WO2014025225A1

WO2014025225A1 - Apparatus for detecting application packet data pattern

Info

Publication number: WO2014025225A1
Application number: PCT/KR2013/007192
Authority: WO
Inventors: 차양명
Original assignee: 주식회사 아이디어웨어
Priority date: 2012-08-10
Filing date: 2013-08-09
Publication date: 2014-02-13
Also published as: KR20140021774A

Abstract

The present invention relates to an apparatus for detecting an application packet data pattern, comprising: an application detection module for outputting an application list and/or an application file list provided to a wireless terminal device, enabling a user to select an application to be analyzed, extracting the character string of the application file for the selected application, extracting, by analyzing the pattern of the extracted character string, analysis result information including information on the IP with which the application connects, domain name information, and/or monitored API usage information, and storing the extracted analysis result information in a storage medium; an event-generating module for controlling the wireless terminal device so as to generate one or more events which are to be generated by the wireless terminal device, receiving, if one or more applications provided to the wireless terminal device generate packet data to be externally transceived in correspondence to the generation of the event, the packet data or packet data information from the wireless terminal device, and analyzing the received packet data or packet data information so as to acquire packet pattern information for each event and for each application; and a packet interception module for generating a packet data interception rule for one or more applications provided to the wireless terminal device, controlling, from a remote location, the generated packet data interception rule to be applied to the wireless terminal device, receiving the packet data or packet data information generated by the wireless terminal device in correspondence to the interception of the external transmission of packet data of said one or more applications, and analyzing the received packet data or packet data information so as to acquire packet pattern information for each application corresponding to the packet interception rule.

Description

Application packet data pattern detection device

The present invention is to detect the packet pattern information according to the network use of the application provided in the wireless terminal device for reducing the wireless network load.

Since the spread of smartphones, personal terminal usage patterns have been rapidly shifting from voice calls to data communication.

As shown in the mobile (wireless) data traffic indicator of FIG. 1, mobile traffic is expected to increase by about 26 times over the next 10 to 15 years, and the amount of mobile data used by individuals in 2010 was 15MB, but in 2020 It can reach 1GB.

This increase in mobile traffic directly affects the profitability and service quality of mobile carriers, and involves the expansion of equipment of mobile carriers as service providers. As a result, profit deterioration is inevitable. In addition, service dissatisfaction is increased due to data communication speed delay.

As a result, mobile operators face the challenge of efficiently utilizing network infrastructure to reduce investment and ensure quality of service, and current solutions have limitations, requiring alternatives that guarantee predictability and real-time control.

For example, as shown in FIG. 2, periodic data polling of various applications installed in a wireless terminal device is a major factor in mobile network congestion.

That is, in order for one data polling application to access a server, dozens of data communications, such as the location of a base station, must be preceded and cause connection traffic with the application server even after the communication is connected to the communication network.

These data polling enforcement applications automatically connect to the application server every few minutes to several tens of minutes to check for updated data, causing excessive traffic on the network even if there is no data update on the actual application server. The same process is repeated periodically, which is a major factor in overloading mobile networks.

In conclusion, in order to solve the enormous cost consumption of mobile communication operators and service dissatisfaction of wireless terminal politics users due to network congestion, it is absolutely necessary to prevent unnecessary network use through a plurality of applications provided in the wireless terminal device. This has come, but there is no solution.

Recognition of the problems and problems of the prior art described above is not obvious to those of ordinary skill in the art of the present invention and should not judge the progress of the present invention compared to the prior art based on such recognition. Reveal.

An object of the present invention for solving the above problems is, after outputting one or more application list and the application file list provided in the wireless terminal device, and receives the analysis target application from the user, the application of the application file for the selected application After extracting the character string, the analysis result information is extracted by extracting analysis result information including one or more IP information, domain name information, and monitoring object API usage status information to which the application accesses through pattern analysis of the extracted character string. The present invention provides a device that can provide basic data that can block unnecessary network access to applications provided in a wireless terminal device.

Still another object of the present invention is to output one or more event types to be generated in a wireless terminal device, and then select one or more events to be generated in the wireless terminal device from a user, and remotely select the selected event to occur in the wireless terminal device. When the external transmission / reception packet data is generated in response to the event occurrence in one or more applications provided in the wireless terminal device, the packet data or packet data information is received from the wireless terminal device, and the received packet is controlled. After storing the data or packet data information on the storage medium by connecting the application information generating the packet data and the information on the event, and analyzing the packet data or packet data information stored on the storage medium for each application by event Packet pattern information By deriving, based on the extracted packet pattern information for each application for each event, it is possible to provide basic data for blocking unnecessary network access to applications provided in the wireless terminal device in response to various events occurring in the wireless terminal device. In providing a device.

