KR20150135168A - Method of detecting a plurality of terminals using a type of a browser and apparatus thererof - Google Patents

Abstract

Disclosed are a method and an apparatus for detecting a sharing terminal by using a type of a browser. The apparatus for detecting a sharing terminal analyzes Internet access traffic to identify a type of an Internet access browser and cookie information provided to a terminal by a server which the terminal is to access, if receiving the internet access traffic of the terminal, and then detects whether the terminal is the sharing terminal based on the number of cookie information different from each other by type of the Internet access browser and has been identified for a certain period of time.

Description

TECHNICAL FIELD [0001] The present invention relates to a method and apparatus for detecting a shared terminal using a browser type,

The present invention relates to a method and apparatus for detecting a terminal sharing one public Internet address, and more particularly, to a method and apparatus for detecting a shared terminal using the kind of browser used by the terminal for Internet access .

In the Internet, each terminal is assigned a unique IP (Internet Protocol) address, and performs communication with each other using the IP address. However, it is impossible to identify each terminal using the IP address when one public IP address is shared by a plurality of terminals using an Internet router.

As a conventional method for solving this problem, a program for obtaining a private IP of each terminal in a private network is planted in each terminal or unique information for identifying each terminal is planted in a terminal using a cookie or a flash shared object There is a way.

However, in order to acquire the private IP, there is a problem that a separate program must be installed in the terminal and the terminal can not be identified if each user does not install it. In order to plant the unique information in the cookie of the terminal, There is an inconvenience that the access traffic must be intercepted in the middle and redirected to the third server.

Patent Registration No. 1002421 Patent Publication No. 2009-0041752 Patent Publication No. 2007-0006478

SUMMARY OF THE INVENTION The present invention has been made in view of the above problems, and it is an object of the present invention to provide a method and apparatus for identifying a terminal, And a method and apparatus for detecting terminals sharing an Internet address.

According to another aspect of the present invention, there is provided a method of detecting a shared terminal, the method comprising: receiving Internet access traffic of a terminal; Analyzing the Internet access traffic and determining a type of an Internet access browser and cookie information provided to the terminal from a server to which the terminal is to access; And detecting the presence or absence of a shared terminal based on the number of different cookie information for each type of Internet access browser that has been detected for a predetermined period of time.

According to another aspect of the present invention, there is provided a shared terminal detection apparatus comprising: a receiver for receiving Internet access traffic; Analyzing the Internet access traffic and analyzing the type of the Internet access browser and the identification information stored in the local storage of the terminal at the destination server of the Internet access traffic; A storage unit for storing the type and identification information of the Internet access browser identified by the packet analyzing unit for each source address of the Internet access traffic; And a detector for detecting whether or not the terminal is a shared terminal based on the number of different identification information for each type of Internet access browser detected during a predetermined period.

According to the present invention, the shared terminal detection apparatus does not need to embed additional unique information for terminal identification in the terminal's cookie. There is no need to redirect the Internet access traffic of the terminal and thus does not affect the Internet access of the terminal at all.

1 is a diagram illustrating a schematic structure of an overall system for detecting a shared terminal using a browser type according to the present invention;
FIG. 2 is a diagram illustrating a configuration of a shared terminal detection apparatus using a browser type according to an embodiment of the present invention.
3 is a flowchart illustrating a method of detecting a shared terminal using a browser type according to an exemplary embodiment of the present invention.
4 is a diagram illustrating an example of Internet access traffic according to the present invention,
5 is a diagram illustrating an example of a result of detecting a shared terminal using a browser type according to the present invention.

Hereinafter, a method and apparatus for detecting a shared terminal using a browser type according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing a schematic structure of an overall system for detecting a shared terminal using a browser type according to the present invention.

Referring to FIG. 1, a plurality of terminals 102, 104, and 106 share a public Internet address (public IP address) using a router 108. The plurality of terminals 102, 104 and 106 use a private Internet address (private IP address) in the private network 100 and a public Internet address when accessing the external server 140 through the Internet 130. Therefore, it is impossible to determine whether a plurality of terminals exist only on the public Internet address outside the private network 100.

Here, the terminals 102, 104, and 106 are all kinds of devices that can be connected to the Internet through a wired / wireless communication network. For example, the terminal may be a computer, a tablet PC, a smart phone, an object of a home network or a matter network.

