KR20230070951A - Apparatus for collecting event and method thereof - Google Patents

Abstract

An event collection device and method are disclosed. According to the present disclosure, an event collection device identifies a plurality of packets transmitted between a first terminal and a second terminal, compares detailed information of each of the plurality of packets, and determines whether the plurality of packets satisfy a predetermined relationship condition with each other. It determines whether or not the packets meet the relationship conditions, classifies packets that meet the relationship conditions into the same group, and collects each of the classified groups as an event corresponding to an individual session.

Description

Event collection device and method {APPARATUS FOR COLLECTING EVENT AND METHOD THEREOF}

The present disclosure relates to a technology for collecting events, and more specifically, to a technology for collecting I/O events based on User Datagram Protocol (UDP) in units of sessions based on a Quick UDP Internet Connections (QUIC) protocol. .

In a transport layer that provides a communication service between a sender and a receiver, TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are used as representative protocols for data transmission.

TCP is a protocol that supports a connection-type service and provides a virtual circuit method, and has a disadvantage in that it has a low speed compared to UDP while having high reliability. On the other hand, UDP is a protocol that supports connectionless services and provides a datagram method. It has the advantage of faster speed and less network load compared to TCP. should be collected and stored.

However, the Internet standard represented by the HTTP/3 standard uses the QUIC (Quick UDP Internet Connections) protocol as a communication protocol of the transport layer during web browsing. This QUIC protocol uses UDP for data transmission. That is, when data is transmitted based on the QUIC protocol, a lot of I/O will occur, and when event information is collected due to the nature of UDP at this time, a very large overhead occurs in the system.

In addition, if there is too much event information, additional problems may occur, such as consuming a lot of computing resources in analyzing data and generating statistical information based on each piece of information.

The present disclosure has been proposed to solve the above-described problems, and compares detailed information of packets transmitted between different terminals to classify packets satisfying relationship conditions into the same group, and each group corresponds to an individual session. An object of the present invention is to provide a method of collecting as an event and a device using the same.

Specifically, an object of the present disclosure is to provide a method for preventing burden on a system due to excessive information collection according to event occurrence in performing a communication service between a sender and a receiver, and an apparatus using the same.

The technical problem to be achieved by the present disclosure is not limited to the technical problems as described above, and other technical problems may be inferred from the following embodiments.

An event collection method according to an embodiment disclosed herein includes identifying a plurality of packets transmitted between a first terminal and a second terminal; comparing detailed information of each of the plurality of packets to determine whether the plurality of packets satisfy a predetermined relationship condition; classifying packets satisfying the relation condition into the same group; and collecting each of the classified groups as an event corresponding to an individual session.

According to an embodiment, each of the plurality of packets may be transmitted using User Datagram Protocol (UDP) as a transport layer protocol.

According to an embodiment, the determining step may be characterized in that it determines whether the relationship condition is satisfied by comparing a 5-tuple value of each of the plurality of packets with each other of the plurality of packets. there is.

According to an embodiment, the determining step may include a 5-tuple value of a request packet transmitted from the first terminal to the second terminal, and from the second terminal to the first terminal after transmission of the request packet. It may be characterized in that it is determined whether the relationship condition is satisfied by comparing 5-tuple values of each of one or more response packets to be transmitted.

According to an embodiment, the determining may include determining whether protocol identification information included in a 5-tuple value of the request packet and protocol identification information included in a 5-tuple value of each response packet are the same; A source IP and source port included in the 5-tuple value of the request packet and a target IP and target port included in each 5-tuple value of the response packet Determining whether is the same; and determining whether the target IP and port included in the 5-tuple value of the request packet are the same as the source IP and source port included in the 5-tuple value of each response packet.

According to one embodiment, the collecting may be characterized in that each of the classified groups is collected as an event corresponding to a communication session using QUIC (Quick UDP Internet Connections) as a transport layer protocol.

According to an embodiment, the event collection method may further include calculating a status value for a packet included in the event for each of the collected events.

