WO2014189224A1 - Server apparatus for reducing wireless network load, operating method thereof, and recording medium - Google Patents

Server apparatus for reducing wireless network load, operating method thereof, and recording medium Download PDF

Info

Publication number
WO2014189224A1
WO2014189224A1 PCT/KR2014/004292 KR2014004292W WO2014189224A1 WO 2014189224 A1 WO2014189224 A1 WO 2014189224A1 KR 2014004292 W KR2014004292 W KR 2014004292W WO 2014189224 A1 WO2014189224 A1 WO 2014189224A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
server
policy
application
network
Prior art date
Application number
PCT/KR2014/004292
Other languages
French (fr)
Korean (ko)
Inventor
차양명
Original Assignee
주식회사 아이디어웨어
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to KR10-2013-0056787 priority Critical
Priority to KR20130056786A priority patent/KR20140136604A/en
Priority to KR1020130056785A priority patent/KR20140136603A/en
Priority to KR20130056787A priority patent/KR20140136605A/en
Priority to KR10-2013-0056786 priority
Priority to KR10-2013-0056788 priority
Priority to KR20130056788A priority patent/KR20140136606A/en
Priority to KR10-2013-0056785 priority
Priority to KR1020130088675A priority patent/KR20150014028A/en
Priority to KR10-2013-0088633 priority
Priority to KR1020130088633A priority patent/KR20150014023A/en
Priority to KR10-2013-0088675 priority
Priority to KR10-2013-0088672 priority
Priority to KR1020130088672A priority patent/KR20150014027A/en
Priority to KR20130099229A priority patent/KR20150022063A/en
Priority to KR10-2013-0099229 priority
Priority to KR20130101475A priority patent/KR20150024957A/en
Priority to KR10-2013-0101475 priority
Application filed by 주식회사 아이디어웨어 filed Critical 주식회사 아이디어웨어
Publication of WO2014189224A1 publication Critical patent/WO2014189224A1/en

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W52/00Power management, e.g. TPC [Transmission Power Control], power saving or power classes
    • H04W52/02Power saving arrangements
    • H04W52/0209Power saving arrangements in terminal devices
    • H04W52/0251Power saving arrangements in terminal devices using monitoring of local events, e.g. events related to user activity
    • H04W52/0258Power saving arrangements in terminal devices using monitoring of local events, e.g. events related to user activity controlling an operation mode according to history or models of usage information, e.g. activity schedule or time of day
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00Arrangements for maintenance or administration or management of packet switching networks
    • H04L41/08Configuration management of network or network elements
    • H04L41/0893Assignment of logical groupings to network elements; Policy based network management or configuration
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W24/00Supervisory, monitoring or testing arrangements
    • H04W24/02Arrangements for optimising operational condition
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04WWIRELESS COMMUNICATION NETWORKS
    • H04W88/00Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/18Service support devices; Network management devices
    • YGENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02DCLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THIR OWN ENERGY USE
    • Y02D70/00Techniques for reducing energy consumption in wireless communication networks

Abstract

The present invention relates to a server apparatus for reducing network load and an operating method thereof, and comprises the steps of: collecting network use state information between a communication network and one or more applications included in one or more wireless terminals; linking the collected network use state information with application information, accumulating and storing the linked information in a storage medium, and analyzing the accumulated network use state information for each application stored in the storage medium, so as to acquire network use pattern information for each application; generating network use control policy information on one or more applications to which a policy is applied, through the acquired network use pattern information; and transmitting, to the wireless terminal apparatus or a communication server, the generated network use control policy information on the applications to which the policy is applied and policy information for reducing network load including information on the applications to which the policy is applied.

Description

Server device for reducing wireless network load, its operation method and recording medium

The present invention relates to a network management method and system and a recording medium for reducing the load on a wireless network, and more specifically, to analyze the network usage information of the analysis target application to derive pattern information and to generate and provide appropriate policy information. The present invention relates to a server device for managing a network, a method and system for operating the same, and a recording medium.

Since the spread of smartphones, personal terminal usage patterns have been rapidly shifting from voice calls to data communication.

As shown in the mobile (wireless) data traffic indicator of FIG. 1, mobile traffic is expected to increase by about 26 times over the next 10 to 15 years, and the amount of mobile data used by individuals in 2010 was 15MB, but in 2020 It can reach 1GB.

This increase in mobile traffic directly affects the profitability and service quality of mobile carriers, and involves the expansion of equipment of mobile carriers as service providers. As a result, profit deterioration is inevitable. In addition, service dissatisfaction is increased due to data communication speed delay.

As a result, mobile operators face the challenge of efficiently utilizing network infrastructure to reduce investment and ensure quality of service, and current solutions have limitations, requiring alternatives that guarantee predictability and real-time control.

On the other hand, as shown in Figure 2, the main factor of the mobile network congestion is largely due to the congestion caused by unnecessary network use of the application provided in the wireless terminal device, a large number of wireless terminal devices in a limited area, such as stadium, subway And congestion according to a user's usage pattern.

In conclusion, in order to solve the enormous cost consumption of mobile communication operators and service dissatisfaction of wireless terminal politics users due to network congestion, it is absolutely necessary to control a network usage pattern through a plurality of applications in the wireless terminal device. The time has come, but there is no solution.

Recognition of the problems and problems of the prior art described above is not obvious to those of ordinary skill in the art of the present invention and should not judge the progress of the present invention compared to the prior art based on such recognition. Reveal.

An object of the present invention for solving the above problems is to collect network usage status information between at least one wireless terminal device and at least one application through a communication network, and stores the collected network usage information in connection with the analysis target application information After accumulating and storing on a medium, the network usage pattern information of each analysis target application stored on the storage medium is analyzed to derive network usage pattern information of the analysis target application, and the network usage pattern information is derived through the derived network usage pattern information. A network usage control policy information for an analysis target application (ie, a policy application target application) is generated, and a network including network usage control policy information for the generated policy application target application and the policy application target application information The present invention provides a method and server system for processing policy information for reducing a workload to be transmitted to a wireless terminal device and a communication server, and a recording medium therefor.

In addition, the present invention allows the wireless terminal device to directly control the optimized use of the network through the policy information, thereby reducing the network congestion and service quality improvement of the mobile communication service provider, and at the same time by eliminating network congestion. Improve the user's data communication environment and reduce battery consumption, and enable the comparison result of the network usage information according to before and after applying the network usage control policy information for the user's wireless terminal device. The present invention provides a method and system for enabling the use of a consultation channel and a recording medium therefor.

The technical problem to be achieved in the present invention is not limited to the technical problem mentioned above, and other technical problems not mentioned above may be clearly understood by those skilled in the art from the following description. There will be.

Method according to an embodiment of the present invention for solving the above problems comprises the steps of collecting network usage status information between at least one application and the communication network provided in at least one wireless terminal device; Accumulating and storing the collected network usage state information on application storage information by storing the network usage state information on the storage medium, and obtaining network usage pattern information for each application by analyzing accumulated network usage state information for each application stored on the storage medium; Generating network usage control policy information for at least one policy application object through the obtained network usage pattern information; And processing the generated network usage control policy information for the policy application object and the policy information for reducing network load including the policy application object information to be transmitted to the wireless terminal device or the communication server. .

An apparatus according to an embodiment of the present invention for solving the above problems, the network usage state information between one or more applications and the communication network provided in one or more wireless terminal device, and collects the collected network usage state information application information An analysis server that accumulates and stores on the storage medium and analyzes the accumulated network usage state information for each application stored on the storage medium to obtain network usage pattern information for each application; And generate network usage control policy information for at least one policy application target application through the obtained network usage pattern information, and generate network usage control policy information and policy application target application information for the generated policy application target application. It includes a policy server for processing the policy information for reducing the network load including a transmission to the wireless terminal device or a communication server.

According to an aspect of the present invention, it is possible to derive a network usage pattern for each application provided in the wireless terminal device, and to operate network usage control policy information corresponding to the network usage pattern information of each application.

In addition, by deriving a comparison result of the network usage information before and after applying the network usage control policy information for the user wireless terminal device, it is possible to policyally block or adjust unnecessary execution of bringing the network load for each application. This has the effect of enabling the optimized use of the network in the wireless terminal device.

Another effect according to an aspect of the present invention, it is possible to minimize the network capacity of the mobile communication provider through the optimization of the network use.

Another effect according to an aspect of the present invention, by minimizing the dissatisfaction of the user of the wireless terminal device due to data communication delay, etc. through the optimization of the network use can significantly reduce the battery consumption of the wireless terminal device.

Another effect according to an aspect of the present invention, it is easy to negotiate the network load reduction between the application developer and the mobile communication provider through the network usage pattern information for each application.

1 is a diagram illustrating a mobile (wireless) data traffic indicator.

2 is a diagram illustrating main factors of conventional mobile network congestion.

3 is a diagram illustrating a communication network or network connection according to an embodiment of the present invention.

4 is a diagram illustrating a detailed configuration of an analysis server according to an embodiment of the present invention.

5 is a diagram showing an example of deriving pattern information for each application of a wireless terminal device through an analysis server according to an embodiment of the present invention.

6 is a view showing an example of the pattern information for each application of the wireless terminal device through the analysis server according to an embodiment of the present invention.

7 is a diagram illustrating periodic data polling of various applications installed in a wireless terminal device as a main factor of mobile network congestion.

8 is a block diagram illustrating the configuration of main components of a periodicity detection module according to an embodiment of the present invention.

9 to 12 show a mapping process of each wireless terminal device IP (Internet Protocol) and each server IP / port through the preprocessor.

13 to 14 illustrate examples of packets collected or captured by a collector.

15 is a temporary view illustrating an example of grouping packets through polling modeling in a modeling processor.

16 is a diagram illustrating a data model grouping packets according to an embodiment of the present invention.

17 is a temporary view illustrating an example of grouping packets through modeling by the modeling processor 1613.

18 is a temporary view illustrating an example of grouping packets through modeling by the modeling processor 1613.

19 to 30 are diagrams illustrating pattern detection processes according to an exemplary embodiment of the present invention.

31 to 46 are views for explaining the main configuration and operation of the server grouping module according to an embodiment of the present invention.

47 to 55 are views for explaining the main configuration and operation of the policy server according to an embodiment of the present invention.

56 to 62 are views for explaining the main configuration and operation of a wireless terminal device according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings and description will be described in detail the operating principle of the preferred embodiment of the present invention. However, the drawings and the following description shown below are for the preferred method among various methods for effectively explaining the features of the present invention, the present invention is not limited only to the drawings and description below. In addition, in the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. Terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to intentions or customs of users or operators. Therefore, the definition should be made based on the contents throughout the present invention.

As a result, the technical spirit of the present invention is determined by the claims, and the following examples are one means for efficiently explaining the technical spirit of the present invention to those skilled in the art to which the present invention pertains. It is only.

3 is a diagram illustrating a communication network or network connection of the entire system according to an embodiment of the present invention.

More specifically, in the overall system according to the embodiment of the present invention, the analysis server 100, the policy server 200, the wireless terminal device 300 and the application server 400 by the communication server 500 It may be a system connected to a communication network or a network formed.

The analysis server 100 may analyze the network usage state based on packet information transmitted and received between the wireless terminal device 300 and the application server 400, and output the analysis result as network usage pattern information.

For this purpose, the analysis server 100 may collect packets transmitted and received between the wireless terminal device 300 and the application server 400 to generate network usage status information. The network usage state information may include application information included in the wireless terminal device 300, packet information used to transmit and receive an application included in the wireless terminal device 300 to and from the application server 400, or the information of the wireless terminal device 300. And user usage pattern information.

In addition, the analysis server 100 may generate the network usage pattern information by analyzing the packets collected as the network usage status information. The analysis server 100 may generate network usage pattern information by performing pattern analysis in various ways. For example, the analysis server 100 may perform signal or traffic anomaly detection (Signal or Traffic Surge), DNS analysis, protocol analysis, statistics and call attempt calculation, and the like. Periodic packet detection such as keepalive, polling, or the like, or server grouping according to a packet pattern / signature may be further performed.

Meanwhile, the analysis server 100 may receive network usage state information of a specific analysis target application through a detection application provided in the wireless terminal device 300.

Therefore, the analysis server 100 may generate network usage status information from the collected packets or may receive network usage status information from the wireless terminal device 300.

Accordingly, the analysis server 100 accumulates and stores the network usage state information collected or received on the storage medium 150, and then analyzes the network usage state information stored on the storage medium 150 to analyze the network. Usage pattern information can be derived.

In addition, the policy server 200 generates network usage control policy information for a policy application object by using the derived network usage pattern information, and processes the generated policy to be transmitted to the user wireless terminal device 300 or the communication server 500. do. For example, the network usage control policy information may be transmitted to an application for reducing network load provided in the wireless terminal device 300. The analysis server 100 compares the network usage information before applying the network usage control policy information to the user wireless terminal device 300 and the network usage information after applying the network usage control policy information, and then derives a comparison result. It may be.

In addition, the policy server 200 generates network usage control policy information for each application based on the network usage state information generated by the analysis server 100, and generates the network using at least one wireless terminal device 100. Usage control policy information can be distributed.

In addition, the policy server 200 may be configured with an application for reducing network load (which may be referred to as a policy agent, and may be mixed hereinafter) in order for the network usage control policy information to be applied to the wireless terminal device 300. Interworking can be performed. For example, if the policy agent is not installed, the policy server 200 may induce installation of the policy agent or provide an installation file. In addition, the policy server 200 may store and manage various information such as identification information or policy subscriber information on the policy application target wireless terminal device 300 on which the policy agent is installed.

Although the analysis server 100 and the policy server 200 described above are described as separate servers, they may be provided as separate modules logically divided in one server device. Therefore, the present invention is not limited to the separation of the analysis server 100 and the policy server 200, it is obvious that can be included. For example, the analysis server 100 may be included in the policy server 200, the policy server 200 may be included in the analysis server 100, or the system may be configured as a separate server.

That is, according to the present invention, the analysis server 100 and the policy server 200 is divided into separate configurations, but according to the method of those skilled in the art, the analysis server 100 and the policy server 200 as a single server One or both of the servers may be included in another server, and the policy server 200 may use the network usage pattern information for each application to provide network usage control policy information for the policy application target application. The generating role is to specify that the analysis server 100 may perform the role instead of the policy server 200.

As described above, the policy analysis system for reducing the wireless network load according to the embodiment of the present invention may be configured in various ways according to the implementation method and the communication network connection method.

On the other hand, the wireless terminal device 300 policy information including the policy information for the network load reduction from the policy server 200 through the policy agent-one or more application information and application information for each network application control policy information for each application After receiving-and storing in the storage area 340, and confirms the policy application object information included in the policy information stored on the storage area 340, as a result of the policy application target application is provided in the wireless terminal device If so, the network usage control policy information for the application pre-stored in the storage area 340 is applied to the application, thereby controlling the network usage environment for the application.

According to the present invention, the wireless terminal device 300 may include any terminal device capable of data communication through a network such as a smart phone, a mobile phone, a tablet PC, and telematics.

In addition, after installing the detection application provided by the analysis server 100, the wireless terminal device 300 is provided in the wireless terminal device through the detection application to provide network usage information of at least one analysis target application to the analysis server ( It may also serve to transmit to 100).