The terminals 102, 104, and 106 access the Internet 130 using an Internet access browser. For example, the terminals 102, 104, and 106 access the Internet using any one of various browsers such as Internet Explorer (IE), Chrome, Safari, and FireFox. A plurality of different types of browsers may exist in the terminals 102, 104, and 106, but different versions of the same type of browsers can not exist at the same time. In other words, version 8.0 and version 9.0 of Internet Explorer can not coexist on the terminal simultaneously.

The server 140 is a device for providing various services or information to the terminals 102, 104, and 106 via the Internet, and has a host name and an Internet address. The host name is a combination of letters, numbers, and so on that represents the server, for example, www.google.com. In this embodiment, the host name is defined to include both the case of including "www" and the case of not including "www" according to the embodiment. The server 140 may have a plurality of host names and a plurality of Internet addresses.

When the terminal (102, 104, 106) accesses the terminal (102, 104, 106) using a specific browser, the server (140) stores the identification information in the local storage of the terminal accessible by the browser when the identification information given to the terminal does not exist. For example, when the server 140 is an online shopping mall, the server 140 may store the information of the products accessed by the terminals 102, 104 and 106 together with the identification information in the local storage of the terminal. One example of a local store is a cookie or FlashShared object. In particular, the server 140 provides different identification information to each terminal according to the type of the browser to which the terminal is connected.

The shared terminal detection device 120 is a device that detects a shared terminal using a browser type. The mirroring device 110 is located between the private network 100 and the Internet 130 and transmits traffic transmitted between the private network 100 and the Internet 130 to the shared terminal detection device 120.

Although the shared terminal detection device 120 and the server 140 are shown as separate components for convenience of description, the configuration of the shared terminal detection device 120 may be implemented in the server 140. [ In addition, the shared terminal detection apparatus 120 can be implemented in the position of the mirroring apparatus 110, and the implementation position can be variously changed according to the embodiment.

2 is a diagram showing a configuration of an embodiment of a shared terminal detection apparatus using a browser type according to the present invention.

2, the shared terminal detection apparatus 120 includes a receiving unit 200, a packet analyzing unit 210, a storage unit 220, and a detecting unit 230.

The receiving unit 200 receives the traffic transmitted from the terminal in the private network to the server. In the example of FIG. 1, the receiving unit 200 receives the mirrored traffic by the mirroring device 110.

The packet analyzing unit 210 analyzes the received traffic to determine the type of browser used by the terminal for Internet access and the identification information provided to the terminal from the server to which the terminal desires to connect. For example, the packet analyzing unit 210 analyzes a Hypertext Transfer Protocol (HTTP) packet received by the receiving unit 200, and grasps the browser type and identification information stored in the terminal environment information in the HTTP packet. An example of an HTTP packet is shown in Table 1.

The packet analyzer 210 may analyze all the traffic, but may analyze only predetermined traffic to reduce the load on the apparatus. For example, the packet analyzer 210 stores at least one host name in advance, and if the host name of the destination server of the traffic, that is, the host name of the server to which the terminal desires to access does not exist in the pre- Discard the traffic and do not perform any further processing.

For example, after storing the host name of "Naver (www.naver.com) ", when the Internet access traffic of the terminal is the access traffic to the" If not, discard the traffic and do not perform any further processing.

The storage unit 220 stores and manages the browser type and identification information acquired by the packet analysis unit 210 together with the source address of the traffic. Here, the source address means the authorized Internet address of the terminal that transmitted the traffic. Therefore, in the case of FIG. 1, when the packet analyzing unit 210 analyzes the traffic of the plurality of terminals 102, 104, and 106 and grasps the origination address, all the origination addresses are the same as the public Internet address.

The detecting unit 230 detects whether or not the terminal is a shared terminal based on the number of different pieces of identification information for each browser type detected during a predetermined period. For example, with respect to a specific authorized Internet address, if the types of browsers that the packet analysis unit 230 grasps are Internet Explorer and Chrome, there are two different pieces of identification information for the Internet Explorer, If there is one identification information, the detection unit 230 determines that the number of shared terminals is two.

Considering that the cookie may be arbitrarily deleted by the user, the detector 230 may repeatedly perform the sharing terminal in a short period. For example, the detection unit 230 performs a detection process for one hour, resets the stored data after one hour, and then performs the detection process again.