Still another object of the present invention is to generate the packet blocking rule for each application, and further control the blocking of external transmission of packet data through one or more applications provided in the wireless terminal device in response to the packet blocking rule for each application. When the external transmission / reception packet data through the application is generated after blocking the external transmission of packet data for the application, the packet data or packet data information is received from the wireless terminal device, and the received packet data or packet data information is received. Is stored on the storage medium by connecting the application information generating the packet data and external transmission blocking information of the packet data through the application, and then analyzes the packet data or packet data information stored on the storage medium to determine the application-specific packet. By deriving the external transmission target packet pattern information for each external transmission blocking information of the data, it corresponds to the packet blocking event of the applications provided in the wireless terminal device based on the external transmission target packet pattern information for each external transmission blocking rule of the extracted application packet data. The present invention provides an apparatus and method for providing basic data that can solve unnecessary network resource waste, and a recording medium therefor.

The technical problem to be achieved in the present invention is not limited to the technical problem mentioned above, and other technical problems not mentioned above may be clearly understood by those skilled in the art from the following description. There will be.

The apparatus for detecting an application packet data pattern according to the present invention outputs one or more application lists and application file lists included in a wireless terminal device, and then selects an analysis target application from a user, and outputs a string of an application file for the selected application. After extracting, extract analysis result information including one or more IP information, domain name information, and monitoring target API usage status information through the pattern analysis of the extracted character string, and stores the extracted analysis result information. An application detection module for storing on a medium, and controlling one or more events to be generated in the wireless terminal device to be generated in the wireless terminal device, and in response to the occurrence of the event in one or more applications provided in the wireless terminal device. An event generation module that receives the packet data or packet data information from the wireless terminal device, and analyzes the received packet data or packet data information to derive packet pattern information for each application per event when kit data is generated; Generate a packet data blocking rule for one or more applications provided in the wireless terminal device, control the remotely applied packet data blocking rule to the wireless terminal device, and transmit the packet data externally to the one or more applications. Receiving packet data or packet data information generated by the wireless terminal device in response to the blocking, packet blocking for deriving packet pattern information for each application corresponding to a packet blocking rule by analyzing the received packet data or packet data information. With module do.

According to one side, the application detection module, the binary format files of the wireless terminal device to compile the intermediate language or high-level language, and then scan the source of the compiled intermediate or high-level language is fixed to the source IP information, port information and domain name information of the server used by the application can be extracted.

According to another aspect, the application detection module, after compiling the binary format file of the wireless terminal device to compile the intermediate language or high-level language, and scan the source of the compiled intermediate or high-level language fixed to the source Extract IP information, port information, and domain name information of a server used by the application, but in the case of domain name information, an additional IP may be extracted by querying the ISP's domain servers.

According to the present invention, the event may include an application install / uninstall operation occurrence event, a specific application execution event, a restart package event, a touch event occurrence event, an H / W key event occurrence event, an LCD on / off Function event, Lock screen unlock function event, WiFi On / Off function event, 3G network On / Off function event, Bluetooth On / Off function event, GPS operation On / Off (can include location search start / end) Event, Camera On / Off event, External Storage Read / Write event, Garbage collection occurrence event, SMS notify message occurrence event, Alarm occurrence event, Vibration occurrence event, System time change event, Wireless terminal device It may include a status update command occurrence event and one or more System Setting Read / Write event, the packet pattern information, the event-specific or packet blocking rule application Access information to a specific IP or port or URL, and information on the number of times to connect to a specific IP or port or URL to an application by event or packet blocking rule And information on polling count requesting data by IP or port or URL by application by event or packet blocking rule, and specific IP by application by event or packet blocking rule. Push count information that transmits data by (IP) or port or URL or ID, and specific IP or port by application by event or packet blocking rule Or user disapproval target data including size or capacity information of data transmitted by URL or ID and application data by event or packet blocking rule To request and receive information may include one or more.

According to an aspect of the present invention, it is possible to policyally block or adjust unnecessary execution of the network load for each application, thereby enabling the optimized use of the network in the wireless terminal device.

Another effect according to an aspect of the present invention, it is possible to minimize the network capacity of the mobile communication provider through the optimization of the network use.

Another effect according to an aspect of the present invention, by minimizing the dissatisfaction of the user of the wireless terminal device due to data communication delay, etc. through the optimization of the network use can significantly reduce the battery consumption of the wireless terminal device.

The following drawings, which are attached to this specification, illustrate preferred embodiments of the present invention, and together with the detailed description of the present invention serve to further understand the technical spirit of the present invention. It should not be construed as limited to.

1 is a diagram illustrating a mobile (wireless) data traffic indicator.

2 is a diagram illustrating one of the main factors of the conventional mobile network congestion.

3 is a diagram illustrating the main components of an apparatus for detecting an application packet data pattern according to an embodiment of the present invention.

4 is a diagram illustrating main components of an application detection module according to an embodiment of the present invention.

5 is a diagram illustrating main components of an event generation module according to an embodiment of the present invention.

6 is a view showing the main components of a packet blocking module according to an embodiment of the present invention.

7 is a diagram illustrating an example of outputting an application list screen according to an embodiment of the present invention.