According to an embodiment, the calculating may include a representative value for a request packet transmitted from the first terminal to the second terminal among packets included in the event, and the second terminal after transmission of the request packet. It may be characterized in that a representative value for a response packet transmitted to the first terminal is calculated.

An event collection device according to an embodiment disclosed herein includes one or more processors; Memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are transmitted between a first terminal and a second terminal. instructions for identifying a plurality of packets; a command for comparing detailed information of each of the plurality of packets to determine whether the plurality of packets satisfy a predetermined relationship condition; a command for classifying packets satisfying the relation condition into the same group; and a command for collecting each of the classified groups as an event corresponding to an individual session.

A non-transitory computer readable storage medium according to an embodiment disclosed herein includes a medium configured to store computer readable instructions, and when the computer readable instructions are executed by a processor, the processor: identifying a plurality of packets transmitted between the second terminal; comparing detailed information of each of the plurality of packets to determine whether the plurality of packets satisfy a predetermined relationship condition; classifying packets satisfying the relation condition into the same group; and collecting each of the classified groups as an event corresponding to an individual session.

Details of other embodiments are included in the detailed description and drawings.

According to the present disclosure, by collecting information in abbreviated event units instead of collecting information every time a packet such as an input/output (I/O) event is transmitted, it is possible to increase efficiency of system resources and improve system performance.

In addition, the event collection device according to the present disclosure collects events and calculates state values for packets constituting a session corresponding to an event, thereby reducing ambiguity, uncertainty, and loss of information that may occur as events are abbreviated and collected. concerns, etc., and waste of system resources due to calculating state values by an event collection device and a separate device can be prevented.

Effects of the invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description of the claims.

1 is a schematic configuration diagram for explaining an event collection system according to an embodiment.
2 is a flowchart illustrating an event collection method according to an exemplary embodiment.
3 is an exemplary diagram illustrating a process of collecting events in more detail.
4 is a flowchart illustrating an event collection method according to an additional embodiment.
5 is an exemplary diagram illustrating state values calculated for each event in more detail.
6 is a block diagram illustrating an event collection device according to an exemplary embodiment.

The terms used in the embodiments have been selected as general terms that are currently widely used as much as possible while considering the functions in the present disclosure, but they may vary depending on the intention or precedent of a person skilled in the art, the emergence of new technologies, and the like. In addition, in a specific case, there are also terms arbitrarily selected by the applicant, and in this case, the meaning will be described in detail in the corresponding description. Therefore, terms used in the present disclosure should be defined based on the meaning of the term and the general content of the present disclosure, not simply the name of the term.

When it is said that a certain part "includes" a certain component throughout the specification, it means that it may further include other components without excluding other components unless otherwise stated. In addition, terms such as "..unit" and "..module" described in the specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software. And, unlike the illustrated example, specific operations may not be clearly distinguished.

The expression of "at least one of a, b, and c" described throughout the specification means 'a alone', 'b alone', 'c alone', 'a and b', 'a and c', 'b and c' ', or 'all a, b, and c'.

A “terminal” referred to below may be implemented as a computer or portable terminal capable of accessing a server or other terminals through a network. Here, the computer includes, for example, a laptop, desktop, laptop, etc. equipped with a web browser, and the portable terminal is, for example, a wireless communication device that ensures portability and mobility. , IMT (International Mobile Telecommunication), CDMA (Code Division Multiple Access), W-CDMA (W-Code Division Multiple Access), LTE (Long Term Evolution), etc. It may include a handheld-based wireless communication device.

In the following description, terms such as "transmission", "communication", "transmission", "reception" and other similar meanings of signals or information refer not only to direct transmission of signals or information from one component to another, but also to It also includes passing through other components.

In particular, "transmitting" or "transmitting" a signal or information as a component indicates the final destination of the signal or information, and does not mean a direct destination. The same is true for "reception" of signals or information. Also, in this specification, two or more data or information being “related” means that when one data (or information) is obtained, at least a portion of other data (or information) can be obtained based thereon.

Also, terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms may be used for the purpose of distinguishing one component from another.