In addition, the wireless terminal device 300 may be controlled and managed by the policy server 200. More specifically, the policy server 200 may check policy application object information included in the policy information stored on the storage area 340 of the wireless terminal device 300.

As a result of the check, when a policy application object is provided in the wireless terminal device 300, the policy server 200 applies network usage control policy information for the application previously stored on the storage area 340 to the application. Thus, by performing a function of controlling the network use environment for the application, it is possible to manage the network load reduction application of the wireless terminal device 300.

In addition, the policy server 200 serves to allow the network load reduction application to be installed in the wireless terminal device 300 of the user or directly through a server on a communication network such as an app store, and the user's wireless terminal device. Upgrade of an application for reducing network load installed at 300 may be handled.

In addition, the application server 400 according to the present invention performs a role of operating and managing each application provided in the user's wireless terminal device 300.

On the other hand, the communication server 500 is a network connection between the communication network and each of the components (100, 200, 300, 400), relays data packets between the application server 400 and the wireless terminal device 300, or network use state It can relay information, relay policy information, or transmit domestic / overseas use network information, it may be composed of a plurality of domestic or overseas communication network server.

4 is a diagram showing the detailed configuration of the analysis server 100 according to an embodiment of the present invention.

More specifically, FIG. 4 shows a detailed configuration of the analysis server 100 on the wireless network load reduction policy analysis system shown in FIG. 3, and each configuration is for explaining an embodiment of the present invention. Only the configuration, the present invention is not limited to the technical features only the embodiment shown in FIG.

Referring to FIG. 4, the analysis server 100 according to the embodiment of the present invention includes a management unit 120, a reception unit 130, a storage unit 140, a storage medium 150, and an analysis unit 160. ), A transmission unit 170, a processing unit 180, and a control unit 110 for controlling the respective components.

Here, the analysis server 100 is shown as a single server in the drawings for the purpose of describing the embodiment, each of the means or components may be divided into one or more servers, respectively.

Referring to FIG. 4, the manager 120 manages a detection application installed in the wireless terminal device 300 through interworking with the wireless terminal device 300.

According to the present invention, the management unit 120 is installed in the wireless terminal device 300 through the application distribution server, such as an application store detection application for detecting the network use of one or more analysis target application provided in the wireless terminal device 300 It is further processed to upgrade the detection and reception policy of network usage information to the detection application.

Receiving unit 130 according to an embodiment of the present invention, serves to receive network usage status information.

For example, the receiver 130 may perform a role of collecting or capturing a plurality of packets transmitted and received between the plurality of wireless terminal devices 300 and the plurality of servers 400 through a communication network at the request of the analyzer 160. Can be.

In addition, the receiver 130 may receive network state information of the analysis target application included in the wireless terminal device 300 through a detection application managed through the manager 120.

In addition, the reception unit 130 may be configured to display network usage information of the analysis target application provided in the wireless terminal device 300, network usage information between the wireless terminal device 300 and the application server 400, and the like through the detection application. Received from the wireless terminal device 300 and the application server 400, or from the communication server 500 on the communication network may be further performed.

The storage unit 140 according to an embodiment of the present invention accumulates and stores the network usage state information of the analysis target application received by the receiver 130 on the storage medium 150 in connection with the analysis target application information. It stores the network usage information in the wireless terminal device 300 and the application server 400 on the storage medium 150.

In addition, the storage unit 140, the network utilization information comparison results before and after applying the network usage control policy information for the wireless terminal device 300 and the application server 400 derived through the analysis unit 160. The storage medium 150 may further perform a role of storing.

According to the present invention, when the receiving unit 130 receives the network usage state information of the analysis target application, the storage unit 140 confirms the analysis target application in response to the received network usage state information, and confirms the analysis target. In response to an application, network usage information for each analysis target application may be accumulated on the storage medium 150.

According to the present invention, the storage medium 150 may be provided in the analysis server 100 or in a separate server on a communication network.

In addition, the storage medium 150 may further store the network usage control policy information for each analysis target application that is directly generated by using the network usage state information for each analysis target application in the analysis server 100.

The analysis unit 160 according to an exemplary embodiment of the present invention analyzes network usage information for each analysis target application accumulated and stored on the storage medium 150 to derive network usage pattern information of each analysis target application. Play a role.

According to the present invention, the network usage pattern information of the analysis target application derived through the analysis unit 160 may include pattern information according to pattern analysis of collected or captured packets. For example, the pattern information may include periodicity detection information analyzed by the periodicity detection module 161 or server usage pattern information analyzed by the server grouping module 162. A detailed embodiment of packet collection and pattern analysis of the periodicity detection module 161 and the server grouping module 162 will be described later.

On the other hand, the network usage pattern information derived through the analysis unit 160 is information per hour that the analysis target application is connected to a specific IP (IP) or a port (Port) or URL (URL), and the analysis target application is specified Information on the number of times data is requested by IP or port or URL, and the application to be analyzed by the analysis target server from a specific IP or port or URL or ID Information on the number of times of receiving data, information on the size or capacity of the data transmitted by the analysis target application to a specific IP or port, URL, or ID, and the analysis target application Request and reception information of user disapproval target data including advertisement data, and data allocated to the wireless terminal device by the analysis target application When the communication limit is exceeded, the data communication connection information may include one or more data communication connection information of the analysis target application when the communication network overload of the region where the wireless terminal device is located is set.

In addition, the analysis unit 160 according to the present invention, before applying the network usage control policy information to the user wireless terminal device 300 stored in the storage medium 150 after applying the network usage information and network usage control policy information After comparing the network utilization information, the role of deriving a comparison result, and the application server 500 to which the analysis target application provided in the user wireless terminal device 300 stored in the storage medium 150 is connected After applying the network usage information before applying the network usage control policy information and the network usage information after applying the network usage control policy information, it may further play a role of deriving a comparison result.

5 to 6 show schematic diagrams and examples of deriving network usage pattern information for each analysis target application through the analysis server 100.

According to the present invention, as shown in FIG. 5, the analysis unit 160 analyzes application-specific codes and application-specific network usage rules, which are analysis target application information stored on the storage medium 150, to analyze the respective network usage rules. Pattern information about the application can be derived.

According to an exemplary embodiment of the present invention, the analysis unit 160 may use one or more of the flow extraction module, the packet analysis module, the repetitive packet detection module, the traffic monitor, and the like to access the server list for each function of the analysis target application. Extract flows and function flows, extract packet header / payload information and / or encryption information, analyze protocols automatically, keep-alive or polling cycles and background execution for each application to be analyzed, access server It derives IP and port information about the network, detects the change of the application-signature, protocol, flow, server increase / decrease, etc., and analyzes each one by analyzing one or more advertisement data and traffic statistics. The network usage pattern information for each target application is derived.

In addition, the transmission unit 170 according to the embodiment of the present invention performs the role of transmitting the network usage pattern information for each analysis target application derived through the analysis unit 160 to the policy server 200 on the communication network. do.

That is, the transmission unit 170 is a policy server 200 for establishing a network usage control policy for each application provided in the wireless terminal device 300 through the network usage pattern information for each application to be analyzed, and for each analysis target application. By transmitting network usage pattern information, the policy server 200 may establish a network usage control policy for each application.

In addition, the transmission unit 170, the comparison result of the network usage information before and after applying the network usage control policy information for the user wireless terminal device 300 and the application server 400 derived through the analysis unit 160 May be further transmitted to a server on a communication network.

The processing unit 180 according to an embodiment of the present invention is a configuration that can be made only when the policy server 200 does not generate network usage control policy information. The analysis target application derived through the analysis unit 160 is provided. By using the network usage pattern information of the, it may play a role of directly generating network usage control policy information for the analysis target application.

Technical details of the network usage control policy information generation of the processing unit 180 according to the present invention is applied in the same manner as the technical details of the network usage control policy information generation through the generation unit 230 of the policy server 200 can do.

According to the present invention, all or part of the functions of the respective components provided in the analysis server 100 may be implemented in the form of a program or a program set.

Hereinafter, a pattern analysis embodiment by the periodicity detection module 161 among various pattern analysis methods of the analysis unit 160 according to an embodiment of the present invention will be described.

As shown in FIG. 7, periodic data polling of various applications installed in a wireless terminal device is a major factor in mobile network congestion.

That is, in order for one data polling application to access a server, dozens of data communications, such as the location of a base station, must be preceded and cause connection traffic with the application server even after the communication is connected to the communication network.

These data polling enforcement applications automatically connect to the application server every few minutes to several tens of minutes to check for updated data, causing excessive traffic on the network even if there is no data update on the actual application server. The same process is repeated periodically, which is a major factor in overloading mobile networks.

To summarize the general network communication, if you create an application that communicates with the server, it connects the network with the server, sends and receives the desired data, and then terminates the network with the server.

In general, if you do not send or receive any packets to and from the server while the network is connected, you can consider the network connection as inactive on the server or network after a certain period of time, and forcibly terminate the network in order to clean up resources. For example, a simple chat program describes the problem that occurs when the network is disconnected. When users A and B connect to the server to chat, the server maintains the network connection of A and B, so You can forward to B or forward a message from B to A, but if A disconnects from the server or network for a while, then when B tries to send a message to A, it is already disconnected from A and from server to A You will not be able to deliver the message.

So, even if the user doesn't send a message, small packets are sent to the server periodically to keep the network connection alive. This is called keep alive.

Thus, in order to receive a packet from the server by keeping the network connection alive, if a large meaningless packet is exchanged between the terminal and the server in an excessively short period, a lot of signals are generated, which may cause a load on the mobile network.

On the other hand, when a wireless terminal device requests or receives something from the server to update data such as contents, it is called polling. If the periodic information inquiry, that is, the polling cycle is set too frequently, because the server data is not updated when It can also generate load on the mobile network.

Therefore, under the mobile network, by detecting a periodicity interval in the process of transmitting and receiving a packet between a specific server and the wireless terminal device, a pattern for blocking unnecessary periodic network access to applications included in the wireless terminal device based on the detection result Depending on the necessity of the analysis, the periodicity detection module 161 according to an embodiment of the present invention may be proposed.

8 is a block diagram illustrating the configuration of main components of the periodicity detection module 161 according to an embodiment of the present invention.

In more detail, FIG. 8 is a configuration for detecting a periodicity after collecting or capturing the packets by being connected to a communication network or a network through which a plurality of wireless terminal devices 300 and a plurality of application servers 400 transmit and receive packets. It is shown.

According to an exemplary embodiment of the present invention, the periodicity detection module 161 collects or transmits a plurality of packets transmitted and received between the plurality of wireless terminal devices 300 and the plurality of application servers 400 received from the receiver 130 through a communication network. Capturing and mapping the packet to be collected or captured, and the packet collection or capture time information with each wireless communication device 300 IP and each application server 400 IP / port, which is a packet transmission and reception subject and an object, and a mapping process. And processing one or more data modeling with respect to the mapped packets and grouping them by packet generation pattern, and then mutual lengths of a plurality of data models grouped by packet generation pattern (the last packet of the previous data model and the current data model The sum of the time difference between the first packet and the time difference between the first packet and the last packet in the current data model. Detects similar data models as repeated occurrence pattern types within the error range defined by the time difference between the last packet of the previous data model and the first packet of the current data model or the first and last packet of the current data model. If the detected repeated occurrence pattern type occurs more than n times (one number of n = 2,3,4 ... n) consecutively, and more than n consecutively occurring sections occupy a certain ratio with respect to all sections periodically It plays a role of discriminating by section.

Referring to FIG. 8, the periodicity detection module 161 according to the embodiment of the present invention includes a collector 1611, a preprocessor 1612, a modeling processor 1613, a pattern detector 1614, and a periodicity. The detector 1615 and the confirmer 1616 are included.

Here, the periodicity detection module 161 is illustrated as a single device in the drawings for the purpose of describing the embodiment, but each of the components may be separately configured into one or more devices or servers.

Referring to FIG. 8, the collection unit 1611 receives and collects or captures a plurality of packets transmitted and received between the plurality of wireless terminal devices 300 and the plurality of application servers 400 through a communication unit 130 through a communication network. Play a role.

According to the exemplary embodiment of the present invention, when the wireless terminal device 300 communicates with the application server 400 (game, web, chat, YouTube, etc.), the packet generated by the wireless terminal device 300 is basically Through a network processing device such as a Gateway GPRS Support Node (GGSN) or P-Gateway, it is converted into a TCP / IP protocol and transmitted to a corresponding server 400, which is exchanged between the wireless terminal device 300 and the server 400. Since the packets should be analyzed without causing problems in communication, the collecting unit 1611 may copy the packets, and then transfer the copied packets to the preprocessor 1612. In addition, the communication equipment described above may be implemented in a form that is in-line (IN-LINE) equipment.

The preprocessing unit 1612 according to the present invention is an IP (Internet) of each wireless terminal device 300 which is a packet transmitting and receiving subject and an object of the packet and packet collection or capture time information collected or captured by the collecting unit 1611. Protocol) and each server 300 is connected to the IP / port and performs a mapping process.

Since the communication packets between the wireless terminal device 300 and the server 400 in the communication network are mixed with the communication packets between the various wireless terminal devices 300 and the server 400, the specific wireless terminal device 300 and the specific server ( In order to grasp the periodicity between the packets transmitted and received between 400, the packet must be first classified by the wireless terminal device 300 communicating with the server 400. The collection unit 1611 collects the preprocessing unit 1612. Alternatively, the packet is captured and the packet collection or capture time information is mapped to each wireless communication device 300 IP (Internet Protocol) and each server 400 IP / port, which is a packet transmission and reception subject and an object, and are mapped. .

9 through 12 illustrate a mapping process of each wireless terminal device IP (Internet Protocol) and each server 400 IP / port through the preprocessor 1612.

According to FIG. 9, the packets collected or captured by the collecting unit 1611 are preprocessed by the preprocessing unit 1612, and an IP (Internet Protocol) of each wireless terminal device 300, which is a packet transmitting and receiving subject and an object, and each server 400. ) Shows the mapping process by connecting IP and port.

According to FIG. 10, a server in which a specific wireless terminal device 300 communicates with a specific wireless terminal device 300 by the pre-processor 1612 communicates a plurality of wireless terminal devices 300 with the server 400. In order to classify by 400, a specific wireless terminal device 300 using the IP, PORT of the packet origin and the destination IP, PORT recorded in the packet to send the packet to the server 400, a plurality of packets to the wireless terminal Primary classification may be performed by IP of the apparatus 300, and respective packets may be secondaryly classified by the server 400.

That is, if a packet is sent from the wireless terminal device IP 1.1.1.1, port 10 to the server 400 IP 2.2.2.2, port 20, 1.1.1.1 is recorded in the source field of the IP header of the packet and the destination field is recorded in the destination field. 2.2.2.2 is recorded, and similarly, 10 is recorded in the source of the TCP (or UDP) header and 20 is recorded in the destination.In this way, the origin and destination are recorded in the packet, and the packet is transmitted to various routers or switches. Note that packets are forwarded to another router or switch, so analyzing these fields allows you to classify where these packets come from and where they go.

Here, once again classified by the port (Port) of the server 400, any wireless terminal device 300 [10.1.1.1] to [1.1.1.1 server 400 port 80] communication, [1.1.1.1 Assuming communication with [20 port of server 400], [9999 port of 2.2.2.2 server 400], packets as shown in Figure 11 are generated (network to a specific port of the server 400) When connecting, the port of the wireless terminal device 300 is randomly assigned and does not change as long as the connection is maintained.