8 is a diagram showing an example of an analysis result information output screen according to an embodiment of the present invention.

9 is a diagram illustrating an example of an analysis result information storage and transmission screen according to an embodiment of the present invention.

10 is a diagram illustrating an example of outputting an event setting screen according to an embodiment of the present invention.

11 is a diagram illustrating an example of recording a user event according to an embodiment of the present invention.

12 is a diagram illustrating an example of a packet flow output screen of an application according to an embodiment of the present invention.

13 is a diagram illustrating an example of a packet blocking rule setting screen of an application according to an embodiment of the present invention.

14 is a diagram illustrating a process for detecting an application according to an embodiment of the present invention.

15 is a diagram illustrating a process for detecting an application packet pattern corresponding to an event according to an embodiment of the present invention.

16 is a diagram illustrating a process for detecting an application packet pattern corresponding to a packet blocking rule according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings and description will be described in detail the operating principle of the preferred embodiment of the present invention. However, the drawings and the following description shown below are for the preferred method among various methods for effectively explaining the features of the present invention, the present invention is not limited only to the drawings and description below. In addition, in the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. Terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to intentions or customs of users or operators. Therefore, the definition should be made based on the contents throughout the present invention.

As a result, the technical spirit of the present invention is determined by the claims, and the following examples are one means for efficiently explaining the technical spirit of the present invention to those skilled in the art to which the present invention pertains. It is only.

3 is a diagram illustrating a main component of the apparatus 100 for detecting an application packet data pattern according to an embodiment of the present invention.

In more detail, in FIG. 3, an application packet data pattern detection apparatus 100 is connected to an analysis wireless terminal device 200 through a communication network or a network, and according to the network use of an application provided in the wireless terminal device 200. A configuration for detecting pattern information is shown.

Each configuration shown in FIG. 3 is merely a configuration for describing an embodiment of the present invention, and the present invention is not limited to the technical features only by the implementation method shown in FIG. 3.

Referring to FIG. 3, an application packet data pattern detection apparatus 100 according to an exemplary embodiment of the present invention includes an application detection module 10, an event generation module 20, and a packet blocking module 30. do.

Here, the application packet data pattern detection apparatus 100 is illustrated as a single device in the drawings for the purpose of describing the embodiments, but each of the components may be separately configured into one or more devices.

Referring to FIG. 3, the application detection module 10 outputs one or more application lists and application file lists included in the wireless terminal device 200, selects an analysis target application from a user, and then selects an application to be analyzed. Extract the character string of the application file, and extracts analysis result information including one or more IP information, domain name information, and monitoring target API usage status information through the pattern analysis of the extracted character string; It stores the extracted analysis result information on the storage medium 16.

According to the present invention, the application detection module 10, after compiling the binary format file of the wireless terminal device 200 to compile the intermediate language or high-level language, and then the source of the compiled intermediate language or high-level language By scanning, the server extracts IP information, port information, and domain name information used by the application fixed to the source.

In addition, the application detection module 10 decompiles the binary format file of the wireless terminal device 200 to compile the intermediate language or the high-level language, and then scans the source of the compiled intermediate or high-level language. Extract IP information, port information, and domain name information of a server used by an application fixed to. However, in the case of domain name information, additional IPs can be extracted by querying ISP's domain servers.

The event generation module 20 according to the embodiment of the present invention controls the one or more events to be generated in the wireless terminal device 200 to be generated in the wireless terminal device 200, and is provided in the wireless terminal device 200. When external transmission / reception packet data is generated in response to the event occurrence in one or more applications, the packet data or packet data information is received from the wireless terminal device 200 and the received packet data or packet data information is analyzed. It derives the packet pattern information for each application by event.

The event may include an application install / uninstall operation occurrence event, a specific application execution event, a restart package event, a touch event occurrence event, an H / W key event occurrence event, an LCD on / off function event, and a lock. screen release function event, WiFi On / Off function event, 3G network On / Off function event, Bluetooth On / Off function event, GPS operation On / Off (including location search start / end) event, Camera On / Off event, External Storage Read / Write event, Garbage collection occurrence event, SMS notify message occurrence event, Alarm occurrence event, Vibration occurrence event, System time change event, Wireless terminal device 200 status update It may include one or more command generation events and one or more System Setting Read / Write events.

Packet blocking module 30 according to an embodiment of the present invention, generates a packet data blocking rule for one or more applications provided in the wireless terminal device 200, the remotely generated packet data blocking rule is the wireless After receiving the packet data or packet data information generated in the wireless terminal device 200 in response to the control to be applied to the terminal device 200, the external transmission of packet data for the one or more applications, the received packet It analyzes the data or packet data information to derive packet pattern information for each application corresponding to the packet blocking rule.