For example, a first element may be termed a second element, and similarly, a second element may be termed a first element, without departing from the scope of the present invention.

In describing the embodiments, descriptions of technical contents that are well known in the technical field to which the present invention pertains and are not directly related to the present invention will be omitted. This is to more clearly convey the gist of the present invention without obscuring it by omitting unnecessary description.

For the same reason, in the accompanying drawings, some components are exaggerated, omitted, or schematically illustrated. Also, the size of each component does not entirely reflect the actual size. In each figure, the same reference number is assigned to the same or corresponding component.

Advantages and features of the present invention, and methods for achieving them, will become clear with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only the present embodiments make the disclosure of the present invention complete, and common knowledge in the art to which the present invention belongs It is provided to fully inform the holder of the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numbers designate like elements throughout the specification.

It will be appreciated that each block of process flow diagrams and combinations of flow diagrams may be performed by computer program instructions. These computer program instructions may be embodied in a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment, so that the instructions executed by the processor of the computer or other programmable data processing equipment are described in the flowchart block(s). It creates means to perform functions. These computer program instructions may also be stored in a computer usable or computer readable memory that can be directed to a computer or other programmable data processing equipment to implement functionality in a particular way, such that the computer usable or computer readable memory The instructions stored in are also capable of producing an article of manufacture containing instruction means that perform the functions described in the flowchart block(s). The computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operational steps are performed on the computer or other programmable data processing equipment to create a computer-executed process to generate computer or other programmable data processing equipment. Instructions for performing processing equipment may also provide steps for performing the functions described in the flowchart block(s).

Additionally, each block may represent a module, segment, or portion of code that includes one or more executable instructions for executing specified logical function(s). It should also be noted that in some alternative implementations it is possible for the functions mentioned in the blocks to occur out of order. For example, two blocks shown in succession may in fact be executed substantially concurrently, or the blocks may sometimes be executed in reverse order depending on their function.

Hereinafter, with reference to the accompanying drawings, embodiments of the present disclosure will be described in detail so that those skilled in the art can easily carry out the present disclosure. However, the present disclosure may be implemented in many different forms and is not limited to the embodiments described herein.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings.

1 is a schematic configuration diagram for explaining an event collection system according to an embodiment.

As shown, the event collection system 100 according to an embodiment includes an event collection device 110 , a first terminal 120 and a second terminal 130 . In addition, those of ordinary skill in the art related to the present embodiment may understand that general-purpose components may be further included in addition to the components shown in FIG. 1 .

The event collection device 110, the first terminal 120, and the second terminal 130 may communicate with each other using a wired or wireless network. At this time, the network includes a local area network (LAN), a wide area network (WAN), a value added network (VAN), a mobile radio communication network, a satellite communication network, and combinations thereof It is a data communication network in a comprehensive sense that allows each system component shown in FIG. 1 to communicate smoothly with each other, and may include wired Internet, wireless Internet, and mobile wireless communication network. Wireless communication includes, for example, wireless LAN (Wi-Fi), Bluetooth, Bluetooth low energy (Bluetooth low energy), Zigbee, WFD (Wi-Fi Direct), UWB (ultra wideband), infrared communication (IrDA, Infrared Data Association) ), Near Field Communication (NFC), etc., but is not limited thereto.

The event collection device 110 may identify packets transmitted between the first terminal 120 and the second terminal 130 and collect the identified packets into abbreviated events according to a specific criterion. Through this, the event collection device 110 can drastically reduce the number of collected events compared to collecting information for each event that occurs when each packet is transmitted.

In the present disclosure, collecting an event by the event collecting device 110 may mean collecting information related to the event. According to an embodiment, the information related to the event may include at least some of identification information for specifying the event, information causing the event to occur, and information generated as a result of the event.

Referring to FIG. 1 , the event collection device 110 is shown as a separate device independent of the first terminal 120 and the second terminal 130, but this is exemplary and according to the embodiment, the event collection device 110 ) may be a device included in the first terminal 120 or included in the second terminal 130 .