In this way, specific applications of the wireless terminal device 300 are connected to various servers 400 to perform their respective tasks, and when these packets are collected or captured by the collector through a base station through a network processing device such as GGSN or P-gateway, etc. Since it is jumbled out as shown in the top picture of Figure 12, this pre-processing unit 1612 is to create the original structure by classifying by IP and PORT as shown in the bottom picture of Figure 12.

In addition, the preprocessor 1612 classifies packets collected or captured through the collector by IP, port, and IP of the wireless terminal device 300. For this purpose, which address is the server 400 and which address It is necessary to know whether the wireless terminal device 300, to determine whether the source IP or the destination IP of the packet of the wireless terminal device 300 IP through the band information of the wireless terminal device 300 in the analysis target wireless network. And the other may be determined as the server 400 IP.

In addition, according to the present invention, the preprocessor 1612 may further perform a role of filtering and excluding a network control packet among a plurality of packets collected or captured by the collector 1611.

In this case, the network control packet may include one or more TCP connection packets, network connection termination packets, reset packets, and acknowledgment packets.

FIG. 13 illustrates an example in which a control packet is included in packets collected or captured by the collector 10.

In other words, assuming that a specific application generates a Keep Alive message at one minute intervals, ideally, the server 400 communicates with the server 400 in a pattern as shown in the upper figure of FIG. As shown in the figure below, various control packets are mixed. In this state, the preprocessing unit 1612 is not able to grasp the period of packets directly transmitted to the server 400 by the wireless terminal device 300 at the time of collecting or capturing the packets. By removing all of the control packets, the wireless terminal device 300 actually leaves only the packets transmitted and received to the server 400.

Referring to the role of filtering the control packet in the pre-processing unit 1612 through the embodiment of Figure 14, first, the specific wireless terminal device 300 is connected to a specific server 400 and sends hello! Listing all packets used to receive! Is the same as before control packet removal in FIG.

In other words, in Figure 14, the user only sends hello! And receives ok !, but the packet is also used for connection establishment (SYN, ACK) and connection termination (FIN, ACK). Various control packets, such as a packet requesting a request and a re-connect connection, are interrupted in the middle. Since these packets are not related to periodicity detection, the preprocessing unit 1612 removes all control packets.

Here, the preprocessor 1612 may determine whether or not the control packet is a control packet if there is no content in the packet.

The modeling processor 1613 according to an exemplary embodiment of the present invention processes one or more data modeling of the packets mapped through the preprocessor 1612 and performs grouping by packet generation patterns.

According to the present invention, the modeling processor 1613 may include a polling model for grouping in a unit of changing a port of the wireless terminal device 300, a time model for grouping packets included within a predetermined time interval, and packet generation. Data modeling may be performed using one or more regional models that are grouped according to the distribution, and a modeling method for grouping packets other than the above-described modeling method may be added.

That is, the modeling processor 1613 primarily groups packets through polling modeling, and then determines whether there is periodicity. If the result of the determination is aperiodic, secondly, the modeling processor 1613 groups packets through second time modeling. If the result of the determination is determined to be aperiodic, in the case of aperiodicity, the modeling may be added step by step by grouping packets through tertiary modeling and determining the periodicity.

FIG. 15 is a temporary view illustrating an example of grouping packets through polling modeling in the modeling processor 1613.

The polling model is a modeling method for a typical polling type of communication. The polling model is a modeling method suitable for a case where the wireless terminal device 300 periodically communicates with the server 400 and transmits and receives data and then terminates the transmission.

Because the port of the wireless terminal device 300 is changed each time the connection is made and disconnected due to the characteristics of the network connection, the modeling processor 1613 groups the given packets in units of changing the port of the wireless terminal device 300.

As shown in the upper picture of FIG. 15, if packets exist in a group, the same ports are sequentially grouped as shown in the following figure, and if the total time or duration of each grouped data model is similar, it can be determined to be periodic. If the ports of the data models are constantly changing, this can be called polling.

16 is a diagram illustrating a data model grouping packets according to an embodiment of the present invention.

Each data model contains the packets belonging to the model and additional information, duration, duration, and total time, which is the time difference between the last packet of the previous data model and the first packet of the current data model. Means the time difference between the first packet and the last packet in the current data model, and the total time means the sum of duration and duration.

The comparison value for determining similarity for each data model may use period or total time.

17 is a temporary view illustrating an example of grouping packets through modeling by the modeling processor 1613.

Temporal modeling is a grouping of temporally adjacent packets into a data model. After specifying a certain time interval, if the current packet and the next packet are within the specified time interval, they belong to the same model. To belong.

As shown in FIG. 17, when the time interval with the previous packet is the same as the upper picture (when the time interval with the previous packet to be assigned to the same group is within 2 seconds), data models as shown in the lower picture are generated.

18 is a temporary view illustrating an example of grouping packets through modeling by the modeling processor 1613.

In the case of time modeling, packets are grouped based on a specified time, while local modeling is a grouping of similarly distributed packets. In the case of the time model described above, slots are created at specific time units to determine whether or not to repeat them. In terms of a somewhat mechanical and strict form of modeling, which determines the periodicity, the regional model is a way to find the periodicity more broadly by grouping 'relatively clustered' packets and separating them from 'relatively separated' packets. will be.

Here, there can be various ways of grouping scattered packets locally. As one example, the minimum duration (the duration of packets grouped in one group), the threshold for branching to another group, and the maximum It consists of three values of duration, and if the duration meets the following conditions, it is considered as a new model.

Duration> = minimum duration and duration> = cumulative duration * threshold) or (cumulative duration> = maximum duration)

Referring to FIG. 18, when the minimum duration is set to 10 seconds, the threshold value is set to 2 times, and the maximum duration is set to 10 minutes, packets can be grouped as shown in the lower figure.

The pattern detection unit 1614 according to an embodiment of the present invention may include a mutual length between a plurality of data models grouped by the packet generation pattern through the modeling processor 30 (the first packet of the previous packet and the current data model). The sum of the time difference between packets and the time difference between the first packet and the last packet in the current data model, or the time difference between the last packet in the previous data model and the first packet in the current data model, or the time difference between the first and last packet in the current data model. ) Detects similar data models as repeated occurrence pattern types within a predetermined error range.

19 to 30 are diagrams illustrating pattern detection processes according to an exemplary embodiment of the present invention.

As shown in FIG. 19, the pattern detector 1614 includes a length (a time difference between the last packet of the previous data model and the first packet of the current data model and belonging to the current data model for the data models grouped by the modeling processor 1613). Patterns between similar data models (pattern A, pattern B, pattern C, etc.) that have a sum of the time difference between the first packet and the last packet, or a period that is the time difference between the last packet of the previous data model and the first packet of the current data model Is detected.

As shown in FIG. 20, the pattern detection unit 1614 specifies ID 1 as the first data model, and compares the total time t values from the first data model to the last model in turn, while the t values of the previous model and the next model are compared. If they are not similar, the ID is increased by 1. If similar, the next model is determined based on the average value of t of the same ID section.

As shown in FIG. 20, in the above example, when the error range is assumed to be 20% and analyzed, t1 and t2 are not similar in length, so ID 2 is assigned to the data model dm2, and t2 and t3 are lengths. Because dm3 is not similar, dm3 specifies ID 3, t3 and t4 are not similar in length, so dm4 gives ID 4, and because t4 and t5 are similar in length, dm5 is assigned the same ID of 4, Since t4 and t5 are the same ID, the similarity with t6 is not found using their average values, so dm6 can be specified as 5 (where, the similarity between the two values can be determined by [(n-1) + error <= n < = (n-1) + error].

FIG. 21 illustrates a form in which an ID is finally assigned after the process in FIG. 20. If an average value of the total time t of data models having the same ID is designated as a pattern of the corresponding data model, FIG.

Thereafter, the pattern detector 1614 aligns the detected patterns in ascending order, as shown in FIG. 23, adds similar patterns, updates the pattern information of the corresponding data model, and finally displays three patterns as shown in FIG. Time 2, total time 29, and total time 61) are detected.

In addition, the pattern detection unit 1614 finds a combination of patterns that can be found in given data models. The pattern detection unit 1614 sequentially uses the method of FIG. 25 for each data model, and manages the found patterns in a pattern combination list.

That is, as shown in FIG. 25, the pattern detecting unit 1614 adds the total time 2 since it is not in the list, and adds the total time 2: the total time 29 because it is not in the list, and the total time 2: the total time 29: the total time. Add 61 because it is not in the list, end because total time 29 exists in the cumulative pattern, add because total time 29 is not in the list, add total time 29: because total time 61 is not in the list, and total time 29 is cumulative Ends because it exists in, and adds because total time 61 is not in the list, adds total time 61: total time 29 because it is not in the list, and ends because total time 29 exists in the cumulative pattern. Ends because the total time 29 exists in the list, and ends because the total time 61 exists in the list. Interval 2: Total time 29, Total time 2: Total time 29: Total time 61, Total time 29, Total time 29: Total time 61, Total time 61, Total time 61: Total time 29] Can be generated.

The periodicity detection unit 1615 according to the exemplary embodiment of the present invention has a pattern number of repeat occurrence patterns detected by the pattern detection unit 1614 n consecutively n times (a number of n = 2,3,4 ... n). If the abnormality occurs, and the section that occurs n or more consecutive times occupies a certain ratio or more than the entire interval serves to determine the periodic interval.

That is, as shown in FIG. 26, the periodicity detector 1615 checks how many areas are distributed for each pattern combination generated by the pattern detector 1614, and as shown in FIG. 27, one or more. If a series of patterns consisting of more than n times occur in succession n times (one of n = 2, 3, 4 ... n), it is determined as a periodic section. If occupied, it is decided as a periodic section.

Of course, if a series of patterns consisting of one or more occurs more than n times (one of n = 2, 3, 4 ... n) in a policy, it may be determined as a periodic section, but at the same time, a periodic section If it occupies more than a certain percentage of the total time, it may be more desirable to determine the interval periodically.

In addition, the periodicity detection unit 1615 according to the present invention may analyze a packet allocated to the section determined as the periodic section and determine whether the corresponding section is a polling periodicity or a keep-alive periodicity section.

That is, the periodicity detector 1615 determines the polling periodicity interval if the port of the packet corresponding to the wireless terminal device 300 continuously changes with respect to the packets stored in the slots existing in the periodically determined interval, and periodically If the port of the packet stored in the slots existing in the determined interval does not change, or if the number of transmit / receive packets is less than n or if the size of the transmit / receive packet is satisfied at least one or more, it is determined as Keep Alive periodicity section. .

The verification unit 1616 according to an embodiment of the present invention uses an IP derived from a domain name system (DNS) protocol analysis and a domain name table to match the IP of the server 400 corresponding to the periodicity interval. It is responsible for verifying domain names.

That is, the periodicity detection unit 1615 finally detects information about the IP and PORT of the specific server 400 periodically and how long the period is, and by this alone, which server 400 the specific server 400 is. Since it is unknown, in order to obtain additional information on the server 400, the domain name derived through DNS protocol analysis is first identified, so that the specific server 400 can be specified.

For example, if the server 400 of 1.1.1.1:80 is detected on a regular basis and the DNS table is checked, it can be assumed that the IP address is www.naver.com.

In addition, according to the present invention, all or a part of the functions of each component provided in the periodicity detection module 161 may be implemented in the form of a program or a program set, and each component includes one or more servers or devices. Can be.

FIG. 28 is a diagram illustrating an entire process according to an embodiment of the present invention, in which one or more data modeling processes are performed on preprocessed packets and grouped by packet generation patterns, and repeated generation of a plurality of data models grouped by packet generation patterns. The pattern type is detected, and the detected repeated occurrence pattern type occurs consecutively more than n times (a number of n = 2,3,4 ... n), or more than n consecutively occurring sections are compared with the entire sections. When one or more of the cases occupy a certain ratio is satisfied, it is determined as a periodic section, and the process of determining the polling section and the keep-alive section by analyzing the packets of the periodic section in which the pattern is continuously found.

29 is a diagram illustrating a periodicity detection process according to an embodiment of the present invention.

First, the periodicity detection module 161 collects or captures a plurality of packets transmitted and received between the plurality of wireless terminal devices 300 and the plurality of application servers 400 in the communication network through the collection unit 1611, the receiving unit 130, Through the preprocessor 1612, the wireless terminal device 300 IP (Internet Protocol), which is a packet transmitting and receiving subject and an object, and the packet collected or captured by the collecting unit 1611 and the packet collecting or capturing time information, respectively. The server 400 connects to the IP / port of the mapping process (S2410).

At this time, the preprocessing unit 1612 of the periodicity detection module 161 filters whether the control packet is included in the packet collected or captured by the collection unit 1611, and then, if the control packet is included, the control packet Can be excluded.

After the process (S2410), the periodicity detection module 161 performs primary data modeling (ex: polling modeling) through the modeling processor 1613 to group by packet generation pattern (S2415).

Thereafter, the periodicity detection module 161 uses the pattern detector 1614 to determine the mutual length between the plurality of data models grouped by the packet generation pattern (the time difference between the last packet of the previous data model and the first packet of the current data model and the current data). The sum of the time difference between the first packet and the last packet in the model, or the time difference between the last packet in the previous data model and the first packet in the current data model, or the time difference between the first and last packet in the current data model, is within a defined margin of error. In step S2420, similar data models are detected as the repeated occurrence pattern type.

Thereafter, the periodicity detection module 161 generates n or more times (a number of n = 2,3,4 ... n) of the detected repetition occurrence pattern type consecutively through the periodicity detection unit 1615, and n If a section that occurs more than one time occupies a predetermined ratio or more than the entire section, it is determined as a periodic section (S2425).

If periodicity is found in step S2425, the periodicity detection module 161 may continue to change the port of the packet corresponding to the wireless terminal device 300 with respect to packets stored in slots existing in the periodically determined section. Determine at least one polling periodicity interval and satisfy at least one case where the port of the packet stored in the slots existing in the periodically determined interval is not changed, the number of transmit / receive packets is n or less, or the size of transmit / receive packets is constant. If it is determined as Keep Alive periodicity interval (S2430).

If the periodicity is not found in step S2425, the periodicity detection module 161 performs secondary data modeling (eg, time modeling) through the modeling processor 1613 to group by packet generation pattern (S2435). ).

Thereafter, the periodicity detection module 161 detects similar data models as a repeating generation pattern type within an error range in which the mutual length between the plurality of data models grouped by the packet generation pattern is determined through the pattern detection unit 1614 (S2440). .

Thereafter, the periodicity detection module 161 generates n or more times (a number of n = 2,3,4 ... n) of the detected repetition occurrence pattern type consecutively through the periodicity detection unit 1615, and n If the section that occurs more than one time occupies a certain ratio or more than the entire section, it is determined as a periodic section (S2445).

If periodicity is found in step S2445, the periodicity detection module 161 executes step S2430.

If the periodicity is not found in step S2445, the periodicity detection module 1616 performs third-order data modeling (ex: region modeling) through the modeling processor 1613 to group by packet generation pattern (S2450). ).

Thereafter, the periodicity detection module 161 detects similar data models as repeated generation pattern types within an error range in which mutual lengths of the plurality of data models grouped by the packet generation pattern are determined through the pattern detection unit 1614 (S2455). .