Here, the packet pattern information derived by the event generation module 20 and the packet blocking module 30 is connected to a specific IP (IP) or port (URL) or URL (URL) for each application per event or packet blocking rule. Information, the number of times per connection to a specific IP or port or URL per application by event or packet blocking rule, and a specific IP (IP) by application per event or packet blocking rule or Polling count information requesting data by port or URL and application-specific IP or port or URL or ID or ID by event or packet blocking rule To transmit the data to the number of pushes to transmit data to each IP or port or URL or ID by application by event or packet blocking rule. It may include one or more information about the size or capacity of the data, and request and reception information of the user disapproval target data including advertisement data for each application per event or packet blocking rule.

4 is a diagram illustrating the main components of the application detection module 10 according to the embodiment of the present invention.

In more detail, FIG. 4 illustrates that the application detection module 10 is connected to the analysis wireless terminal device 200 through a communication network or a network, and access IP information and domain name information for each application provided in the wireless terminal device 200. And, it shows a configuration for detecting the analysis result information including one or more monitoring status information API usage information.

Each configuration shown in FIG. 4 is merely a configuration for describing an embodiment of the present invention, and the present invention is not limited to the technical features only by the implementation method shown in FIG. 4.

Referring to FIG. 4, an application detecting apparatus 100 according to an exemplary embodiment of the present invention includes a management unit 11, an interface unit 13, an analysis unit 14, a storage unit 15, and a storage medium. 16, the communication part 17, and the control part 11 for controlling each said structure part is comprised.

Referring to FIG. 4, the management unit 11 manages an application list, an application file list, an application version, and an upgrade provided in the wireless terminal device 200.

That is, the management unit 11 manages a list of one or more analysis target applications provided in the wireless terminal device 200 for analysis and whether the version upgrade is changed for each application.

The communication unit 17 according to the embodiment of the present invention receives one or more application lists and application file lists included in the wireless terminal device 200 managed by the management unit 11 from the wireless terminal device 200. It plays a role.

In addition, the communication unit 17 may further perform a role of transmitting the analysis result information extracted by the analysis unit 14 to the server on the communication network, the application detection module 10 and the wireless terminal device 200 outside the role. Role of transmitting / receiving data or information between the terminals), transmitting / receiving data or information between the application detection module 10 and a server on a communication network, and between a computer that remotely controls the application detection module 10 and the application detecting apparatus 100 remotely. It also performs the role of transmitting and receiving data or information.

The interface unit 13 according to the embodiment of the present invention outputs one or more application lists and application file lists included in the wireless terminal device 200 managed by the management unit 11, and then analyzes the analysis targets from the user. It plays the role of selecting an application.

FIG. 7 is a diagram illustrating an example of outputting an application list screen according to an exemplary embodiment of the present invention, wherein a list and a file list of applications included in the wireless terminal device 200 are displayed on the screen through the interface unit 13. After output, it shows that the user can select one or more applications or application files to be analyzed.

The analysis unit 14 according to the embodiment of the present invention extracts a string of an application file for the selected application through the interface unit 13, and then analyzes the IP information to which the application accesses through pattern analysis of the extracted string. It extracts the analysis result information including one or more domain name information and monitoring object API usage status information.

Here, the monitoring target API usage status can be expanded and changed as specified as the monitoring target among the APIs used in Android (language format used for communication between the operating system and the App). Can be

For example, the API is a method such as getSystemService () getDeviced () getSubscribed () to grasp the usage and frequency of APIs that cause signal congestion and traffic congestion in the wireless network, such as frequently calling networks. It can be used for future suspension recommendations or management.

According to the present invention, the analysis unit 14, after compiling a binary format file of the wireless terminal device 200 to compile the intermediate language or high-level language, and scans the source of the compiled intermediate language or high-level language IP information, port information and domain name information of the server used by the application fixed to the source can be extracted.In the case of domain name information, additional IPs can be extracted by querying the ISP's domain servers. .

8 is a view showing an example of an analysis result information output screen according to an embodiment of the present invention, IP information and domain name information of the 'KakaoTalk' application among the applications provided in the wireless terminal device 200; And output the analysis result of the analysis unit 14 including the monitoring target API information on the screen.

The storage unit 15 according to an exemplary embodiment of the present invention stores the analysis result information extracted by the analysis unit 14 on the storage medium 16.

According to the present invention, the storage unit 15 stores the analysis result information in connection with the analysis target application information, and accumulates or changes the updated information whenever an analysis result of the analysis target application occurs. Can be.

Here, the analysis result information, the number of times per hour that the application is connected to a specific IP (IP) or port (Port) or URL (URL), and the application is a specific IP (IP) or port (Port) or UAL ( Polling count information requesting data through URL), Push count information sending data to the specific IP or port or URL or ID. The size or capacity information of the data transmitted by the application to a specific IP or port or URL or ID, and the request of the user disapproval target data including the advertisement data by the application. And receiving information and one or more data communication connection information when the application exceeds a data communication limit allocated to the wireless terminal device 200. The.

The storage medium 16 according to an exemplary embodiment of the present invention is a medium for storing one or more analysis target application information and analysis result information corresponding thereto, which are stored through the storage unit 15, and the application detection module 10. ) Or on a server or computer connected to the application detection module 10 by a communication network or a network.

