the network address translation device 200. [

Since the terminals 100a to 100f pass through the network address translation device 200, the terminals 100a to 100f have a value smaller than the decremented maintenance period, and are smaller than 127 in the case of Windows, 63 in the case of Linux, The address translation identifier 432 can be identified as having passed through the network address translator 200 based on the small value.

On the contrary, since the terminals 100g to 100n do not pass through the network address translation device 200, they have the same maintenance period of 1, 127 for the window, 63 for the Linux and IOS, and 63 for the Android, Based on this, the address translation identifier 432 can identify that the network address translation apparatus 200 has not been passed.

10 is a flowchart illustrating a method of identifying a UE according to an exemplary embodiment of the present invention.

Referring to FIG. 10, in a terminal information identification method according to an embodiment of the present invention, a packet collector collects IP packets transmitted from a terminal to a server (S100).

Then, the packet collecting unit identifies the HTTP packet through header analysis of the collected IP packet (S102).

If the IP packet collected as the result of the identification by the packet collecting unit is an HTTP packet, the terminal identifying unit extracts and analyzes the field value of the user agent field in the HTTP packet (S104).

If the operating system version corresponding to the field value of the user agent field is iOS and Android, the terminal identification unit classifies the terminal into a mobile terminal such as a smart phone or a smart pad at step S120.

Otherwise, if the operating system version according to the field value of the user agent field is Linux (S108), the terminal identification unit classifies the terminal as a Linux-based computer terminal (S122).

If the operating system version corresponding to the field value of the user agent field is a window (S110), the terminal identification unit classifies the terminal into a window-based computer terminal (S124) (S112).

However, since the user agent field is included only in the HTTP packet, the terminal identification unit can not detect the ordinary TCP packet that does not access the web. Therefore, if the packet is not an HTTP packet, the terminal type is identified by checking the duration and the window scale factor.

To do this, the packet collector extracts the retention period through IP header analysis of the IP packet (especially through header analysis of the TCP SYN packet) (S114).

As described above, the window sequence uses 128 as the initial value of the sustain period, and accordingly, the terminal identification unit identifies the terminal that transmitted the packet as a computer terminal using the window if the sustain period is greater than 64 and less than or equal to 128 (S116) (S124).

On the other hand, the terminal identification part extracts the window scale factor from the TCP header to identify them because Linux, IOS, and Android are all included when the maintenance period is 64 or less. If the window scale factor is greater than 6 (S116), it corresponds to a computer using Linux (S122) because the window scale factor is 7, iOS is 5, and Android is 6 ), And when it is 6 or less, it is identified as a mobile terminal because it is iOS and Android (S120).

The terminal thus identified can determine whether to use the network address translation apparatus according to the degree of decrease in the maintenance period of each terminal.

As described above, the sustain period has a characteristic of decrementing by 1 every time it passes through the router or the network address translator.

Therefore, the packet passing through the network address translation device has a shorter maintenance period than that of the packet not including the packet.

Therefore, the present invention directly collects packets passing through the edge router closest to the terminal, thereby reducing the maintenance period by one every time.

Accordingly, the address translation identification unit is smaller than 127 in the case of the window (S126) because it has a smaller value than the reduced maintenance period if passed through the network address translation apparatus, and is smaller than 63 in the case of Linux, IOS and Android (S128), and identifies whether the network address translator has passed (S130, S132).

According to the present invention, a type of a terminal is identified through a complex comparison of a retention period (TTL), a window scale factor (WSCALE), and a user agent value included in a general packet, Identify whether or not to use a conversion device. This is easy to implement because the complexity is low compared to the existing linearity method, and the execution overhead can also be reduced.

In addition, the present invention can be utilized not only as to whether or not to use the network address translation apparatus, but also as a basic data for providing service for each terminal by identifying the terminal type.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments of the present invention are not intended to limit the scope of the present invention but to limit the scope of the present invention. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents thereof should be construed as being included in the scope of the present invention.

100a to 100n: terminal 200: network address translation device
300: router 400: terminal information identification system
410: Packet collecting unit 420:
421: User agent extractor 422: Retention period extractor
423: window scale extractor 424: terminal identifier
430: address conversion identification unit 431: terminal type receiver
432: address translation identifier 500: server

Claims (21)