Thereafter, the periodicity detection module 161 generates n or more times (a number of n = 2,3,4 ... n) of the detected repetition occurrence pattern type consecutively through the periodicity detection unit 1615, and n If a section that occurs more than one time occupies a predetermined ratio or more than the entire section, it is determined as a periodic section (S2460).

If periodicity is found in step S2460, the periodicity detection module 161 executes step S2430.

If the periodicity is not found in step S2460, the periodicity detection module 161 executes fourth-order data modeling through the modeling processor 1613 or sets it as an aperiodic period in step S2465.

Data modeling in the process (S2415), (S2435), and (S2450) may be added or deleted, and the order may be changed.

30 illustrates a polling or keepalive periodicity detection process according to an embodiment of the present invention.

The periodicity detection module 161 analyzes the packets stored in the slots existing in the period set as the periodicity period through the periodicity detection unit 1615 and checks whether the port of the packet corresponding to the wireless terminal device 300 continuously changes. (S2510)

As a result of checking in operation S2510, when a port of a packet stored in slots existing in the periodic interval continuously changes (S2520), the periodicity detector 1615 of the periodicity detection module 161 polls the periodicity interval. Set to section (S2530).

If the ports of the packets stored in the slots existing in the periodic interval do not continuously change (S2540), the periodicity detection unit 1615 of the periodicity detection module 161 sets the periodicity interval as a keepalive periodicity interval. .

Here, although the periodicity detection unit 1615 of the periodicity detection module 161 sets the periodicity period to the keep-alive periodicity period, although not shown in the drawing, transmission and reception packets stored in slots existing in the periodically determined period If the number of times is equal to or less than the preset number or the size of the transmission / reception packet is constant, it may be set as the keep-alive periodicity interval.

Thereafter, the verification unit 1616 of the periodicity detection module 161 matches the IP of the server 400 corresponding to the periodicity interval by using an IP and a domain name table derived through DNS (Domain Name System) protocol analysis. Check the domain name (S2550).

Hereinafter, the server grouping module 162 of the analysis unit 160 according to an embodiment of the present invention will be described in more detail.

<Server Grouping Using Time Adjacency and Other Conditions>

In order to detect a specific service or a specific application causing an overload of a communication network, by grouping servers in which a packet is exchanged for a specific service or a specific application, the server connection of a specific service or a specific application causing an overload can be blocked or controlled. There is a need to do it.

Also, in general, servers providing a specific service or a specific application are often not specified as one, and because a plurality of servers communicate in a complex manner for one application, even if traffic is generated by some servers It is difficult to analyze what kind of application or service this is. Therefore, there is a need to effectively manage servers that cause traffic by grouping them by service or application.

In order to solve this problem, the analysis unit 160 according to an embodiment of the present invention processes the packets causing the overload of the communication network through the server grouping module 162 according to various criteria and types, and an object to which each packet is transmitted. Can identify servers 400 as.

In addition, the server grouping module 162 may group the servers associated with each service or application by grouping the identified servers 400 into a plurality of sets according to predetermined criteria and classifying each group to correspond to a specific service or application. Can be. Accordingly, it is possible to monitor traffic generated by each service or application, or to accurately set a blocking or control policy corresponding to each service or application, thereby enabling efficient traffic management.

In addition, the server grouping module 162 may use various methods in grouping the servers 400, and time-to-packet time proximity may be considered first.

For example, when one wireless terminal device 300 and the application server 400 communicate, when analyzing the packet flow, it is possible to find the transmitted or received packets or patterns of the packet within a predetermined time during the communication process. have. In this case, the server grouping module 162 may identify the IPs of the servers 400 that the wireless terminal device 300 accesses and exchanges packets for a predetermined time based on the time interval between the packets.

Then, the server grouping module 162 may estimate that the wireless terminal 300 is operated by one application to communicate with the servers 400. That is, if there are IPs of the plurality of servers 400 found from adjacent packets in time, the servers 400 may be assumed to belong to the same application.

In addition, the server grouping module 162 collects or captures packets transmitted and received between the plurality of wireless terminal devices 300 and the plurality of servers 400 based on such an estimation, and identifies the servers 400 according to time proximity. Can be grouped The grouped servers 400 may be classified for each service or application according to a predetermined criterion, and traffic monitoring, traffic blocking, or control policy for each service or application may be established based on the classification result.

To this end, the server grouping module 162 may generate the relationship type information by connecting the servers 400 identified from the packets. The relationship type information may be implemented as, for example, a graphic object or data having a plurality of servers 400 as nodes and an edge of a relationship between the servers 400, and the server grouping module 162 may be generated. Store, print, and manage relationship type information.

The server grouping module 162 identifies all servers 400 that have communicated with one wireless terminal device 300 to generate the relationship type information, and repeats this operation for all wireless terminal devices 300. Server pairs for identifying the servers 400 and generating the relationship type information from the communication between the terminal device 300 and the server 400 may be extracted according to time proximity.

For example, the server grouping module 162 collects packets transmitted and received with A and B servers 400 that communicate with one wireless terminal device 300, and packets whose time intervals are within x hours. If they are present in succession, it is assumed that up to a preset y hour is exchanged by one service or application, and the server 400 A and B, which are objects, appear in a pair, y time interval. Two servers). In addition, the server grouping module 162 may aggregate the server pairs throughout the network by expanding it to the entire wireless terminal device 300. As a result, the server grouping module 162 may appear in a specific time interval based on the number of collected server pairs. The number of servers 400 may be identified to calculate the number of relationships between the servers.

Accordingly, the server grouping module 162 generates relationship type information based on the number of collected server pairs, and calculates a relationship diagram between servers based on the relationship type information, thereby grouping highly related servers into each group. You can do it.

On the other hand, if the processing simply depends on the absolute number of server pairs, there may be a problem that the dominant appearing server (for example, Google server, etc.) and other servers all belong to one group, Problems with low reliability may occur.

Accordingly, the server grouping module 162 according to an embodiment of the present invention calculates the relationship diagram based on the number of server pairs in order to calculate a more accurate relationship diagram. Determining the relative degree of relationship between each pair of servers using the number of appearances or the number of absolute time intervals in which the particular server 400 is included may be further performed.

For example, the server grouping module 162 according to an exemplary embodiment of the present invention may detect 100 server pairs between the server n and the server A, and if the number of server A appears in the entire server pair is 10000, the server A to the server A The relative relationship between furnaces can be determined as 0.01, which is 100/10000. On the other hand, if the server grouping module 162 finds 100 server pairs between server n and server A, and the number of server A occurrences in all server pairs is 100, the server n to server A has a relative relationship of 100/100. By choosing 1, the latter can be judged to be more relevant. As a result, it is possible to remove noises caused by specific shared servers that are relatively frequent regardless of the application.

On the other hand, when calculating the relative relationship using the absolute number of server appearances as described above, the relative importance between each server can be estimated, but as the number of server pairs increases, the reliability by improving the number of samples may not be reflected. have.

For example, if the basic relationship (absolute number of occurrences) of the A-n server pair is 200 and the relative relationship is 0.1, and the relationship of the n-B server pair is 10000 and the relative relationship is 0.1, the latter relationship is It is necessary to determine that the reliability of the is higher.

Accordingly, the server grouping module 162 may obtain a statistical relationship value reflecting the sample value by performing an operation of applying the total number of occurrences of each server pair as the sample value to the relative relationship diagram. In addition, the server grouping module 162 may appropriately group the servers 400 based on the statistical relationship value.

Here, the degree of reflection of the total number of appearances (number of samples) of the server pairs with respect to the statistical relationship value may be determined by a predetermined application value. As a method for applying statistical relationship values, various methods using general statistics can be used. For example, the server grouping module 162 may calculate a statistical relationship value with a formula such as (number of samples * relative relationship diagram) / (number of samples + applied value). As the applied value is higher in the above formula, the total number of occurrences of the server pair may be reflected more, and the applied value may be preset by the server grouping module 162.

The server grouping module 162 may finally generate the above-described relationship type information based on the statistical relationship value, and group the plurality of servers by modularizing the relationship type information. As described above, the relationship type information may be generated as graph data having a plurality of servers as nodes and a statistical relationship value as an edge.

Meanwhile, the server grouping module 162 may remove edges having a predetermined value or less from the data of the generated relationship type information. Accordingly, the server grouping module 162 may primarily remove noises having too small a value, and may distinguish optimal server groups from the noise-relational relationship type information.

However, the removed noises need to be used again according to the grouping result later. Accordingly, when grouping is completed through modularization, the server grouping module 162 may further perform the step of analyzing the server pairs connected to the edges removed previously and assigning them to the appropriate server group.

In addition, the above-described relative relationship value and the statistical relationship value may be selectively used in some cases. Therefore, the server grouping module 162 performs server grouping based on the network usage pattern information, but connects the servers that appear in a predetermined time interval from the packets extracted from the network usage pattern information in pairs and counts the pairs. Calculate the relative or statistical relationship value by calculating a relationship number between servers, applying at least one of an absolute number of appearances of each server or an absolute number of appearances of the server pairs to the number of relationships between the servers, and calculating the relative or statistical relationship value The server 400 may be grouped into one or more groups by the relationship type information generated based on a value.

Meanwhile, the server grouping module 162 described above may group the servers 400 in combination with various other methods described below, as well as time adjacentness, and classify them according to applications or services. Specific classification schemes and implementation examples will be described below.

31 is a diagram illustrating the main components of the server grouping module 162 according to the embodiment of the present invention.

In more detail, FIG. 31 illustrates that a plurality of wireless terminal devices 300 and a plurality of servers 400 are connected to a communication network or a network for transmitting and receiving (or exchanging) packets, and then collecting or capturing the packets. The configuration of grouping the server 300 for each application is illustrated.

According to an embodiment of the present invention, the server grouping module 161 collects or captures a plurality of packets transmitted and received between the plurality of wireless terminal devices 300 and the plurality of servers 400 through a communication network, and collects or captures the plurality of packets. Map and process the packet and the packet collection or capture time information (or packet exchange time information) by connecting the identification information of each wireless terminal device 300 which is a packet transmission and reception subject and object and the address information of each server 400. By using the sorted information, the address information of the plurality of servers 400 connected to the mapped packets within the preset time for each wireless terminal device 300 may be sorted according to packet collection or capture time, and by using the sorted information, Packet collection or capture of the first server 300, the second server 300, and the n (n = 3, 4, ... n) server 300 connected to the wireless terminal device 300 within the set time Connect by time, and between each server 300 After counting the number N of the wireless terminal device 300 having the same number or the number N of time intervals in which the wireless terminal device 300 having the same connection between the servers 400 appeared, the counting wireless terminal device was counted. Connection between servers 400 where the number N of 300 or the number N of time intervals in which the wireless terminal device 300 with the same connection between the servers 400 appear is greater than the preset number N ′. It serves to group a plurality of servers 400 constituting a group of the server 400 corresponding to a single service or a single application.

In addition, the server grouping module 162 collects or captures a plurality of packets transmitted and received between the plurality of wireless terminal devices 300 and the plurality of servers 400 through a communication network, and transmits or receives the collected or captured plurality of packets. The extracted signatures and the storage medium 162-26 through a storage medium 162-26 that identify domain names of the server 300, extract signatures of the verified domain names, and store predetermined unique signatures. After comparing the unique signatures previously stored in 26), in response to the comparison result, the extracted signatures are divided, combined, or divided and merged, corresponding to the same signatures among the divided or combined signatures. A grouping of servers 400 into groups of servers 400 corresponding to a single service or single application. To do.

In addition, the server grouping module 162 may match the signatures of the servers grouped through the pattern grouping with one or more of the signatures of the servers grouped through the domain name grouping. It performs a role of complex grouping by moving servers including the signed signature to servers grouped through domain name grouping.

In addition, the server grouping module 162 addresses the addresses of the grouped servers 400 through storage media 162-16 and 162-26 which connect and store one or more server 400 address information for each service or application. Information and address information of the server 400 stored on the storage media 162-16 and 162-26, and as a result of the comparison, at least one of address information of the grouped servers 300 is stored in the storage media 162. When matched with the address information of the server 300 stored on the -16, 162-26, the server 400 matched the grouped server 400 on the storage medium (162-16, 162-26) It performs the role of setting to the server 400 to which the service or application connected with the.

According to the present invention, the server grouping module 162 may further perform a role of filtering and excluding packets transmitted and received in common to a plurality of services or a plurality of applications among the plurality of packets to be collected or captured. The transmitted and received packet may include one or more advertisement packets or charging packets.

In addition, according to the present invention, the server grouping module 162 uses the address information and the domain name table of the server 400 derived through DNS (Domain Name System) protocol analysis, to determine the grouping of the server 400. It may further perform the role of checking the domain name corresponding to the address.

Referring to FIG. 31, a server grouping module 162 according to an embodiment of the present invention may include a packet collecting module 162-105, a pattern grouping module 162-110, and a domain name grouping module 162-120. And a complex processing module (162-130), wherein the pattern grouping module (162-110) includes an alignment unit (162-13), a pattern extraction unit (162-14), and a pattern processing unit (162-). 15, and a storage medium 162-16, the domain name grouping module 162-120 includes a verification unit 162-22, a signature extractor 162-23, and a comparison unit ( 162-24, a signature processor 162-25, and a storage medium 162-26.

Here, the server grouping module 162 is illustrated as a single module 162 in the drawings for the purpose of describing the embodiments, but each of the configuration modules may be separately configured into one or more devices or servers.

In addition, each component of the pattern grouping module 162-110 and the domain name grouping module 162-120 may be formed of a separate component or a common component.

That is, the storage medium 162-16 and the storage medium 162-26 may be configured as a single storage medium, and the pattern extractor 162-14, the signature extractor 162-23, and the pattern processor 162 15 and the signature processor 162-25 may also be configured as a common component.

 Referring to FIG. 31, the packet collection modules 162 to 105 collect or capture a plurality of packets transmitted and received between the plurality of wireless terminal devices 300 and the plurality of servers 400 through a communication network.

As described above, according to an embodiment of the present invention, when the wireless terminal device 300 communicates with the server 400 (game, web, chat, YouTube, etc.), the wireless terminal device 300 is basically The generated packets are converted into Internet protocols such as TCP / IP and forwarded to the corresponding server 400 through a carrier system (eg, a network processing device such as a Gateway GPRS Support Node (GGSN) or a P-gateway). Bar packets should be analyzed without causing problems in the communication between the wireless terminal device 300 and the server 400. The packet collection module 162-105 copies the packet and then collects the duplicated packet. It would be desirable to deliver to modules 162-105. In addition, the communication equipment described above may be implemented in a form that is in-line (IN-LINE) equipment.

In addition, the packet collection module (162-105) according to the present invention, each of the wireless terminal device which is the packet transmitting and receiving the packet and packet collection or capture time information (or packet exchange time information) and the respective subjects and objects 300 is connected to IP (Internet Protocol) and address information (IP / port information, etc.) of each server 400 to perform a mapping process.

As described above, since the communication packets between the wireless terminal device 300 and the server 400 in the communication network are mixed with the communication packets between the various wireless terminal device 300 and the server 400, the specific wireless terminal device 300 In order to grasp the rule between the packets sent and received between the specific server 400 and the packet must be first classified by the wireless terminal device 300 communicating with the server 400, the packet collection module (162-105) Mapping processing is performed by connecting the packet to be collected or captured and the packet collection or capture time information with each packet transmitting / receiving entity and each wireless terminal device IP (Internet Protocol) and each server 400 IP / port. It is.