5 is a diagram illustrating the main components of the event generation module 20 according to the embodiment of the present invention.

In more detail, FIG. 5 illustrates that the event generation module 20 is connected to the analysis wireless terminal device 200 through a communication network or a network, corresponding to one or more events generated by the wireless terminal device 200. The configuration of detecting the packet pattern information according to the network use of the application provided in (200) is shown.

Each configuration shown in FIG. 5 is only a configuration for describing an embodiment of the present invention, and the present invention is not limited to the technical features only by the implementation method shown in FIG. 5.

Referring to FIG. 5, the event generating module 20 according to the embodiment of the present invention includes an interface unit 22, an event control unit 23, a communication unit 24, a storage unit 25, and a storage medium. (26), the analysis part 27, and the control part 21 for controlling each said structure part is comprised.

Referring to FIG. 5, the interface unit 22 outputs one or more types of events to be generated in the wireless terminal device 200, and then selects one or more events to be generated in the wireless terminal device 200 from the user. Do this.

According to the present invention, the interface unit 22 outputs one or more application lists and application file lists included in the wireless terminal device 200, and then selects an analysis target application from a user and the application for each event. It may further perform the role of outputting the packet pattern information for each screen.

The event may include an application install / uninstall operation occurrence event, a specific application execution event, a restart package event, a touch event occurrence event, an H / W key event occurrence event, an LCD on / off function event, and a lock. screen release function event, WiFi On / Off function event, 3G network On / Off function event, Bluetooth On / Off function event, GPS operation On / Off (including location search start / end) event, Camera On / Off event, External Storage Read / Write event, Garbage collection occurrence event, SMS notify message occurrence event, Alarm occurrence event, Vibration occurrence event, System time change event, Wireless terminal device 200 status update One or more command generation events, a System Setting Read / Write event, and an external packet transmission / reception event may be included.

FIG. 10 is a diagram illustrating an example of outputting an event setting screen according to an embodiment of the present invention, and may sequentially or randomly set various events to be generated in the wireless terminal device 200 through the interface unit 22. Make sure

FIG. 11 is a diagram illustrating an example of recording a user event according to an exemplary embodiment of the present invention. FIG. 11 illustrates an event record of touching a coordinate of 100,200 while dragging from a 100,500 coordinate to a 400.500 coordinate while performing a 'Touch event' among user events. And storing the event record on storage medium 26.

The event controller 23 according to the embodiment of the present invention performs a role of controlling the event selected through the interface unit 22 to be generated in the wireless terminal device 200.

According to the present invention, the event controller 23, the selected event using the API (Application Programming Interface) of the operating system (OS) provided in the wireless terminal device 200 in the wireless terminal device 200 It can be remotely controlled to generate.

In addition, the event controller 23 may further play a role of controlling the external transmission blocking of packet data through one or more applications provided in the wireless terminal device 200.

Communication unit 24 according to an embodiment of the present invention, when the external transmission and reception packet data in response to the occurrence of the event in one or more applications provided in the wireless terminal device 200, from the wireless terminal device 200 It serves to receive the packet data or packet data information.

In addition, the communication unit 24 may further receive event data corresponding to the packet data or the packet data information received from the wireless terminal device 200, and the event control unit 23, the wireless terminal device ( In the case of controlling external transmission blocking of packet data through at least one application provided in 200, when external transmission / reception packet data through the application occurs after blocking external transmission of packet data for the application, the wireless terminal device ( 200 may further perform the role of receiving the packet data or packet data information.

In addition, the communication unit 24 transmits the external application blocking information of the application-specific packet data corresponding to the application-specific packet pattern information detected by the analysis unit 27 and the external transmission blocking of the packet data through the application. It may further perform the role of transmitting the target packet pattern information to the server on the communication network, the role of transmitting and receiving data or information between the event generating module 20 and the wireless terminal device 200 and the event generating module 20 It further performs the role of transmitting and receiving data or information between the server on the communication network, and the data or information transmission and reception between the event generating module 20 and the computer that controls the event generating module 20 from a remote location.

The storage unit 25 according to an exemplary embodiment of the present invention connects the packet data or the packet data information received by the communication unit 24 with the application information generating the packet data and the information on the event to store the storage medium 26. ) To save on.

According to the present invention, the storage unit 25 may configure the order of occurrence of the selected events through the interface and store them in the storage medium 26, through one or more applications provided in the wireless terminal device 200. When an external transmission blocking event of packet data occurs, the packet data or packet data information received by the communication unit 24 is connected with application information generating the packet data and external transmission blocking information of packet data through the application. The storage medium 26 may be stored.

In addition, the storage unit 25 is external to the external transmission blocking information of the application-specific packet data corresponding to the application-specific packet pattern information for each event detected by the analysis unit 27 and blocking the external transmission of packet data through the application. The transmission target packet pattern information may be further stored on the storage medium 26.