A packet collecting unit for collecting IP packets transmitted from the terminal;
A terminal identification unit for identifying the terminal type using the operating system information and the holding time included in the IP packet collected by the packet collector; And
And an address conversion identification unit for determining whether to use the network address translation apparatus by reducing the maintenance period of the IP packet collected by the packet collector,
The address translation identification unit
A terminal type receiver for receiving a terminal type from the terminal identification unit; And
If the terminal type received by the terminal type receiver is a Windows-based computer terminal, it is determined that the use of the network address translation device is enabled if the IP header of the IP packet has a shorter maintenance period than a value obtained by decrementing the first retention period reference value by one. Based on a value of the second maintenance period reference value, the IP address of the mobile terminal is determined to be the use of the network address translation apparatus if the IP header of the IP packet has a shorter maintenance period than a value obtained by subtracting 1 from the value of the second sustain period reference value, Information identification system. The method according to claim 1,
Wherein the terminal identification unit identifies the operating system information of the user agent field as a computer terminal if the IP packet is an HTTP packet, and identifies the mobile terminal as a mobile terminal if the operating system is a mobile operating system. The method according to claim 1,
Wherein the terminal identification unit identifies the IP header as a window-based computer terminal if the IP header holding time is greater than the first holding time reference value when the IP packet is not an HTTP packet. The method according to claim 3,
If the IP packet is not an HTTP packet and the retention time of the IP header is equal to or smaller than the first retention time reference value, the terminal identification unit uses the window scale factor included in the TCP header of the IP packet to determine the terminal information Identification system. A packet collecting unit for collecting IP packets transmitted from the terminal; And
And a terminal identification unit for identifying the terminal type using the operating system information and the holding time included in the IP packet collected by the packet collector,
The terminal identification unit identifies the IP header as a window-based computer terminal if the IP header holding time is greater than the first holding time reference value when the IP packet is not an HTTP packet,
The terminal identification unit identifies the terminal type using the window scale factor included in the TCP header of the IP packet if the IP header holding time is equal to or smaller than the first retention time reference value when the IP packet is not an HTTP packet,
Wherein the terminal identification unit identifies the terminal as a Linux based computer terminal if the window scale factor is greater than the first window scale reference value and identifies the terminal as a mobile terminal if the window scale factor is not greater than the first window scale reference value. The method according to claim 1,
The terminal identification unit
A user agent extractor for extracting a field value from the user agent field when the IP packet is an HTTP packet;
A retention time extractor for extracting retention time from the IP header when the IP packet is not an HTTP packet; And
And a terminal identifier that identifies the terminal type using the operating system and the retention time extracted by the retention time extractor according to the field value of the user agent field extracted by the user agent extractor. The method of claim 6,
The terminal identification unit
And a window scale extractor for extracting a window scale factor included in the TCP header when the IP packet is not an HTTP packet,
The terminal identifier identifies the terminal as a window-based computer terminal if the hold time is greater than the first hold time reference value, and if the hold time is less than or equal to the first hold time reference value, . The method of claim 5,
Further comprising an address conversion identification unit for determining whether the network address translation apparatus is used by decreasing the maintenance period of the IP packet collected by the packet collector. delete delete delete delete (A) collecting IP packets by a packet collector;
(B) identifying a terminal type using an operating system information when an IP packet collected by the packet collector is an HTTP packet;
(C) identifying a terminal type using a retention time if the IP packet collected by the packet collector is not an HTTP packet; And
(E) determining whether the network address translation apparatus is used by decreasing the maintenance period of the IP packet collected by the address translation identification adder packet collector,
In the step (E), if the duration of the IP header of the IP packet is smaller than the value obtained by decrementing the first retention period reference value in the case where the terminal type is a window-based computer terminal, And determines that the use of the network address translation apparatus is determined if the maintenance period of the IP header of the IP packet is smaller than a value obtained by subtracting 1 from the second sustain period reference value in the case where the terminal type is a Linux- Way. The method of claim 13,
The step (B)
(B-1) the terminal identification unit extracts a field value of the user agent field when the IP packet is an HTTP packet;
(B-2) if the operating system information of the extracted user agent field is an operating system for a window-based computer, the terminal identifying unit identifies the operating system information as a window-based computer terminal;
(B-3) The terminal identification unit identifies a Linux-based computer terminal if the operating system information of the extracted user agent field is an operating system for a Linux-based computer; And
(B-4) The terminal identification unit identifies the mobile terminal if the operating system information of the extracted user agent field is a mobile operating system. The method of claim 13,
Wherein the step (C) identifies the terminal identifier as a window-based computer terminal if the IP header of the IP packet has a retention time greater than a first retention time reference value. The method of claim 13,
(D) The terminal identification unit identifies the terminal type using the window scale factor if the IP header of the IP packet has a retention time that is equal to or smaller than a first retention time reference value. (A) collecting IP packets by a packet collector;
(B) identifying a terminal type using an operating system information when an IP packet collected by the packet collector is an HTTP packet;
(C) identifying a terminal type using a retention time if the IP packet collected by the packet collector is not an HTTP packet; And
(D) The terminal identification unit identifies the terminal type using the window scale factor if the IP header of the IP packet has a retention time equal to or smaller than a first retention time reference value,
The step (D)
(D-1) if the window scale factor is greater than the first window scale reference value, identifying the terminal as a Linux-based computer terminal; And
(D-2) The terminal identification unit identifies the mobile terminal if the window scale factor is not greater than the first window scale reference value. The method of claim 17,
(E) determining whether to use the network address translation apparatus by decreasing the maintenance period of the IP packet collected by the address translation identification adder packet collector. delete delete delete

Images