Meanwhile, according to an embodiment, the first terminal 120 performs the function of a client constituting a client-server model architecture, and the second terminal 130 performs the function of a server under the architecture. can do. However, this is exemplary, and the first terminal 120 may perform the function of a server and the second terminal 130 may perform the function of a client. Also, according to embodiments, the first terminal 120 and the second terminal 130 may each function as devices constituting a peer-to-peer (P2P) architecture.

In relation to the above, it will be described in more detail through the following drawings.

2 is a flowchart illustrating an event collection method according to an exemplary embodiment.

The method shown in FIG. 2 may be performed by, for example, the event collection device 110 described above.

In the illustrated flowchart, the method is divided into a plurality of steps, but at least some of the steps are performed in reverse order, combined with other steps, performed together, omitted, divided into detailed steps, or not shown. One or more steps may be added and performed.

In step S210 , the event collection device 110 may identify a plurality of packets transmitted between the first terminal 120 and the second terminal 130 .

According to an embodiment, each of a plurality of packets identified by the event collection device 110 may be a packet transmitted using User Datagram Protocol (UDP) as a transport layer protocol.

For example, when the first terminal 120, which is a client, requests a file download from the second terminal 130, which is a server, the event collection device 110 transfers data from the first terminal 120 to the second terminal 130. A transmitted file download request packet may be identified, and one or more response packets transmitted from the second terminal 130 to the first terminal 120 as a response to the request packet may be identified. In this case, each response packet may include at least a part of the file requested to be downloaded by the first terminal 120 or may include a message indicating that the download request of the first terminal 120 has failed to be received. It may include a message indicating that the download request of the terminal 120 has been received, but the corresponding file does not exist.

In step S220, the event collection device 110 may compare detailed information of each of the identified plurality of packets to determine whether the plurality of packets satisfy a predetermined relationship condition.

According to an embodiment, the event collecting device 110 may determine whether a predetermined relationship condition is satisfied by comparing a 5-tuple value of each of a plurality of identified packets with each other.

Specifically, the event collection device 110 determines the 5-tuple value of the request packet transmitted from the first terminal 120 to the second terminal 130, and the second terminal 130 after transmitting the request packet. By comparing 5-tuple values of each of one or more response packets transmitted to the terminal 120, it is possible to determine whether a preset relationship condition is satisfied.

In more detail, the relationship condition to be determined by the event collection device 110 may include the following (1) to (3).

(1) Whether the protocol identification information included in the 5-tuple value of the request packet is the same as the protocol identification information included in the 5-tuple value of each response packet

(2) Source IP and source port included in the 5-tuple value of the request packet and target IP and target port included in the 5-tuple value of each response packet ) is the same

(3) Whether the target IP and target port included in the 5-tuple value of the request packet and the source IP and source port included in the 5-tuple value of each response packet are the same

For example, as a result of determining (1), the event collection device 110 has the same protocol identification information included in the 5-tuple value of the request packet and the protocol identification information included in the 5-tuple value of each response packet. In this case, the above-mentioned (2) can be determined. Thereafter, the event collection device 110 determines that the source IP included in the 5-tuple value of the request packet and the target IP included in the 5-tuple value of each response packet are the same, and the source IP included in the 5-tuple value of the request packet. When the port and the target port included in each 5-tuple value of the response packet are the same, the above-described (3) can be determined. Thereafter, the event collection device 110 determines that the target IP included in the 5-tuple value of the request packet and the source IP included in the 5-tuple value of each response packet are the same, and the target IP included in the 5-tuple value of the request packet. When the source port included in each 5-tuple value of the port and the response packet is the same, it may be determined that the request packet and the response packet satisfy the relationship condition.

Meanwhile, illustratively in relation to (1) described above, the protocol identification information may have a value of either 0 or 1, and the event collection device 110 may include the protocol identification information included in the 5-tuple value of the request packet. When the protocol identification information included in the 5-tuple value of each response packet is equal to 1, the above-described (2) is determined, and when the two protocol identification information are not identical or both are equal to 0, the above-described (2) It may be determined that the request packet and the response packet do not satisfy the relation condition without determining .