The storage medium 26 according to an exemplary embodiment of the present invention may include one or more analysis target application information stored through the storage unit 25, one or more event information applied to the application, and an event-specific application corresponding to the event, respectively. As a medium for storing the packet pattern information for each star, it may be provided in the event generating module 20 or on a server or a computer connected to the event generating module 20 by a communication network or a network.

The analysis unit 27 according to the exemplary embodiment of the present invention analyzes packet data or packet data information stored on the storage medium 26 to derive packet pattern information for each application by event.

Here, the external transmission target packet pattern information for each application by event is information on the packet transmission / reception pattern for each application provided in the wireless terminal device 200 in response to each event occurrence. Information connected by IP or port or URL, application by event information per hour, and information about the number of times to connect by specific IP or port or URL, application by event Polling number information requesting data by specific IP or port or URL by URL, and specific IP or port or URL or URL by application by event Push count information to transmit data in (ID), and specific IP (IP) or port (URL) or ID by application for each event The size and capacity information of the data transmitted to the ID, request and reception information of the user disapproval target data including the application-specific advertisement data for each event, and data allocated to the wireless terminal device 200 for each application per event. If the communication limit is exceeded, it may include one or more data communication connection information.

According to the present invention, the analyzer 27 is stored in the storage medium 26 when the event is an external transmission blocking event of packet data through at least one application provided in the wireless terminal device 200. The application information generating the packet data and the external transmission blocking information of the packet data through the application may be analyzed to detect external transmission target packet pattern information for each external transmission blocking information of the application-specific packet data.

According to the present invention, all or part of the functions of the respective components provided in the event generating module 20 may be implemented in the form of a program or a program set.

In addition, among the functions of each component provided in the event generation module 20, packet data blocking and packet pattern information derivation functions according to packet data blocking may be replaced by a function of a component of the following packet blocking module 30. In this case, among the functions of each component included in the event generating module 20, functions related to deriving packet pattern information according to packet data blocking and packet data blocking may be excluded.

6 is a diagram showing the main components of the packet blocking module 30 according to the embodiment of the present invention.

In more detail, in FIG. 6, the packet blocking module 30 is connected to the analysis wireless terminal device 200 through a communication network or a network, and corresponds to one or more packet blocking generated by the wireless terminal device 200. The configuration of detecting packet pattern information according to a network use of an application provided in 200 is illustrated.

Each configuration shown in FIG. 6 is merely a configuration for describing an embodiment of the present invention, and the present invention is not limited to the technical features only by the implementation method shown in FIG. 6.

Referring to FIG. 6, the application packet pattern detecting apparatus 100 corresponding to packet blocking according to an embodiment of the present invention includes an interface unit 32, a packet blocking control unit 34, a communication unit 35, and a storage unit. The unit 36 includes a storage medium 37, an analyzer 38, a generator 33, and a controller 31 for controlling each of the components.

Referring to FIG. 6, the interface unit 32 performs a role of selecting a packet data blocking target application and a packet data blocking item among one or more applications included in the wireless terminal device 200.

According to the present invention, the interface unit 32 outputs one or more application lists and application file lists included in the wireless terminal device 200, and then selects an analysis target application from a user and the packet blocking. The packet pattern information for each application may be output on the screen.

The generation unit 33 according to the embodiment of the present invention is based on the packet data blocking target application and the packet data blocking item selected through the interface unit 32, and at least one application provided in the wireless terminal device 200. It creates a packet data blocking rule for.

The packet data blocking rule may include one or more specific IP / Port or domain access blocking rules of a specific application and one or more specific packet transmission / reception blocking rules.

12 and 13 illustrate examples of setting a packet blocking rule through the generation unit 33. As shown in FIG. 12, a user confirms a packet flow of a specific application by outputting a packet data flow screen for a specific application. In addition, as shown in FIG. 13, a user interface (UI) may be provided to a user to block specific packet data of the application, and the packet data flow blocking state may be illustrated and output to the user.

The packet blocking control unit 34 according to the embodiment of the present invention performs a role of controlling the packet data blocking rule generated by the generation unit 33 to be applied to the wireless terminal device 200 remotely.

According to the present invention, the packet blocking control unit 34, the selected packet blocking rule using the API (Application Programming Interface) of the operating system (OS) provided in the wireless terminal device 200 is the wireless terminal device ( Can be remotely generated to occur at 200).

The communication unit 35 according to the embodiment of the present invention performs a role of receiving packet data or packet data information generated in the wireless terminal device 200 in response to blocking transmission of packet data to the one or more applications. .

In addition, the communication unit 35 may further receive packet blocking rule information corresponding to the packet data or the packet data information received from the wireless terminal device 200, and wirelessly with the non-role packet blocking module 30. The role of transmitting and receiving data or information between the terminal device 200, the role of transmitting and receiving data or information between the packet blocking module 30 and the server on the communication network, the packet blocking module 30 and the packet blocking module 30 from a remote location It also plays a role of transmitting and receiving data or information between computers.