The mapping process of each wireless terminal device IP (Internet Protocol) IP and each server 400 IP / port through the packet collection module 162-105 as described above is performed in the periodic detection module (see FIG. 10). Since it is similar to that described in operation 161, it will be omitted.

In addition, according to the present invention, the packet collection module 162 to 105 may further perform a role of filtering and excluding packets transmitted and received in common to a plurality of services or a plurality of applications among the plurality of packets to be collected or captured. In this case, the commonly transmitted and received packets may include one or more advertisement packets or charging packets.

On the other hand, the pattern grouping module (162-110) according to an embodiment of the present invention, the packet collection or capture of the address information of a plurality of servers connected to the mapped packets within a predetermined minimum time for each wireless terminal device; Sorting by time and using the sorted information, packets are collected by a first server, a second server, and an n (n = 3, 4, ... n) server connected to a wireless terminal device within a preset time. Or counting the number (N) of time intervals in which the connection between the capture times and the number of wireless terminal devices having the same connection between each server (N) or the wireless terminal device 300 having the same connection between the servers 400 appeared. Thereafter, the number N of the counted wireless terminal devices or the number N of time intervals in which the wireless terminal device 300 with the same connection between the servers 400 appear is greater than the predetermined number N '. A single service or a single application It performs a role of grouping the group of the server corresponding to the illustration, the following, a description for each of the component parts.

The sorting unit 162-13 according to an exemplary embodiment of the present invention collects packet information of address information of a plurality of servers 400 connected to the mapped packets within a predetermined time period for each wireless terminal device 300. Or sort by capture time.

Here, the predetermined time is preferably set in units of a predetermined time length, but may be set in other units according to technological development and modification. According to one embodiment of the present invention, the pattern extracting unit 162-14 may be used. The first server 400, the second server 400, and the n (n = n) are connected to the wireless terminal device 300 within a preset time by using the information arranged by the alignment unit 162-13. 3, 4, ... n) the server 400 is connected to each packet collection or capture time, the number (N) of the wireless terminal device 300 or the server 400 between the same connection between each server 400 The wireless terminal device 300 having the same connection may serve to count the number N of time intervals in which the wireless terminal device 300 appears.

32 to 33 illustrate packet collection or collection of address information of a plurality of servers 400 connected within a predetermined time period for each wireless terminal device 300 through the alignment unit 162-13 and the pattern extraction unit 162-14. The number (N) of wireless terminal devices 300 having the same connection between each server 400 and having the same connection between each server 400 or the number of time intervals in which the wireless terminal device 300 having the same connection between servers 400 appeared ( An example of counting N) is shown.

32 is a graph showing address information of a plurality of servers 400 connected within a preset time for each wireless terminal device 300.

Here, a node represents an address of a server 400 as an element of a relationship in a graph, and the server 400 address is basically an IP address including a port number.

In addition, an edge represents a relationship between nodes and is represented by a pair of two server 400 addresses, that is, "server address A" and "server address B". It is the source node and the server 400 address behind it is the destination node.

In addition, the weight refers to the degree of the relationship between the two nodes, that is, the number of the wireless terminal device 300 calling the server 400 at the same time.

According to FIG. 32, it is shown that the wireless terminal device 300 connects to server B at the same time (ie, within a predetermined minimum time) when connecting to server A, and to server C at the same time after connecting to server B. When connecting with Server A, the number of wireless terminal devices 300 that are connected to Server B is about 5 at the same time, and when connecting with Server B, the number of wireless terminal devices 300 that are connected with Server C is about 7 Shows.

Similarly, according to FIG. 33, if the wireless terminal device 300 is connected to Server A at the same time, the server 300 connected to Server A is composed of Server B and Server D and Server C. Shows the configuration of connecting to Server D, and the configuration of connecting to Server E after connecting to Server D.

In addition, the number of the wireless terminal device 300 connected to the server B at the same time as the server A connected to the server A is 122, the number of the wireless terminal device 300 connected to the server D at the same time almost connected to the server A is two, When connecting with server A, the number of wireless terminal devices 300 connected to server C at almost the same time is nine, and when connecting with server B, the number of wireless terminal devices 300 connecting to server C at almost the same time is 79, server B. 5 shows that the number of the wireless terminal device 300 to be connected to the server D at the same time, and the number of the wireless terminal device 300 to be connected to the server E at the same time almost connected to the server D shows 86.

According to the present invention, the alignment unit 162-13 is connected to each server 400 by the pattern extraction unit 162-14 according to the present invention based on the result of the graph form as shown in FIG. 33. The number (N) of the same wireless terminal device 300 or the connection between the server 400 to count the number (N) of time intervals in which the same wireless terminal device 300 appeared, the pattern according to the present invention Based on the result counted by the processor 162-15, a plurality of servers 400 constituting a connection between servers 300 having a number N of wireless terminal devices 300 greater than a preset number N 'are single. Allows grouping into groups of servers 400 corresponding to a service or a single application.

That is, according to FIG. 33, the pattern extractor 162-14 may determine the number N of the wireless terminal devices 300 having the same connection between the servers 400 in 122, 798, 5, 9, Counting to 2, 86, and assuming that the predetermined number N 'is 50, the pattern processing unit 162-15 is the number preset by the number N counted by the pattern extraction unit 162-14. Server A, Server B, and Server C higher than (N ') can be grouped into one group, and Server D and Server E can be grouped into one group.

The pattern processor 162-15 according to the exemplary embodiment of the present invention has the same number of wireless terminal devices 300 counted by the pattern extractor 162-14 as the number N or the connection between the servers 400. A server corresponding to a single service or a single application includes a plurality of servers 400 constituting a connection between servers 400 in which the number N of time intervals in which the device 300 appears is greater than a preset number N '. Group to 400).

In addition, according to the present invention, the pattern processing unit 162-15 is connected to the one or more server 400 for each service or application, the grouping server 400 through a storage medium 162-16 for connecting and storing the address information. The address information of the server 400 and the address information of the server 400 stored on the storage medium 162-16, and as a result of the comparison, the at least one of the address information of the grouped servers 400 is the storage medium 162-16. When the server 400 matches the address information of the server 400 stored on the server 400, the server or server connected to the grouped servers 400 to which the service or application connected to the matched server 400 address on the storage medium 162-16 is connected. 400 may be further set.

In addition, the pattern processing unit 162-15 corresponds to the addresses of the grouped servers 400 using the domain name table and the address information of the server 400 derived through DNS (Domain Name System) protocol analysis. It can further perform the role of verifying the domain name.

34 to 36 show that the number N of the wireless terminal devices 300 counted by the pattern extracting units 162-14 in the pattern processing unit 162-15 or the same connection between the servers 400 are the same. The server 400 corresponding to a single service or a single application includes a plurality of servers 400 constituting a connection between the servers 400 in which the number N of time intervals 300 is greater than a preset number N '. This is an example of the process of grouping into groups.

Referring to the grouping process of the pattern processing unit 162-15, first, as shown in FIG. 34, after grouping the servers 400 connected within a preset time period for each wireless terminal device 300, each wirelessly, respectively, Grouping for each terminal device 300 is connected by a graph as shown in FIG.

According to FIG. 35, the number of two wireless terminal devices 300 connected to server B at the same time as the server A is connected, and the number of wireless terminal devices 300 connected to the server D at the same time when the server A is connected, One, the number of the wireless terminal device 300 to be connected to the server C almost at the same time when connecting to the server A, the number of the wireless terminal device 300 to be connected to the server C at the same time almost connected to the server B is two The number of wireless terminal devices 300 connected to Server D at the same time as the server B is connected to the server D shows that the number of wireless terminal devices 300 connected to Server E at the same time is two. .

35 is a diagram illustrating a connection of the server 300 through a total of five wireless terminal devices 300 in order to help the understanding of the present invention. When this is expanded, the result as shown in FIG. 34 may be obtained.

On the basis of the graph result in FIG. 35, when the number of wireless terminal devices 300 is two or more, the pattern processing unit 162-15 is configured as one server A, one server B, and one server C as shown in FIG. 36. It can be grouped into groups, and server D and server E can be grouped into one group.

FIG. 37 illustrates a server on a storage medium 162-16 that stores the server 400 grouped by the pattern processor 162-15 by connecting address information of one or more servers 400 for a specific service or a specific application. Compared to the 400, the process of setting the grouped server 400 to the server 400 to which the service or application connected to the matching server 400 address on the storage medium (162-16) Shows.

That is, the address of the server 400 to which a specific application (for example, KakaoTalk) already known on the storage medium 162-16 is connected is server A, server B, and server C. The pattern processor 162- If the group of servers 400 grouped through 15) is Server A, Server B, Server D, Server E, Server F, Server A and Server B of the server 400 group are KakaoTalk on the storage medium 162-16. The matching server A, server B is matched, the server 400 KakaoTalk is connected to not only server A, server B, server C known, but also server D, server E, server F also KakaoTalk The server 400 to be connected can be set.

Here, the storage medium 162-16 may serve to store server 400 address information that is already known or known for each specific service or application.

Here, FIG. 37 sets the servers 400 derived through the pattern grouping to the servers 400 to which the specific service or the specific application is connected, as well as the server 400 derived through the domain name grouping. To set the server 400 to which a specific service or a specific application is connected to, or to the server 400 to which a specific service or a specific application is connected to the server 400 derived through complex grouping. It can be seen as an example in all cases.

By the server grouping method according to the embodiment of the present invention, the server which is the object of the traffic may be grouped by using the time adjacent pattern information of the wired / wireless traffic. In addition, it can be managed by each server group, it is possible to efficiently automate tasks such as attribute assignment, application / service set classification for each group.

Hereinafter, in the server grouping method according to an embodiment of the present invention, an embodiment of deriving a connection relationship between the servers 400 will be described in more detail.

35 to 36, the relationship type information using a graph may be used as basic data for determining whether the connections between the servers 400 are the same. The relationship type information may include at least one of edge information, node information, and weight information as shown in FIG. For example, the pattern processor 162-15 may perform a grouping process using relationship type information generated from the alignment unit 162-13 and the pattern extractor 162-14.

As the smallest unit constituting such relationship type information, a set of one server generated in the same terminal may be exemplified. In addition, the minimum unit generated from the relationship type information may include a set of two server information generated from the same terminal. The set of two servers can be represented as server pairs, and hundreds of such server pairs can be derived in any short time interval. Such a relationship between server pairs may be represented by the relationship type information.

In addition, various graph modeling methods may be used to generate the relationship type information. The graph modeling method can be used, for example, a graph modeling method that connects two server pairs to bundle a wide range (coverage), and connects the maximum number of server pairs that occur frequently to emphasize accuracy. Graph modeling methods may be used. Either way, pairs of closely related servers on the graph can be more likely to belong to the same app.

That is, as shown in FIG. 35, based on the relationship type information between server pairs, a graph having a G = (V, E) shape connected to an edge may be modeled. Each edge may be assigned a weight. The weight of the edge may indicate the degree of relationship and may have a different value depending on how the degree of relationship is specified.

For example, the edge value may be a relative value or an absolute value according to the number of occurrences of the server pair. If an absolute value is specified as the number of times a server pair appears (or the number of intervals) for a terminal, the number of absolute appearances may be high for a server that appears a lot. On the other hand, when there is a need to compare the relationship of the server for the distinction of individual services it may be reasonable to compare with a relative value. This is because the frequency of server pairs can be concentrated around specific and popular servers (e.g. Google Talk server, Android startup server).

In addition, in an embodiment, the total number of correspondences of the communication target server may be considered in determining the edge value as a relative value. For example, if a particular n server is frequently connected to a server with a relatively high frequency such as Google, many other servers in the packet to be analyzed communicate with the Google server, which may cause noise and loss of reliability in the analysis process. . Therefore, in the application of the edge value of the server pair, by using the relative value which uses the total number of communication of the communication target server as the numerator, not the absolute value, the server which has a more important relationship from the position of the n server, that is, the edge of the relationship is high. The server to be assigned a high value can be distinguished from the Google server.

Meanwhile, in an embodiment, in determining the edge value, the magnitude of an absolute parameter (the number of appearing terminals or the number of appearing time intervals) may also be considered. For example, if a relative value for determining an edge value is similar, an operation process using a parameter size as a variable may be added. This can improve the reliability in comparing the relationship between the servers.

In addition, in an embodiment, when the value of the edge is determined, an edge below a certain parameter may be removed from the graph. This is because the inclusion of relatively small edges is more likely to cause noise in the grouped results. This may be semantically the same as removing the occurrence frequency of each server pair below a certain value.

Meanwhile, according to an embodiment of the present disclosure, after the server grouping operation as shown in FIG. 36 is completed, the step of correcting the correction may be further performed. To this end, the server grouping apparatus 100 may perform a correction operation such as grouping servers that are not included in the grouping again by using the original graph G = (V, E) that has not been subjected to noise removal. This is performed by the preprocessing unit 20 to reduce the noise of the communication pattern, so that some servers (ex, periodic servers, higher traffic servers, or servers that constantly change the same IP or port to the same service) are related. This is because a case may be excluded because of lowness.

For example, servers connected to the same group but previously excluded as noise may be included in the group again. Also, depending on the degree of relative relationship, even servers connected to the same server may be created as a new group.

According to one embodiment of the present invention described above, servers in which packet exchange is performed for a specific service or a specific application may be efficiently grouped. In addition, it is possible to efficiently detect a specific service or a specific application that causes an overload of the communication network, and through this, it is possible to block or adjust unnecessary execution that brings network load for each specific service or a specific application. In addition, this enables the optimized use of the network in the wireless terminal device end, and it is possible to minimize the network capacity of the mobile operator through the optimization of the network use.

On the other hand, the domain name grouping module (162-120) according to an aspect of the present invention, to check the domain name of the server that is the transmission and reception subject or object of the plurality of packets collected or captured through the packet collection module (162-105) Extract signatures of the verified domain names, compare the extracted signatures with the signatures previously stored in the storage medium through a storage medium storing predetermined unique signatures, and then correspond to the extracted signature in response to a comparison result; Splitting, merging, or merging after merging, grouping servers corresponding to the same signatures among the splitting or merging or splitting and merging signatures into a group of servers corresponding to a single service or a single application, Hereinafter, each component is demonstrated.

Confirmation unit (162-22) according to an aspect of the present invention, the packet collection module (162-105) performs the role of verifying the domain names of the server 400 that is the subject or object of the transmission and reception of packets collected or captured do.

According to an exemplary embodiment of the present invention, the verification unit 162-22 transmits and receives the packet by using the address information and the domain name table of the server 400 derived through DNS (Domain Name System) protocol analysis. The domain name corresponding to the address of the server 400 as the subject or the object may be checked.

The signature extracting unit 162-23 according to an aspect of the present invention performs a role of extracting signatures of domain names verified through the checking unit 162-22.

In this case, the system extracts only a characteristic part representing the entire domain name and is used as a main key value for grouping the servers 400.

38 is a diagram illustrating an example of extracting signatures of domain names through the signature extractor 162-23.