That is, the event collection device 110 may determine that the relation condition is satisfied when both the request packet and the response packet use the same transport layer protocol (eg, UDP) and the source and target are opposite to each other. . Accordingly, the event collecting device 110 may increase the efficiency of system resources and improve system performance by collecting information in abbreviated event units instead of collecting information every time a packet is transmitted.

In step S230, the event collection device 110 may classify into the same group packets satisfying a predetermined relationship condition.

For example, as a result of the determination in step S220, when it is determined that the request packet A and the response packets B and C satisfy the relation condition, the event collection device 110 classifies A, B, and C into the same group. can However, this is illustrative, and a plurality of response packets are not necessarily transmitted per request packet, and in response to transmission of a plurality of request packets according to the type of session between the first terminal 120 and the second terminal 130 A numerical relationship between a request packet and a response packet may correspond to one of 1 to 1, 1 to N, N to 1, and N to M, such as that one response packet may be transmitted (in this case, N and M is a natural number greater than or equal to 2).

In step S240, the event collection device 110 may collect each of the classified groups as an event corresponding to an individual session.

According to an embodiment, the event collection device 110 may collect each of the classified groups as an event corresponding to a communication session using QUIC (Quick UDP Internet Connections) as a transport layer protocol.

3 is an exemplary diagram illustrating a process of collecting events in more detail.

Specifically, FIG. 3 shows a session in which a plurality of response packets are transmitted as one request packet is transmitted between the first terminal 120 and the second terminal 130, and the IP address of the first terminal 120 is shown. is 1.1.1.1, the port (port number) is 10240, the IP address of the second terminal 130 is 1.1.1.2, and the port is 443.

According to an embodiment, the event collection device 110 includes one request packet (No. 1) transmitted from the first terminal 120 to the second terminal 130 and the first terminal (from the second terminal 130). 120) can identify five response packets (No. 2 to No. 6).

According to an embodiment, the event collection device 110 can identify that all six packets are packets transmitted using UDP as a transport layer protocol based on protocol identification information of each of one request packet and five response packets. .

According to an embodiment, the event collection device 110 responds with the IP address of the first terminal 120 and the port of the first terminal 120 respectively corresponding to the source IP and the source port among the 5-tuple values of the request packet. The IP address of the second terminal 130 corresponding to the target IP and target port among the 5-tuple values of the packet and the source IP and source port among the 5-tuple values of the response packet, respectively. As the port corresponds to the target IP and target port, respectively, among the 5-tuple values of the request packet, the shown 1 request packet and 5 response packets are classified into the same group, and QUIC session input/output (I/O) It can be collected through events.

4 is a flowchart illustrating an event collection method according to an additional embodiment.

The method shown in FIG. 4 may be performed by, for example, the event collection device 110 described above.

In the illustrated flowchart, the method is divided into a plurality of steps, but at least some of the steps are performed in reverse order, combined with other steps, performed together, omitted, divided into detailed steps, or not shown. One or more steps may be added and performed.

In step S410 , the event collection device 110 may identify a plurality of packets transmitted between the first terminal 120 and the second terminal 130 .

In step S420, the event collection device 110 may compare detailed information of each of the identified plurality of packets to determine whether the plurality of packets satisfy a predetermined relationship condition.

In step S430, the event collection device 110 may classify into the same group packets that satisfy a predetermined relationship condition.

In step S440, the event collection device 110 may collect each of the classified groups as an event corresponding to an individual session.

In step S450, the event collection device 110 may calculate a state value for a packet included in the event for each collected event.

According to an embodiment, the event collection device 110 transmits a representative value for a request packet transmitted from the first terminal 120 to the second terminal 130 among packets included in the event and the second terminal after transmission of the request packet. In step 130, a representative value for a response packet transmitted to the first terminal 120 may be calculated.