3 is a flowchart illustrating a method of detecting a shared terminal using a browser type according to an exemplary embodiment of the present invention.

Referring to FIG. 3, when a terminal in the private network 100 sharing a public Internet address transmits a request traffic for accessing the server 140 (S300), the mirroring apparatus 110 mirrors the traffic to detect a shared terminal To the device 120 (S305, S310).

The shared terminal detection apparatus 120 determines whether the mirrored traffic is a detection target traffic (S315). For example, the shared terminal detection device 120 stores the host names of the top five portal sites with the largest number of user connections, and the host names of the servers to which the terminal desires to access are stored in the top five portal sites If the host name is found, the next detection step is performed. If not, the traffic is discarded and no further processing is performed (S320).

If the traffic is the detection target traffic (S315), the shared terminal detection apparatus 120 analyzes the traffic and identifies the type of the browser used by the terminal for Internet access and the identification information previously stored in the terminal by the server the terminal desires to access (S325).

The shared terminal detection device 120 stores and manages the identified browser type and the identification information based on the source address of the traffic (that is, the same public Internet address in the case of a shared terminal) (S330). The shared terminal detection apparatus 120 detects the number of different identification information for each browser type and detects whether or not the terminal is a shared terminal by using the type of browser and identification information stored for the public Internet address (S335).

If it is detected as a shared terminal, the shared terminal detection device 120 transmits necessary guidance information such as warning about the sharing to the terminal (S340), or may block the terminal's Internet connection (S345).

4 is a diagram illustrating an example of Internet access traffic according to the present invention.

4, the traffic 400 includes a host name 410, a user agent 420, and a cookie 430. [ The host name 410 indicates the host name of the destination server of the traffic, the user agent 420 indicates the environment information of the terminal such as the type of the browser and the version information used for the Internet connection, and the cookie 430 indicates the destination server Indicates identification information previously stored in the terminal.

For example, Table 1 shows an example of the Internet access traffic transmitted when the terminal accesses the "Naver (www.naver.com) ", which is a kind of portal site, using chrome.

Hypertext Transfer Protocol
Get / Http / 1.1 \ r \ n
Host: www.naver.com\r\n
Connection: Keep-alive \ r \ n
Cache-control: max-age = 0 \ r \ n
Accept: Text / html.application / xml + xml.application / xml; q = 0.9.image / webp, * / * = 0.8 \ r \ n
User-Agent: Mozilla / 5.0 (Windows NT 6.3; WOW64) Applewebkit / 537.36 (KHTML, like Gecko) Chrome / 34.0.1847.116 Safari / 537.36 \ r \ n
Accept-Encoding: gzip, deflate, sdch \ r \ n
Accept-Language: ko-kr, ko; q = 0.8, en-us; q = 0.6, en; q =
Cookie: NNB = 2FZDCFOTEBHFG; page_uid = k6wkkwpyLP1ssc7z4k8ssssssgG-139343; nrefreshx = 0 \ r \ n

Referring to Table 1, in the "User-Agent", it is indicated that the browser used for accessing the Internet by the terminal is chrome, and the identification information "NNB = 2FZDCFOTEBHFG" "

5 is a diagram illustrating an example of a result of detecting a shared terminal using a browser type according to the present invention.

Referring to FIG. 5, in the case where the subscriber identification information is "A ", the shared terminal detection apparatus detects two browser types of Internet Explorer and chrome, and two different cookie information exist in the Internet Explorer. In this case, the shared terminal detection apparatus judges the number of the minimum shared terminals to be two.

For example, a detection process in a case where there are seven terminals sharing a public Internet address and each of the terminals has a browser as shown in Table 2 below will be described.

browser Terminal 1 IE8, Chrome Terminal 2 IE8, Opera, Safari Terminal 3 IE10, Chrome, FireFox Terminal 4 IE11, Chrome

When the detection process is performed in units of one hour, the Internet access status by time is as follows.