That is, as shown in FIG. 38, domain names corresponding to 1.1.1.1 to 4.1.1.1 for IP addresses of servers are represented by 'stream.music.naver.com', 'img.music.naver.com', and 'img', respectively. .cafe.naver.com ',' text.cafe.naver.com ',' stream.music.naver.gscdn.com ',' www.daum.co.kr ',' cafe.daum.co.kr ', In the case of 'fow.kr', when the top-level domain is com (generic rule), the signature is extracted to the next top-level domain, 'stream.music.naver.com', 'img.music.naver.com', ' The signatures of the four domain names such as 'img.cafe.naver.com' and 'text.cafe.naver.com' will be 'naver.com'. The top level domain is kr and the top next domain is co, ac,…. In the case of (organization rule), the signatures of two domain names such as 'www.daum.co.kr' and 'cafe.daum.co.kr' are extracted from the signature up to the next next to the top. In other cases (country rule), the signature up to the next highest level is extracted, and the signature of 'fow.kr' becomes 'fow.kr'.

39 is a schematic diagram of a signature extraction process according to an embodiment of the present invention, showing an embodiment of extracting a signature from a domain name.

According to FIG. 39, the signature extraction order is determined differently according to the top-level domain. For example, when the top-level domain is com, a generic rule is defined as a signature. The top-level domain is kr and the top-level next domain is defined. This co, ac,… In the case of (organization rule), the signature is defined as the signature up to the next next to the top. In other cases (country rule), the signature is defined after the top.

Comparator 162-24 according to an embodiment of the present invention, the storage medium (162-26) for storing predetermined unique signatures (eg, gscdn.com, naver.com, apple.com, etc.) By comparing the signatures extracted by the signature extraction unit (162-23) and the unique signatures stored in the storage medium (162-26) through the signature processing unit 162- according to an embodiment of the present invention In response to the comparison result of the comparison unit 162-24, the signature extractor 162-23 divides, combines, or divides the signatures extracted by the signature extracting unit 162-23, and divides, combines, or divides the signatures. The server 400 corresponding to the same signatures among the combined signatures is grouped into a group of the server 400 corresponding to a single service or a single application.

There are domain names that are not mechanically distinct in grouping. For example, the naver.gscdn.com service is run by a global hosting company called gscdn, naver.gscdn. com service should be grouped with the same recognition as music.naver.com.

That is, the signatures extracted through the signature extractor 162-23 are divided and / or combined through the comparator 162-24 and the signature processor 162-25, respectively, and then the final signature is obtained. Is confirmed.

40 and 41 illustrate a process of dividing and combining the respective signatures extracted by the signature extracting unit 162-23 through the comparing unit 162-24 and the signature processing unit 162-25, respectively. One embodiment is also.

40 illustrates a process of dividing, and signatures pre-defined and pre-stored on the storage medium 162-26 are split in order to further refine the signature extracted by the signature extracting unit 162-23. For example, naver.com is further subdivided, and the signature is detailed as music.naver.com and cafe.naver.com, and the segmentation process includes one more domain than the signature that has already been created.

That is, the signatures extracted through the signature extractors 162-23 are 'stream.music.naver.com', 'img.music.naver.com', 'when the top level domain is com (generic rule). The signatures of the four domain names such as img.cafe.naver.com and text.cafe.naver.com were extracted as 'naver.com'. However, after the partitioning process, 'stream.music.naver.com' , 'img.music.naver.com', 'music.naver.com' is confirmed as a more granular signature, 'img.cafe.naver.com', 'text.cafe.naver.com' 'cafe.naver.com' is identified as a more granular signature.

FIG. 41 illustrates a merging process, in which signatures extracted through the signature extractors 162-23 are merged into one signature, for example, music.naver.com and gscdn.com are combined. It can be made as a signature music.naver.com, the representative signature is a representative signature among the signatures previously stored on the storage medium (162-26).

That is, through the division process in FIG. 40, in the case of 'stream.music.naver.com' and 'img.music.naver.com', 'music.naver.com' is determined to be a more detailed signature. Through the merging process in FIG. 41, in the case of 'stream.music.naver.gscdn.com', 'gscdn.com' is previously stored on the storage medium 26 as a proxy server of a global hosting company. The signature of 'stream.music.naver.gscdn.com' is confirmed as 'music.naver.com' except gscdn.

In conclusion, when the process of splitting and merging according to FIGS. 40 and 41 is performed, 'stream.music.naver.com', 'img.music.naver.com', 'stream.music.naver.gscdn.com', etc. Three domain names can be identified with the same signature 'music.naver.com'.

The signature processing unit 162-25 according to an aspect of the present invention may group servers corresponding to the same signatures into a group of servers corresponding to a single service or a single application by using the signatures determined in FIGS. 40 and 41. do.

FIG. 37 described above shows a group of the server 400 grouped by the signature processor 162-25 and stores address information of one or more servers 400 for a specific service or a specific application. Compared with the servers 400, the grouped servers 400 are set as servers 400 to which a service or an application connected with a server 400 address matched on the storage medium 162-26 is connected. Corresponds to the process.

That is, the address of the server 400 to which a specific application (eg, KakaoTalk) already known on the storage medium 162-26 is connected is server A, server B, server C, and the signature processor 162-26. 25, if the group of the server 400 grouped through the server 400 is server A, server B, server D, server E, or server F, server A and server B of the server 400 group are KakaoTalk on the storage medium 162-26. The matching server A, server B is matched, the server 400 KakaoTalk is connected to not only server A, server B, server C known, but also server D, server E, server F also KakaoTalk The server 400 to be connected can be set.

Here, the storage medium 162-26 serves to store server 400 address information that has already been identified or known for a specific service or application, and has predetermined unique signatures (for example, gscdn.com). storage medium (162-26) for storing information such as server, naver.com, apple.com, etc., and storage medium (162-26) for storing address information already known or known by specific service or application Although shown as a medium, the storage medium (162-26) and the predetermined unique signatures (for example, gscdn.com, naver.com) storing the server 400 address information already identified or known for each specific service or application. , apple.com, etc.), the storage medium 162-26 may be configured as a separate storage medium.

Meanwhile, in the complex processing module 162-130 according to an aspect of the present invention, signatures of servers grouped through the pattern grouping module 162-110 are grouped through the domain name grouping module 162-120. If any one or more of the signatures of the servers are matched, the servers containing matching signatures among the servers grouped through the pattern grouping module 162-110 are grouped into the servers grouped through the domain name grouping module 162-120. It moves and performs group processing.

42 illustrates one or more of the servers grouped through the pattern grouping module 162-110 through the complex processing module 162-130 to servers grouped through the domain name grouping module 162-120. Show a case of moving.

That is, four servers, such as 10.1.1.4 (cafe.naver.com) and 10.1.1.1/10.1.1.2/10.1.1.3 (music.naver.com), which are grouped through the pattern grouping module 162-130, are domain names. The domain name group can be expanded by moving to the 'naver.com' server group grouped through the grouping module 162-120.

In addition, FIG. 37 described above shows a specific service or a specific application for a server group that is complex grouped through the complex processing module 162-130 in the pattern processor 162-15 or the signature processor 162-25. Compared to the server 400 on the storage medium (162-16, 162-26) to connect and store one or more server 400 address information, the grouped server 400 to the storage medium (162-16, The process of setting the server 400 to which the service or application connected to the matched server 400 address on the 162-26 may be matched.

43 is a diagram illustrating a server 400 pattern grouping primary process according to an embodiment of the present invention.

First, the server grouping module 162 collects or captures a plurality of packets transmitted and received between the plurality of wireless terminal devices 300 and the plurality of servers 400 in a communication network through the packet collection module 162-105 (S1610).

Subsequently, the server grouping module 162 transmits the packet to be collected or captured and the packet collection or capture time information (or picket exchange time information) through the packet collection module 162 to 105, respectively. The wireless terminal device 300 maps the identification information (for example, IP information) and the address information (for example, IP / port information) of each server 400 to perform mapping processing (S1620).

In this case, the packet collection modules 162-105 of the server grouping module 162 determine filtering of common packets that are commonly transmitted and received to a plurality of services or a plurality of applications on the packets to be collected or captured, and if the common packets exist, The common packet is excluded (S1630).

After the step S1630, if the common packet filtering process is omitted (S1640), the server grouping module 162 may determine the mapped packets by the wireless terminal device 300 through the alignment unit 162-13. Address information of a plurality of servers 400 connected within a preset time is sorted by packet collection or capture time (S1650).

Subsequently, the server grouping module 162 uses the information arranged by the alignment unit 162-13 through the pattern extractor 162-14 to connect the wireless terminal device 300 within a preset time. The first server 400, the second server 400, and the nth (n = 3, 4, ... n) server 400 are connected for each packet collection or capture time (S1660).

44 is a diagram illustrating a server 400 pattern grouping secondary process according to an embodiment of the present invention.

First, the server grouping module 162 uses the pattern extractor 162-14 to wirelessly connect the same number of wireless terminal devices 300 or the same connection between the servers 400 to each server 400. The terminal device 300 counts the number N of time intervals in which the terminal device 300 appears (S1710).

Subsequently, the server grouping module 162 uses the pattern processor 162-15 to connect the number N of the wireless terminal devices 300 counted in the process S1710 or the wireless terminal device having the same connection between the servers 400. In operation S1720, the connection between the servers 300 in which the number N of the time intervals in which the 300 appears is greater than the predetermined number N 'is determined. The preset number N 'may be set to a relative value corresponding to the number of connections between other servers rather than an absolute value. For example, in determining the N 'value, the server grouping apparatus 100 may check the number of different server-to-server connections (server pairs) and determine the relative value with respect to the number.

The number (N) of the wireless terminal device 300 counted in step S1720 or the number N of time periods in which the wireless terminal device 300 having the same connection between the server 400 appears is set in advance ( N ') is less than a group, the number (N) of counted wireless terminal device 300 or the number of time intervals in which the wireless terminal device 300 with the same connection between servers 400 appeared (N) If greater than or equal to the preset number (N ') (S1740), the server grouping module 162 is the number (N) or server (number of wireless terminal device 300 counted through the pattern processing unit 162-15) A single service is provided to a plurality of servers 400 that form a connection between servers 400 in which the number N of time intervals in which the wireless terminal device 300 with the same connection is identical is greater than the preset number N '. Or group into a group of the server 400 corresponding to a single application (S1750).

Subsequently, the pattern processing unit 162-15 of the server grouping module 162 connects the grouped server 400 through the storage medium 162-16 to connect and store one or more server 400 address information for each service or application. ) Is compared with the address information of the server 400 stored on the storage medium (162-16) (S1760).

If the address information of the grouped servers 400 and the address information of the server 400 stored on the storage medium 162-16 match in step S1760, the grouped server ( 400 are set to the servers 400 to which the service or application connected with the matched server 400 address on the storage medium 162-16 (S1770).

Subsequently, the pattern processor 162-15 of the server grouping module 162 uses the address information and the domain name table of the server 400 derived through DNS (Domain Name System) protocol analysis. Check the domain name corresponding to the address of the (S1780).

Here, the process (S1780) may be included in the process (S1750) or any process.

In addition, the steps S1760 to S1780 may be applied to servers excluded from the complex grouping through the complex processing modules 162 to 130.

45 illustrates a server domain name grouping process according to an embodiment of the present invention.

First, the server grouping module 162 collects or captures a plurality of packets transmitted and received between the plurality of wireless terminal devices 300 and the plurality of servers 400 in the communication network through the packet collection module 162-105 (S1810).

Subsequently, the server grouping module 162 confirms domain names of the servers 400 that are the transmitting and receiving subjects or objects of the packet collected or captured by the packet collecting module 162-105 through the checking unit 162-22 ( S1820).

In this case, the verification unit 162-22 of the server grouping module 162 uses the address information and the domain name table of the server 400 derived through DNS (Domain Name System) protocol analysis to transmit and receive the packet. Alternatively, the domain names corresponding to the addresses of the servers 400 as objects may be checked.

Thereafter, the server grouping module 162 extracts the signatures of the domain names checked by the verification unit 162-22 through the signature extraction unit 162-23 (S1830).

Subsequently, the server grouping module 162 uses the comparison unit 162-24 to extract the signatures and the predetermined unique signatures (eg, gscdn.com and naver.com) extracted by the signature extractor 162-23. , apple.com, etc.) are compared with the pre-stored unique signatures on the storage medium (162-26) (S1840).

In the case of (S1840), when any one or more of the unique signatures previously stored on the comparison result storage medium (162-26) match the signatures extracted by the signature extractor (162-23) (S1850), the server The grouping module 162 performs the process of dividing, merging, or merging the signatures extracted by the signature extracting units 162-23 through the signature processing unit 162-25 (S1860).

Subsequently, the server grouping module 162 uses the signature processing unit 162-25 to divide the servers 400 corresponding to the same signatures among the split or merged or split and merged signatures into a server corresponding to a service or an application ( Grouping to a group of 400 (S1870).

In the process (S1840), if any one or more of the signatures previously stored on the comparison result storage medium (162-26) does not match the signatures extracted by the signature extractor (162-23) (S1880). The server grouping module 162 performs a group of the server 400 corresponding to the service or the application to the servers 400 corresponding to the signatures extracted by the signature extracting units 162-23 through the signature processing unit 162-25. Grouping to (S1870).

Although not separately illustrated in the drawings, the server grouping module 162 is a server 400 grouped through the signature processing unit 162-25 for servers excluded from the complex grouping through the complex processing module 162-130. The respective address information of the group is compared with the servers 400 on the storage medium 162-26 which connect and store one or more server 400 address information by specific services or by specific applications. The servers 400 are set as servers 400 to which a service or an application connected with address information of the servers 400 matched on the storage medium 162-26 is connected.

46 illustrates a complex grouping process according to an embodiment of the present invention.

First, the server grouping module 162 includes the signatures of the servers grouped by the pattern grouping module 162-110 through the complex processing module 162-130 and the servers grouped by the domain name grouping module 162-120. The signatures are compared (S1910).

As a result of the comparison of S1910, when signatures matching the signatures of the servers grouped by the domain name grouping module 162-120 are present among the signatures of the servers grouped by the pattern grouping module 162-110 ( In operation S1920, the complex processing module 162-130 groups the servers including a signature matched among the servers grouped through the pattern grouping module 162-110 through the domain name grouping module 162-120. The server processes the grouping process by moving to the server (S1930).

Subsequently, the server grouping module 162 performs a specific service for a server group that is complex-grouped by the complex processing module 162-130 through the pattern processor 162-15 or the signature processor 162-25. The address comparison is performed with the servers 400 on the storage media 162-16 and 162-26, which connect and store one or more server 400 address information for a specific application (S1940).

If, as a result of comparing (S1910), among the signatures of the servers grouped in the pattern grouping module (162-110), there is a signature that matches the signatures of the servers grouped in the domain name grouping module (162-120) If not (S1950), the process (S1930) is omitted and go straight to (S1940).

Thereafter, the server grouping module 162 processes the complex grouping server 400 in response to a comparison result through the process (S1940) through the pattern processing unit 162-15 or the signature processing unit 162-25. The server 400 is connected to a service or an application connected to the matched server 400 address on the storage mediums 162-16 and 162-26 (S1960).

47 is a diagram showing the detailed configuration of a policy server 200 according to an embodiment of the present invention.