For example, the event collecting device 110 includes a request count indicating the number of times request packets are transmitted, a request byte count indicating the number of bytes transmitted by the request packet, a response count indicating the number of times response packets are transmitted, and a response packet. Calculate at least some of the number of response bytes representing the number of bytes transmitted by or use at least some of the number of requests, the number of requested bytes, the number of responses, and the number of response bytes to calculate a representative value such as average, sum, quartile value, etc. there is.

As an additional example, the event collection device 110 may include a request time representing the time required for transmission of the request packet, a request rate representing the transmission rate of the request packet, a response time representing the time required for transmission of the response packet, and the number of response packets. Representative values such as average, sum, and quartile may be calculated using at least some of the response rates representing transmission rates or using at least some of the request time, request rate, response time, and response rate.

Through this, the event collection device 110 collects events and calculates state values for packets constituting sessions such as system actions corresponding to events and system input/output. Concerns such as ambiguity, uncertainty, and loss of can be eliminated, and waste of system resources due to calculating state values by a separate device can be prevented.

5 is an exemplary diagram illustrating state values calculated for each event in more detail.

Specifically, in FIG. 5, based on one QUIC session I/O event in which six packets transmitted between the first terminal 120 and the second terminal 130 are abbreviated, six packets included in the event The state value for is shown.

According to an embodiment, the event collection device 110 may calculate the number of requests representing the number of times the request packet is transmitted and the number of request bytes representing the number of bytes transmitted by the request packet as status values for the request packet.

Specifically, as shown in FIG. 3, the event collection device 110 calculates the number of requests once as one request packet is transmitted, and sets the number of requested bytes as N according to the number of bytes transmitted by the request packet. It can be calculated in bytes.

Meanwhile, according to an embodiment, the event collection device 110 may calculate the number of responses representing the number of times the response packet is transmitted and the number of response bytes representing the number of bytes transmitted by the response packet as a status value for the response packet. .

Specifically, as shown in FIG. 3, the event collection device 110 calculates the number of responses as 5 times as 5 response packets are transmitted, and sets the number of response bytes M as the number of bytes transmitted by the response packet is M. It can be calculated in bytes.

6 is a block diagram illustrating an event collection device according to an exemplary embodiment.

The event collection device 110 may include a transceiver 111 , a processor 113 , and a memory 115 according to an embodiment. The event collection device 110 may be connected to other external devices through the transceiver 111 and exchange data.

The processor 113 may perform at least one method described above through FIGS. 1 to 5 . The memory 115 may store information for performing at least one method described above through FIGS. 1 to 5 . Memory 115 may be volatile memory or non-volatile memory.

The processor 113 may control the event collection device 110 to execute a program and provide information. Program codes executed by the processor 113 may be stored in the memory 115 .

The processor 113 is connected to the transceiver 111 and the memory 115, identifies a plurality of packets transmitted between the first terminal 120 and the second terminal 130, and provides detailed information of each of the plurality of packets. It compares a plurality of packets to determine whether or not they satisfy a predetermined relationship condition, classifies packets that satisfy the predetermined relationship condition into the same group, and collects each of the classified groups as an event corresponding to an individual session. can

Also, the event collection device 110 according to an embodiment may further include an interface capable of providing information to a user.

In the event collection device 110 shown in FIG. 6, only components related to the present embodiment are shown. Accordingly, those skilled in the art can understand that other general-purpose components may be further included in addition to the components shown in FIG. 6 .

The device according to the above-described embodiments includes a processor, a memory for storing and executing program data, a permanent storage unit such as a disk drive, a communication port for communicating with an external device, a touch panel, a key, a button, and the like. The same user interface device and the like may be included. Methods implemented as software modules or algorithms may be stored on a computer-readable recording medium as computer-readable codes or program instructions executable on the processor. Here, the computer-readable recording medium includes magnetic storage media (e.g., read-only memory (ROM), random-access memory (RAM), floppy disk, hard disk, etc.) and optical reading media (e.g., CD-ROM) ), and DVD (Digital Versatile Disc). A computer-readable recording medium may be distributed among computer systems connected through a network, and computer-readable codes may be stored and executed in a distributed manner. The medium may be readable by a computer, stored in a memory, and executed by a processor.