The storage unit 36 according to an exemplary embodiment of the present invention connects the packet data or the packet data information received by the communication unit 35 with the application information generating the packet data and the packet blocking rule information. ) To save on.

The storage medium 37 according to an embodiment of the present invention may correspond to one or more analysis target application information stored through the storage unit 36, one or more packet blocking rule information applied to the application, and the packet blocking, respectively. As a medium for storing packet pattern information for each packet blocking application, the packet blocking module 30 may be provided in the packet blocking module 30 or on a server or a computer connected to the packet blocking module 30 through a communication network or a network.

The analysis unit 38 according to an exemplary embodiment of the present invention analyzes packet data or packet data information stored on the storage medium 37 to derive packet pattern information for each application corresponding to a packet blocking rule. .

Here, the external transmission target packet pattern information for each packet blocking application is information on packet transmission / reception patterns for each application provided in the wireless terminal device 200 corresponding to each packet blocking rule. Information to connect to a specific IP or port or URL per application, and information per hour to connect to a specific IP or port or URL per application per packet blocking, and , Information on polling count requesting data to a specific IP or port or URL per application by packet blocking, and a specific IP or port per application by packet blocking, or Push count information for transmitting data by URL or ID, and specific IP or port or port per application by packet blocking The size or capacity information of the data transmitted to the URL (URL) or ID (ID), the request and reception information of the user disapproval target data including the advertisement data for each packet blocking application, and the wireless terminal for each application by packet blocking When the data communication limit allocated to the device 200 is exceeded, the data communication connection information may include one or more data communication connection information.

According to the present invention, all or part of the functions of the respective components provided in the packet blocking module 30 may be implemented in the form of a program or a program set.

First, the application detection module 10 receives at least one list of applications and a list of application files included in the analysis wireless terminal device 200 through the communication unit 17 from the wireless terminal device 200 (S1410). .

Thereafter, the application detection module 10 outputs one or more application lists and application file lists received by the communication unit 17 through the interface unit 13, and receives an analysis target application from the user (S1420).

Thereafter, the application detection module 10 extracts a string of an application file for the application selected by the interface unit 13 through the analysis unit 14 (S1430), and then accesses the application through pattern analysis of the extracted string. The analysis result information including one or more IP information, domain name information, and monitoring target API usage status information is extracted (S1440).

In operation S1440, when the analysis result information including one or more IP information, domain name information, and monitoring target API usage status information is derived (S1450), the application detection module 10 stores the information. The analysis result information is stored on the storage medium 16 through the unit 15 and the communication unit 17, and the analysis result information is transmitted to a server on a communication network (S1460).

If the analysis result information including one or more IP information, domain name information, and monitoring target API usage status information is not derived in step S1440, the application detection module 10 ) Repeats the process (S1440), repeats the process (S1410) to (S1440), or terminates the application detection process.

First, the event generation module 20 outputs one or more types of events to be generated in the wireless terminal device 200 through the interface unit 22 (S1510), and then generates one or more events to be generated in the wireless terminal device 200 from the user. The event is selected (S1520).

Thereafter, the event generation module 20 controls the event selected by the interface unit 22 through the event controller 23 to be generated in the wireless terminal device 200 (S1530).

Thereafter, the event generation module 20 monitors whether external transmission / reception packet data is generated in response to the event occurrence in one or more applications provided in the wireless terminal device 200 (S1540).

If the external transmission / reception packet data does not occur in response to the event generation in one or more applications provided in the wireless terminal device 200 in step S1540, the event generation module 20 performs the step S1540. Repeat.

In step S1540, when external transmission / reception packet data is generated in response to the occurrence of an event in one or more applications provided in the wireless terminal device 200 (S1560), the event generation module 20 communicates through the communication unit 24. The packet data or packet data information is received from the wireless terminal device 200 (S1570).

Thereafter, the event generation module 20 connects the packet data or the packet data information received by the communication unit 24 through the storage unit 25 with the application information generating the packet data and the information on the event to store the storage medium. In operation S1580, the process is performed on the storage device 26.

Thereafter, the event generation module 20 analyzes packet data or packet data information stored on the storage medium 26 through the analyzer 27 to derive packet pattern information for each application per event (S1590).

First, the packet blocking module 30 receives a packet data blocking target application and a packet data blocking item among one or more applications provided in the wireless terminal 200 through the interface unit 32 (S1610).

Subsequently, the packet blocking module 30 is one provided in the wireless terminal device 200 based on the packet data blocking target application and the packet data blocking item selected through the interface unit 32 through the generation unit 33. A packet data blocking rule for the above application is generated (S1620).

Subsequently, the packet blocking module 30 corresponds to a packet blocking rule for each application generated by the generation unit 33 through a packet blocking control unit 34, and thus, the packet through one or more applications provided in the wireless terminal device 200. External transmission and reception of data is blocked (S1630).

Thereafter, the packet blocking module 30 corresponds to blocking external transmission / reception of packet data through one or more applications provided in the wireless terminal device 200, and externally through one or more applications provided in the wireless terminal device 200. It is monitored whether transmission / reception packet data occurs (S1640).