In more detail, FIG. 47 illustrates a detailed configuration of the policy server 200 on the wireless network load reduction policy analysis system illustrated in FIG. 3, and each configuration is for explaining an embodiment of the present invention. The present invention is only limited to the technical features of the embodiment shown in FIG.

Referring to FIG. 47, the policy server 200 according to the embodiment of the present invention includes a receiver 220, a generator 230, a storage 240, a storage medium 250, and a processor 260. ), A transmission unit 270, an update unit 280, and a control unit 210 for controlling the respective components.

Here, the policy server 200 is illustrated as a single server in the drawings for the purpose of describing the embodiments, but each means or component may be separately configured into one or more servers.

Referring to FIG. 47, the receiver 220 performs a role of receiving network usage pattern information on an analysis target application (ie, a policy application target application) through the analysis server 100.

The generation unit 230 according to an exemplary embodiment of the present invention plays a role of generating network usage control policy information for a policy application target application by using the network usage pattern information for each application received by the receiver 220. .

According to the present invention, the generation unit 230, the number of times per hour that the policy application target application that is the network usage pattern information of the policy application target access to a specific IP (IP) or port (Port) or URL (URL) And information on the number of times that the policy application application requests data to a specific IP or port or URL, and the policy application application is specified from a server to a specific IP or port. Or information on the number of times data is received by URL or ID and data transmitted by the application to which the policy is applied to a specific IP or port or URL or ID. Size or capacity information, request and reception information of user disapproval target data including the advertisement data by the policy application, and the When a book application target exceeds a data communication limit assigned to the wireless terminal device, data communication connection information and a data communication connection of the policy application target application are set when the network overload of the region where the wireless terminal device is located is set. After checking one or more pieces of information, network usage control policy information according to each pattern-policy information for adjusting the number of times to connect to a specific IP or a port or URL, and a specific IP. Or policy information for adjusting the number of times to request data from the port (URL) or URL (URL), and receives data from the server to a specific IP (Port) or URL (URL) or ID (ID) Policy information to adjust the number of times, and the size or capacity of data transmitted to a specific IP (IP) or port (Port) or URL (URL) or ID (ID) Policy information to be adjusted, policy information to block the request and reception of user disapproval target data including advertisement data, and policy information to block data communication connection when the data communication limit assigned to the wireless terminal device is exceeded. And policy information including one or more policy information for blocking a data communication connection when the communication network overload of the region where the wireless terminal device is located is set.

For example, the network usage control policy information generated by the generation unit 230 is as follows.

<xml version "1.0" encoding = "UTF-8">

<policy>

<description> Rules for block app </ description>

<rule>

<rule_id> T_2012_B_02_103030_P2 </ rule_id>

<rule_act> B_03_P_01 </ rule_act>

<app_id> T_2012_A_08_2089_K2_09_3092 </ app_id>

<target_ip> 192.168.0.255 </ target_ip>

<port> 80 </ port>

<refresh> 30 sec </ refresh>

</ rule>

<sign> e5c6e5ccec361baebcf79859e49c5526 </ sign>

</ policy>

In the above policy case, "<rule_id> T_2012_B_02_103030_P2 </ rule_id>" defines the policy value, which is the 2012 Application Network Blocking Policy (B02), the policy administrator's permission is 103030, and the policy application priority is P2 level. have.

Here, the "<rule_id> T_2012_B_02_103030_P2 </ rule_id>" is replaced with "<rule_id> T_2012_P_02_103030_P2 </ rule_id>" used as the 2012 application network polling policy (P02), or the 2012 application network loopback policy (L05). The policy manager may be replaced with " <rule_id> T_2012_L_05_103030_P3 </ rule_id> ", which specifies that the policy administrator's authority is 103030 and the policy application priority is P3 level.

In addition, "<rule_act> B_03_P_01 </ rule_act>" indicates that the policy enforcement method is applied immediately. "<App_id> T_2012_A_08_2089_K2_09_3092 </ app_id>" indicates that the policy application application ID (ID) is from "A_08_2089_K2" to "09_3092." "Means that the policy application mask value is K2.

In addition, "<sign> e5c6e5ccec361baebcf79859e49c5526 </ sign>" is a value for verifying the integrity of the policy information to check whether the policy document has not been tampered with while traveling through the network, and "<target_ip> 192.168.0.255 </ target_ip>" , "<port> 80 </ port>" means 192.168.0.255 and the port is 80 for blocking.

In addition, "<refresh> 30 sec </ refresh>" means setting the refresh timeout to 30 sec. In this case, the proxy / cache server for the corresponding packet is used. In this case, the user's wireless terminal device ( In step 300, the request packet transmitted to the network is transmitted to the proxy / cache server every 30 sec.

In this case, a method of forwarding by the wireless terminal device 300 of the user, a method of forwarding, registering a corresponding detour information in the DNS server, or a method of dynamically / statically changing the routing table for a specific IP address to be used For example, an unconditional forwarding method using the user's wireless terminal device 300 may be used as a blacklisting policy for a malicious malicious service / packet.

The above described policy information is merely an example, and may be formed in various forms according to the nature or type of the policy.

The storage unit 240 according to an exemplary embodiment of the present invention connects the network usage control policy information of the policy application target application generated by the generation unit 230 with the policy application target application information on the storage medium 250. It serves to store in.

According to the present invention, the storage unit 240 updates the network usage control policy information for the policy application target application stored on the storage medium 250 whenever the network usage control policy information for the policy application target is updated. Save it.

The storage medium 250 according to an embodiment of the present invention serves to connect and store network usage control policy information about one or more policy application target applications stored through the storage unit 240 and the policy application target information. Do this.

According to the present invention, the storage medium 250 may be provided in the policy server 200 or in a separate server on a communication network.

In addition, the storage medium 250 may further store network usage pattern information for the policy application target application received by the receiver 220.

The processor 260 according to an exemplary embodiment of the present invention may include a policy for reducing network load including network usage control policy information for the policy application target application and the policy application application information stored on the storage medium 250. It serves to process the information to be transmitted to the network load reduction application provided in the user wireless terminal device (300).

The transmission unit 270 according to the embodiment of the present invention performs the role of processing the policy information to be transmitted to the network load reduction application provided in the user wireless terminal device 300 in conjunction with the processing unit 260.

The update unit 280 according to the embodiment of the present invention, when the network use control policy information for the policy application target is changed, the network for the changed policy application application in conjunction with the network load reduction application. It handles the upgrade of the usage control policy information.

According to the present invention, all or part of the functions of the respective components provided in the policy server 200 may be implemented in the form of a program or a program set.

48 is a diagram illustrating an example of operating policy information through the policy server 200 according to an embodiment of the present invention.

According to FIG. 48, the policy server 200 provides network usage control policy information (policy information for network control such as data polling and keepalive) for the weather information providing application included in the wireless terminal device. By generating and transmitting to the network load reduction application provided in the wireless terminal device, it shows that unnecessary data transmission and reception of the weather information providing application is blocked.

49 is a diagram illustrating an effect of network usage control using policy information according to an embodiment of the present invention.

Referring to FIG. 49, in a wireless terminal device before and after applying a policy in response to network use control using network usage control policy information (background call connection blocking policy information every 10 minutes) through a network load reduction application included in the wireless terminal device. Traffic reduction effect. In FIG. 49, each rectangle represents a period, which may be, for example, three minutes.

50 is a diagram illustrating a policy operation process through the policy server 200 according to an embodiment of the present invention.

First, the policy server 200 receives network usage pattern information for an analysis target application through the receiver 220 (S1110).

Thereafter, the policy server 200 generates network usage control policy information for the policy application target application by using the network usage pattern information of the analysis target application received by the receiver 220 through the generation unit 230. (S1120).

According to the present invention, the generation unit 230, the number of times per hour that the policy application target application that is the network usage pattern information of the policy application target access to a specific IP (IP) or port (Port) or URL (URL) And information on the number of times that the policy application application requests data to a specific IP or port or URL, and the policy application application is specified from a server to a specific IP or port. Or information on the number of times data is received by URL or ID and data transmitted by the application to which the policy is applied to a specific IP or port or URL or ID. Size or capacity information, request and reception information of user disapproval target data including the advertisement data by the policy application, and the When a book application target exceeds a data communication limit assigned to the wireless terminal device, data communication connection information and a data communication connection of the policy application target application are set when the network overload of the region where the wireless terminal device is located is set. After checking one or more pieces of information, network usage control policy information according to each pattern-policy information for adjusting the number of times to connect to a specific IP or a port or URL, and a specific IP. Or policy information for adjusting the number of times to request data from the port (URL) or URL (URL), and receives data from the server to a specific IP (Port) or URL (URL) or ID (ID) Policy information to adjust the number of times, and the size or capacity of data transmitted to a specific IP (IP) or port (Port) or URL (URL) or ID (ID) Policy information to be adjusted, policy information to block the request and reception of user disapproval target data including advertisement data, and policy information to block data communication connection when the data communication limit assigned to the wireless terminal device is exceeded. And policy information including one or more policy information for blocking a data communication connection when the communication network overload of the region where the wireless terminal device is located is set.

Thereafter, the policy server 200 connects the network usage control policy information of the policy application target application generated by the generation unit 230 to the policy application target application information through the storage 240 and the storage medium 250. Store on the (S1130).

Thereafter, the policy server 200 includes network usage control policy information and the policy application target application information for the policy application target application stored on the storage medium 250 through the processor 260 and the transmitter 270. Policy information for reducing the network load is processed to be transmitted to the network load reduction application provided in the user's wireless terminal device (S1140).

Then, when the network usage control policy information for the policy application target application is changed (S1150), the policy server 200 for the policy application target application previously stored on the storage medium 250 through the update unit 280. After upgrading the changed items of the network usage control policy information, the changed policy information through the processing unit 260 and the transmission unit 270 is transmitted to the network load reduction application provided in the user's wireless terminal device 300. (S1160).

Meanwhile, the policy server 200 may identify the wireless terminal device 300 that initiates the connection to the overseas communication network through information exchange with the communication server 500, and may policyly block network access through indiscriminate overseas roaming of applications. .

For example, the policy server 200 according to an embodiment of the present invention uses actual applications due to data polling, keepalive maintenance, etc. through a number of applications provided on a smartphone by users traveling or traveling abroad. It can solve the problem of paying a large amount of communication fees due to the use of overseas data, and provide a policy control service that enables users to smoothly control and adjust the use of the network abroad without the user having to block data communication. .

In more detail, the network load reduction policy operating system including the policy server 200 as described above in FIG. 3 includes a plurality of communication servers 500 and a user's wireless terminal device 300 and a domestic communication network. And the domestic communication network is connected to an overseas communication network, thereby controlling network connection of applications to the wireless terminal device 300 for initiating connection to an overseas communication network.

The domestic communication network according to the present invention serves to process data communication between the user wireless terminal device 300 and the communication server 500 and / or policy server 200, and serves to process data communication with the overseas communication network, It includes various equipment and devices of mobile communication system such as base station, switching center for data communication processing.

In addition, the overseas communication network according to the present invention includes a variety of equipment and devices of the mobile communication system that the user wireless terminal device 300 is connected abroad, and processes data communication generated in the user terminal device, and with the domestic communication network Handle data communication.

When the policy server 200 of the policy management system according to the present invention receives the identification information of the wireless terminal device 300 of the user initiating the overseas communication network connection from the communication server 500 on the communication network, the customer information management system of the communication company. First, confirm that the wireless terminal device 300 corresponding to the received wireless terminal device 300 identification information of the user is the wireless terminal device 300 subscribed to the unlimited data roaming service, and as a result, the unlimited data roaming service If the wireless terminal device 300 is not subscribed to, the overseas communication network through the storage medium 250 for connecting and storing the wireless terminal device identification information and the policy agent identification information provided in the wireless terminal device 300; After confirming the policy agent identification information installed in the wireless terminal device 300 corresponding to the identification information of the wireless terminal device 300 for initiating the connection, the identified policy agent identification information is determined. It serves to process such that the policy agent transport network using policy information block is performed corresponding to the.

Here, the network use blocking policy information may include, for example, policy information for blocking network access to all other applications except for a predetermined specific application among a plurality of network using applications provided in the wireless terminal device 300 and the wireless terminal device. Policy information for blocking a specific network connection type (eg, periodic data polling, background execution, keepalive, etc.) for all other applications except for a predetermined one of the plurality of network using applications provided in the 300. And, if the user wireless terminal device 300 is connected to the Wi-Fi, the network use blocking policy includes one or more policy information is temporarily released.

According to an aspect of the present invention, the network use blocking policy information is policy information for blocking network access to the remaining applications except for a predetermined specific application among a plurality of network using applications provided in the wireless terminal device 300. In this case, the wireless terminal device 300 having received the network use blocking policy information automatically blocks network access to the remaining applications except for a specific specific application among a plurality of network using applications.

Here, in the present invention, the term "automatically" means that when the network access to the application is blocked by network use blocking policy information, requesting user approval for network access blocking on the screen before the network access is blocked. It also prints the screen, and includes a means to automatically disconnect the network after user approval is selected.

Likewise, even if the network access to the application is released according to the network use blocking policy information, a screen for requesting user approval for network disconnection is displayed on the screen before the network access is unblocked, and the user approval is selected. After that, it automatically unblocks network access.

In addition, according to another aspect of the present invention, the network use blocking policy information is a specific network access to all other applications except for a predetermined specific application among a plurality of network use applications provided in the wireless terminal device 300; In the case of the policy information to block the form, the wireless terminal device 300 receiving the network use blocking policy information may perform a specific network connection type such as periodic data polling, background execution, and keepalive maintenance for the remaining applications except for the specific application. Will automatically shut off.

In addition, according to another aspect of the present invention, when the network use blocking policy information is policy information for temporarily canceling a network use blocking policy when the user wireless terminal device 300 is connected to Wi-Fi, the network use blocking In the wireless terminal device 300 receiving the policy information, the communication network where data communication fees are paid, such as 3G network, LTE network, or 4G network, is blocked so that the use of the network through an application is blocked. It will automatically disable the use block.

According to an aspect of the present invention, the policy server 200, when receiving the identification information of the wireless terminal device 300 of the user terminating the connection to the overseas communication network from the communication server 500 on the communication network, the wireless terminal device 300 (B) confirming whether the network use blocking policy information is transmitted to the wireless terminal device 300 corresponding to the identification information, and if the wireless terminal device 300 transmits the network use blocking policy information, the storage medium is stored. After confirming the policy agent identification information installed in the wireless terminal device 300 in response to the identification information of the wireless terminal device 300, the network use blocking policy information is transmitted to the policy agent corresponding to the checked policy agent identification information. It performs more of the processing if possible.

Here, the network use release policy information may be information for releasing the network use restrictions in the wireless terminal device 300 that was blocked through the network use block policy information.

According to another aspect of the present invention, the policy server 200, the application identification information allowing the use of the network, regardless of initiating the connection to the overseas communication network is transmitted to the policy agent provided in the wireless terminal device 300 You can play more roles if you can.

Communication server 500 according to an embodiment of the present invention, the role of processing data communication relay between the wireless terminal device 300 and the application server 400, and the wireless terminal device through a domestic communication network connected to an overseas communication network ( After receiving the overseas communication network connection start information of 300, it may serve to transmit identification information of the wireless terminal device 300 for initiating the overseas communication network connection to the policy server 200.