This embodiment can be presented as functional block structures and various processing steps. These functional blocks may be implemented with any number of hardware or/and software components that perform specific functions. For example, an embodiment is an integrated circuit configuration such as memory, processing, logic, look-up table, etc., which can execute various functions by control of one or more microprocessors or other control devices. can employ them. Similar to components that can be implemented as software programming or software elements, the present embodiments include data structures, processes, routines, or various algorithms implemented as combinations of other programming constructs, such as C, C++, Java ( It can be implemented in a programming or scripting language such as Java), assembler, or the like. Functional aspects may be implemented in an algorithm running on one or more processors. In addition, this embodiment may employ conventional techniques for electronic environment setting, signal processing, message processing, and/or data processing. Terms such as "mechanism", "element", "means" and "composition" may be used broadly and are not limited to mechanical and physical components. The term may include a meaning of a series of software routines in association with a processor or the like.

The foregoing embodiments are merely examples and other embodiments may be implemented within the scope of the claims described below.

Claims (10)

identifying a plurality of packets transmitted between the first terminal and the second terminal;
comparing detailed information of each of the plurality of packets to determine whether the plurality of packets satisfy a predetermined relationship condition;
classifying packets satisfying the relation condition into the same group; and
and collecting each of the classified groups as an event corresponding to an individual session. According to claim 1,
Each of the plurality of packets,
An event collection method characterized in that it is transmitted using UDP (User Datagram Protocol) as a transport layer protocol. According to claim 1,
The determining step is
The event collection method, characterized in that determining whether the relation condition is satisfied by comparing a 5-tuple value of each of the plurality of packets with each other of the plurality of packets. According to claim 3,
The determining step is
A 5-tuple value of a request packet transmitted from the first terminal to the second terminal and a 5-tuple value of each of one or more response packets transmitted from the second terminal to the first terminal after transmission of the request packet Characterized in that, the event collection method for determining whether the relation condition is satisfied by comparing. According to claim 4,
The determining step is
determining whether the protocol identification information included in the 5-tuple value of the request packet is the same as the protocol identification information included in the 5-tuple value of each response packet;
A source IP and source port included in the 5-tuple value of the request packet and a target IP and target port included in each 5-tuple value of the response packet Determining whether is the same; and
And determining whether the target IP and the target port included in the 5-tuple value of the request packet are the same as the source IP and source port included in the 5-tuple value of each of the response packets. According to claim 1,
The collecting step is
An event collection method characterized in that each of the classified groups is collected as an event corresponding to a communication session using QUIC (Quick UDP Internet Connections) as a transport layer protocol. According to claim 1,
Further comprising calculating a state value for a packet included in the event for each of the collected events. According to claim 7,
The calculating step is
Among the packets included in the event, a representative value for a request packet transmitted from the first terminal to the second terminal and a representative value for a response packet transmitted from the second terminal to the first terminal after transmission of the request packet An event collection method characterized by calculating. one or more processors;
Memory; and
contains one or more programs;
the one or more programs are stored in the memory and configured to be executed by the one or more processors;
The one or more programs,
instructions for identifying a plurality of packets transmitted between the first terminal and the second terminal;
a command for comparing detailed information of each of the plurality of packets to determine whether the plurality of packets satisfy a predetermined relationship condition;
a command for classifying packets satisfying the relation condition into the same group; and
And a command for collecting each of the classified groups as an event corresponding to an individual session. As a non-transitory computer readable storage medium,
a medium configured to store computer readable instructions;
The computer readable instructions, when executed by a processor, cause the processor to:
identifying a plurality of packets transmitted between the first terminal and the second terminal;
comparing detailed information of each of the plurality of packets to determine whether the plurality of packets satisfy a predetermined relationship condition;
classifying packets satisfying the relation condition into the same group; and
A non-transitory computer-readable storage medium for performing an event collection method comprising collecting each of the classified groups as an event corresponding to an individual session.

Images