In step S1640, when external transmission / reception packet data does not occur in response to blocking external transmission / reception of the packet data in one or more applications provided in the wireless terminal device 200 (S1650), the packet blocking module 30 The process (S1640) is repeated.

In operation S1640, when external transmission / reception packet data is generated in response to blocking external transmission / reception of the packet data in one or more applications provided in the wireless terminal device 200 (S1660), the packet blocking module 30 may include a communication unit. The packet data or packet data information is received from the wireless terminal device 200 through 35 (S1670).

Thereafter, the packet blocking module 30 connects the packet data or the packet data information received by the communication unit 35 through the storage unit 36 with the application information generating the packet data and the packet blocking rule information. In operation S1680, the process is stored on (37).

Thereafter, the packet blocking module 30 analyzes packet data or packet data information stored on the storage medium 37 through the analyzing unit 38 to derive packet pattern information for each application according to the packet blocking rule (S1690).

In addition, the present invention described above may be stored in a computer-readable recording medium produced as a program for execution in a computer, and examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape, Floppy disks, optical data storage, and the like, and also include those implemented in the form of carrier waves (eg, transmission over the Internet).

The computer readable recording medium can be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. In addition, functional programs, codes, and code segments for implementing the control method can be easily inferred by programmers in the art to which the present invention belongs.

The present invention has been described above with reference to preferred embodiments thereof, which are merely examples and are not intended to limit the present invention, and those skilled in the art do not depart from the essential characteristics of the present invention. It will be appreciated that various modifications and applications are not possible that are not illustrated above. For example, each component shown in detail in the embodiment of the present invention may be modified. And differences relating to such modifications and applications will have to be construed as being included in the scope of the invention defined in the appended claims.

Claims

After outputting one or more application list and application file list included in the wireless terminal device, the analysis target application is selected by the user, the character string of the application file for the selected application is extracted, and the pattern analysis of the extracted character string is performed. An application detection module for extracting analysis result information including one or more IP information to which the application accesses, domain name information, and monitoring target API usage status information, and storing the extracted analysis result information on a storage medium;

When at least one event to be generated in a wireless terminal device is controlled to be generated in the wireless terminal device, and external transmission / reception packet data is generated in response to the event occurrence in at least one application provided in the wireless terminal device, the wireless terminal device An event generation module for receiving the packet data or packet data information from the packet, and analyzing the received packet data or packet data information to derive packet pattern information for each application per event;

Generate a packet data blocking rule for one or more applications provided in the wireless terminal device, control the remotely applied packet data blocking rule to the wireless terminal device, and transmit the packet data externally to the one or more applications. Receiving packet data or packet data information generated by the wireless terminal device in response to the blocking, packet blocking for deriving packet pattern information for each application corresponding to a packet blocking rule by analyzing the received packet data or packet data information. And an application packet data pattern detection apparatus having a module.
The method of claim 1, wherein the application detection module,

After compiling the binary format file of the wireless terminal device to the intermediate language or the high-level language, scan the source of the compiled intermediate or high-level language, and then use the server's IP information and port information to be used by the application fixed to the source. And an application packet data pattern detection device for extracting domain name information.
The method of claim 1, wherein the application detection module,

After compiling the binary format file of the wireless terminal device to the intermediate language or the high-level language, scan the source of the compiled intermediate or high-level language, and then use the server's IP information and port information to be used by the application fixed to the source. And extracting domain name information, and in the case of domain name information, additionally querying domain servers of an ISP operator to extract additional IP.
The method of claim 1, wherein the event,

Application install / uninstall operation event, specific application execution event, Restart package event, Touch Event occurrence event, H / W key event occurrence event, LCD On / Off function event, Lock screen release function event, WiFi On / Off function event, 3G network On / Off function event, Bluetooth On / Off function event, GPS operation On / Off (including location search start / end) event, Camera On / Off event, External Storage Read / Write event, Garbage collection occurrence event, SMS notify message occurrence event, Alarm occurrence event, Vibration occurrence event, System time change event, Wireless device status update command occurrence event, System Setting Read / Application packet data pattern detection device including one or more write events.
The method of claim 1, wherein the packet pattern information,

Access information by IP or port or URL by application or by event or packet blocking rule,

The number of times per hour to connect to a specific IP (IP) or port (URL) or URL (URL) per application by event or packet blocking rule,

Polling count information requesting data to a specific IP (IP) or port (Port) or URL (URL) for each event or packet blocking rule, and

Push count information for transmitting data in a specific IP (IP) or port (Port) or URL (URL) or ID (ID) for each event or packet blocking rule, and

Size or capacity information of the data to be sent to a specific IP (IP) or port (Port) or URL (URL) or ID (ID) for each event or packet blocking rule,

Application packet data pattern detection device comprising one or more request and reception information of the user disapproval target data including the advertisement data for each event or packet blocking rule.