Internet access by time zone The result of detection by the shared terminal detection device 13:00 to 14:00
Terminal 1: Connect using IE8
Terminal 2: Connect using IE9 and Opera, respectively Browser Type = IE8, Cookie Value = a
Browser type = IE9, Cookie value = b
Browser type = Opera, Cookie value = c 14:00 to 15:00
Terminal 2: Connect using IE9 and Safari, respectively
Terminal 3: IE10 and Chrome respectively
Terminal 4: IE11, Chorme Browser type = IE9, Cookie value = d
Browser Type = Safari, Cookie Value = e
Browser type = IE10, cookie value = f
Browser Type = Chrome, Cookie Value = g
Browser Type = IE11, Cookie Value = h
Browser Type = Chrome, Cookie Value = i 15:00 to 16:00
Terminal 1: Connect using IE8
Terminal 3: Connect using FireFox Browser Type = IE8, Cookie Value = a
Browser type = FireFox, Cookie value = j

Table 3 shows the number of the minimum number of shared terminals in each time slot when an Internet connection situation as shown in Table 3 occurs.

Minimum number of shared terminals 13:00 to 14:00 Use two Internet Explorer
Use one opera 14:00 to 15:00 Use 4 Internet Explorer
Use one safari
Use two crawls 15:00 to 16:00 Use one Internet Explorer
Use one Firefox

Therefore, the shared terminal detection apparatus recognizes the number of the minimum shared terminals between the hours of 13:00 and 14:00 and the number of the shared terminals of 14 to 15:00.

The present invention can also be embodied as computer-readable codes on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like. The computer-readable recording medium may also be distributed over a networked computer system so that computer readable code can be stored and executed in a distributed manner.

The present invention has been described with reference to the preferred embodiments. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

Claims (15)

Receiving Internet access traffic of a terminal;
Analyzing the Internet access traffic and determining a type of an Internet access browser and cookie information provided to the terminal from a server to which the terminal is to access; And
Detecting whether or not the shared terminal is based on the number of different cookie information for each type of Internet access browser detected during a predetermined period of time. 2. The method of claim 1,
And mirroring and receiving Internet access traffic transmitted to the server. 3. The method according to claim 1 or 2,
Comparing the host name of the destination server of the Internet access traffic with the pre-stored host name; And
And discarding the Internet access traffic if the host name of the destination server is different from the pre-stored host name. 2. The method of claim 1,
And receiving Internet access traffic from a terminal that wants to access the Internet using any one of a plurality of Internet access browsers of different types. The method according to claim 1,
Wherein the terminal is a terminal sharing a public Internet address. The method according to claim 1,
Wherein the Internet access traffic is an HTTP packet,
Wherein the step of grasping grasps the type of the Internet access browser using the user agent in the HTTP packet. 2. The method of claim 1,
Determining a source address of the Internet access traffic; And
And detecting the presence or absence of the shared terminal by counting the number of different cookie information for each type of Internet access browser with respect to the source address. A receiving unit for receiving Internet access traffic;
Analyzing the Internet access traffic and analyzing the type of the Internet access browser and the identification information stored in the local storage of the terminal at the destination server of the Internet access traffic;
A storage unit for storing the type and identification information of the Internet access browser identified by the packet analyzing unit for each source address of the Internet access traffic; And
And a detector for detecting whether or not the terminal is a shared terminal based on the number of different identification information for each type of Internet access browser detected during a predetermined period of time. 9. The method of claim 8,
And a mirroring unit for mirroring Internet access traffic transmitted from a terminal sharing a public Internet address to a destination server,
Wherein the receiving unit receives the internet access traffic mirrored by the mirroring unit. The packet analyzing apparatus according to claim 8,
And discards the Internet access traffic if the host name of the destination server of the Internet access traffic does not exist in the pre-stored host name. 9. The apparatus of claim 8,
And receives Internet access traffic from a terminal that wants to access the Internet using any one of a plurality of Internet access browsers of different types. 9. The method of claim 8,
Wherein the terminal is a terminal sharing a public Internet address. 9. The method of claim 8,
Wherein the Internet access traffic is an HTTP packet,
Wherein the packet analyzing unit identifies the type of the Internet access browser using the user agent in the HTTP packet. 9. The apparatus according to claim 8,
Wherein the shared terminal detection unit detects the number of shared terminals by counting the number of different cookie information for each type of Internet access browser for the source address of the Internet access traffic. A computer-readable recording medium storing a program for performing the method according to any one of claims 1 to 7.

Images