In addition, the communication server 500 is connected to the overseas communication network after receiving the end of the overseas communication network connection termination (for example, the connection termination by moving from overseas to the domestic) of the wireless terminal device 300 through the domestic communication network It may serve to transmit the identification information of the wireless terminal device 300 to terminate the policy server 200.

The wireless terminal device 300 according to the embodiment of the present invention performs a network connection to the application server 400 and has a policy agent, and receives a network use blocking policy received from the policy server 200 through a policy agent. Through the information and the network use blocking policy information, it may serve to control network connection (or background call connection, etc.) of a plurality of applications provided in the wireless terminal device 300 by itself.

In addition, the wireless terminal device 300 stores application identification information allowing use of a network in advance in a storage area irrespective of initiation of an overseas communication network connection, and initiates an access to an overseas communication network, and then receives it from the policy server 200. When executing the network use blocking policy information, it may further play a role of excluding an application corresponding to the network use permission application identification information pre-stored in the storage area among a plurality of network use applications.

In addition, the wireless terminal device 300 may check whether the connected communication network is an overseas communication network or a domestic communication network by itself, and confirms the start and end of the connection to the overseas communication network. Process the overseas communication network connection start information to be transmitted to the communication server 500 on the domestic communication network together with the identification information of the wireless terminal device 300 via the communication server 500. The overseas network connection termination information and the wireless terminal 300 identification information are transmitted to the communication server 500 through the communication network.

In addition, when the wireless terminal device 300 confirms that the immediately connected communication network was an overseas communication network and changed to a domestic communication network, the wireless terminal device 300 may release the network connection to the application itself.

According to the present invention, the wireless terminal device 300 includes all terminal devices capable of wireless communication, such as mobile phones, smart phones, tablet PCs.

Application server 400 according to an aspect of the present invention, serves to process data transmission and reception when the network connection of the application provided in the user wireless terminal device 300.

Customer information management system according to an aspect of the present invention may be included in the communication server 500, the wireless terminal device 300 corresponding to the identification information of the wireless terminal device 300 whether the subscription to the unlimited data roaming service; It serves to inform the policy server 200.

51 is a diagram illustrating the policy server 200 according to another exemplary embodiment of the present invention, wherein the storage unit 212, the storage medium 213, the receiver 214, the verification unit 215, It is comprised including the processing part 216 and the control part 211 for controlling each said structure part.

Here, the policy server 200 is illustrated as a single server in the drawings for the purpose of describing the embodiments, but each means or component may be separately configured into one or more servers.

Referring to FIG. 51, the storage unit 212 connects identification information of a plurality of wireless terminal devices 300 and policy agent identification information provided in each of the plurality of wireless terminal devices 300 to store a storage medium 213. It acts as a store to the prize.

According to the present invention, the storage unit 212, in addition to the identification information and the policy agent identification information of the wireless terminal device 300, various information or data transmitted and received to and from the communication server 500 and the user wireless terminal device 300. The storage medium 213 may store the data on the database.

The identification information of the wireless terminal device 300 may include one or more identification information of the wireless terminal device 300 and identification information of a subscriber (or a user) of the wireless terminal device 300. Each agent may include a unique ID or number.

The storage medium 213 according to an embodiment of the present invention serves to connect and store and manage identification information of a plurality of wireless terminal devices 300 and policy agent identification information provided in each of the plurality of wireless terminal devices 300. Do this.

According to the present invention, the storage medium 213 may be provided in a third server instead of the policy server 100 and may be provided in the communication server 500.

The communication unit 214 according to the embodiment of the present invention performs a role of receiving identification information of the wireless terminal device 300 for initiating an overseas communication network connection from the communication server 500 on the communication network.

In addition, the communication unit 214 further performs a role of transmitting and receiving various information or data to the communication server 500 and the user wireless terminal device 300.

For example, the communication unit 214 may further receive identification information of the wireless terminal device 300 for terminating the connection to the overseas communication network from the communication server 500 on the communication network, and the network may be connected to the overseas communication network regardless of initiation. Application identification information allowing use may be transmitted to a policy agent provided in the wireless terminal device 300.

Confirmation unit 215 according to the embodiment of the present invention, the radio corresponding to the identification information of the wireless terminal device 300 of the user initiating the connection to the overseas communication network received by the communication unit 214 through the customer information management system of the communication company When the terminal device 300 is the first wireless terminal device 300 subscribed to the unlimited data roaming service, and as a result of the check, the wireless terminal device 300 not subscribed to the unlimited data roaming service, the storage medium 213 In response to the identification information of the wireless terminal device 300 for initiating the connection to the overseas communication network received by the communication unit 214 serves to verify the policy agent identification information installed in the wireless terminal device 300. .

In addition, according to an aspect of the present invention, the confirmation unit 215, the communication unit 214 receives the wireless terminal device 300 identification information of the user for terminating the connection to the overseas communication network from the communication server 500 on the communication network In this case, the first check whether the network use blocking policy information is transmitted to the wireless terminal device 300 corresponding to the identification information of the wireless terminal device 300, and as a result, the wireless terminal to which the network use blocking policy information is transmitted. In the case of the device 300, the policy agent identification information installed in the wireless terminal device 300 may be further confirmed in response to the identification information of the wireless terminal device 300 through the storage medium 213.

The processor 216 according to an embodiment of the present invention performs a process of transmitting network use blocking policy information to a policy agent corresponding to the policy agent identification information checked by the checker 215.

Here, the network use blocking policy information may include, for example, policy information for blocking network access to all other applications except for a predetermined specific application among a plurality of network using applications provided in the wireless terminal device 300 and the wireless terminal device. Policy information for blocking a specific network connection type (eg, periodic data polling, background execution, keepalive, etc.) for all other applications except for a predetermined one of the plurality of network using applications provided in the 300. And, if the user wireless terminal device 300 is connected to the Wi-Fi, the network use blocking policy may include one or more policy information to be temporarily released.

Accordingly, according to an aspect of the present invention, the network use blocking policy information is the policy information for blocking network access to the remaining applications other than a predetermined specific application among a plurality of network using applications provided in the wireless terminal device 300; In this case, the wireless terminal device 300 that has received the network use blocking policy information may automatically block network access to the remaining applications except for a specific specific application among a plurality of network using applications.

In addition, according to another aspect of the present invention, the network use blocking policy information is a specific network access to all other applications except for a predetermined specific application among a plurality of network use applications provided in the wireless terminal device 300; In the case of the policy information to block the form, the wireless terminal device 300 receiving the network use blocking policy information may perform a specific network connection type such as periodic data polling, background execution, and keepalive maintenance for the remaining applications except for the specific application. Will automatically shut off.

In addition, according to another aspect of the present invention, when the network use blocking policy information is policy information for temporarily canceling a network use blocking policy when the user wireless terminal device 300 is connected to Wi-Fi, the network use blocking In the wireless terminal device 300 receiving the policy information, the communication network where data communication fees are paid, such as 3G network, LTE network, or 4G network, is blocked so that the use of the network through an application is blocked. It will automatically disable the use block.

In addition, the processing unit 216 serves to process the application identification information allowing the use of the network to be transmitted to the policy agent irrespective of the start of the overseas communication network connection, and the wireless terminal device 300 of the user initiating the overseas communication network connection When c) terminates the access to the overseas communication network, the network agent may further perform a process of transmitting the network use release policy information to the policy agent.

According to the present invention, all or part of the functions of the respective components provided in the policy server 200 may be implemented in the form of a program or a program set.

52 is a diagram illustrating a network use blocking policy operating process according to an overseas communication network connection start according to an embodiment of the present invention.

First, the policy server 200 connects the plurality of wireless terminal device identification information and the policy agent identification information provided in each of the plurality of wireless terminal devices 300 through the storage unit 212 to the storage medium 213. Save on (S410).

Thereafter, the policy server 200 processes the application identification information allowing the use of the network to be transmitted to the policy agent provided in the wireless terminal device 300 regardless of the initiation of access to the overseas communication network through the processing unit 215, thereby processing the policy agent. The application identification information allowing the use of the network is stored in the storage area irrespective of the start of the overseas communication network access (S420).

The processes S410 and S420 may be changed in order, and the process S420 may be performed in the following process (S480).

The communication server 500 according to the present invention receives identification information of the wireless terminal device 300 for initiating connection to an overseas communication network through an overseas communication network and a domestic communication network (S430).

Thereafter, the communication server 500 transmits identification information of the wireless terminal device 300 of the user who initiates connection to the overseas communication network received in step S430 to the policy server 200 (S440).

The policy server 200 receives the wireless terminal device 300 identification information of the user who initiates the connection to the overseas communication network through the communication unit 214 from the communication server 500, and then through the customer information management system of the communication company through the communication unit. It is checked whether the wireless terminal device 300 corresponding to the identification information of the wireless terminal device 300 of the user who initiates the connection to the overseas communication network received by 214 is the wireless terminal device 300 subscribed to the unlimited data roaming service (S450). ).

If the check result in step S450, the wireless terminal device 300 corresponding to the identification information of the wireless terminal device 300 of the user is a wireless terminal device 300 not subscribed to the unlimited data roaming service, the policy server Confirmation unit 215 of 200 corresponds to the identification information of the wireless terminal device 300 of the user who initiates the connection to the overseas communication network received by the communication unit 214 through the storage medium 213 of the wireless terminal device ( The policy agent identification information installed in 300 is checked (S470).

Thereafter, the policy server 200 processes the network usage blocking policy information to be transmitted to the policy agent corresponding to the policy agent identification information checked by the verification unit 215 through the processing unit 216 (S480).

Although not separately illustrated in the drawings, the policy agent provided in the wireless terminal device 300 subsequently connects to a network connection (or background call connection, etc.) of a plurality of applications provided in the wireless terminal device 300 through the network use blocking policy information. ) Will control itself.

FIG. 53 is a view illustrating a network use release policy operating process upon termination of access to an overseas communication network according to an embodiment of the present invention. FIG.

First, the communication server 500 according to the present invention receives the identification information of the wireless terminal 300 to terminate the connection to the overseas communication network through the domestic communication network (S510).

For example, when the user wireless terminal device 300 moves from abroad to a domestic communication network, the communication server 500 connects to a domestic communication network of the user wireless terminal device 300. The connection confirmation confirms the termination of the overseas communication network connection.

Thereafter, the communication server 500 transmits identification information of the user's wireless terminal device 300 terminating the connection to the overseas communication network received in step S510 to the policy server 200 (S520).

The policy server 200 receives the wireless terminal device 300 identification information of the user who terminates the connection to the overseas communication network through the communication unit 214 from the communication server 500, the wireless terminal device 300 identification information In operation S530, it is determined whether network usage blocking policy information is transmitted to the wireless terminal device 300 corresponding thereto.

If, as a result of the check in step (S530), if the wireless terminal device 300, the network use blocking policy information is transmitted (S540), the verification unit 215 of the policy server 200 is the storage medium 213 The policy agent identification information installed in the wireless terminal device 300 is checked in response to the identification information of the wireless terminal device 300 of the user who terminates connection to the overseas communication network received by the communication unit 214 (S550).

Thereafter, the policy server 200 processes the network usage release policy information to be transmitted to the policy agent corresponding to the policy agent identification information checked by the verification unit 215 through the processing unit 216 (S560).

Although not separately illustrated in the drawings, the policy agent provided in the wireless terminal device 300 subsequently controls network access blocking or connection restriction of a plurality of applications provided in the wireless terminal device 300 through the network use release policy information. It will be released automatically.

FIG. 54 is a diagram illustrating a network use blocking policy operating process in a wireless terminal device according to an overseas communication network connection start according to an embodiment of the present invention.

First, the policy server 200 connects the plurality of wireless terminal device identification information and the policy agent identification information provided in each of the plurality of wireless terminal devices 300 through the storage unit 212 to the storage medium 213. Save on (S610).

Thereafter, the policy server 200 processes the application identification information allowing the use of the network to be transmitted to the policy agent provided in the wireless terminal device 300 regardless of initiation of an overseas communication network connection through the processing unit 215 (S620).

Thereafter, the policy agent provided in the wireless terminal device 300 stores the application identification information allowing the use of the network in the storage area regardless of initiation of access to the overseas communication network (S630).

Processes S610 to S620 may be changed in order. Processes S620 and S630 may be performed in the following process (S660).

The policy server 200 according to the present invention receives or confirms the identification information of the wireless terminal device 300 that initiates the connection to the overseas communication network through the communication server 500 (S640).

Subsequently, the policy server 200 corresponds to a wireless terminal device corresponding to identification information of the wireless terminal device 300 of a user who initiates connection to an overseas communication network received by the communication unit 214 through the customer information management system 500 of a communication company. Check whether 300 is the wireless terminal device 300 subscribed to the unlimited data roaming service, and as a result of the check, the wireless terminal device 300 corresponding to the identification information of the wireless terminal device 300 of the user is not compared to the unlimited data roaming service. If the wireless terminal device 300 is subscribed, the identification unit 215 of the policy server 200 is a wireless terminal device of the user who initiates the connection to the overseas communication network received by the communication unit 214 through the storage medium 213 ( In step S650, the policy agent identification information installed in the wireless terminal device 300 is checked in response to the identification information.

Thereafter, the policy server 200 processes the network usage blocking policy information to be transmitted to the policy agent corresponding to the policy agent identification information checked by the verification unit 215 through the processing unit 216 (S660).

Thereafter, the policy agent provided in the wireless terminal device 300 receives the network use blocking policy information (S670), and then checks application identification information irrelevant to the start of access to the overseas communication network previously stored in the storage area ( S680).

Subsequently, the policy agent provided in the wireless terminal device 300 connects to a network (or background call connection) of a plurality of applications provided in the wireless terminal device 300 except for an application corresponding to the application identification information identified in step S680. Etc.) to control itself (S690).

FIG. 55 is a view illustrating a network use disconnection release policy operating process in a wireless terminal device upon termination of access to an overseas communication network according to an embodiment of the present invention.

First, the policy server 200 according to the present invention receives or confirms the identification information of the wireless terminal device 300 terminating the connection to the overseas communication network through the communication server 500 (S710).

For example, when the user wireless terminal device 300 moves from abroad to a domestic communication network, the communication server 500 connects to the domestic communication network of the user wireless terminal device 300. The connection confirmation confirms the termination of the overseas communication network connection.

Thereafter, the policy server 200 checks whether network usage blocking policy information has been transmitted to the wireless terminal device 300 corresponding to the identification information of the wireless terminal device 300, and, as a result, the network usage blocking policy information is determined. In the case of the transmitted wireless terminal device 300, the wireless terminal device corresponding to identification information of the wireless terminal device 300 of the user who terminates connection to the overseas communication network received by the communication unit 214 through the storage medium 213. The policy agent identification information installed at 300 is checked (S720).

Thereafter, the policy server 200 processes the network usage release policy information to be transmitted to the policy agent corresponding to the policy agent identification information checked by the identification unit 215 through the processing unit 216 (S730).

After that, when the policy agent provided in the wireless terminal device 300 releases the network use block by the network use release policy information (S740), the policy agent 100 receives the network use release policy information transmitted from the policy server 100. After that (S750), on the basis of the received network use release policy information, the network connection to the application is released (S760).

On the other hand, Figure 56 is a diagram showing a detailed configuration of a wireless terminal device 300 according to an embodiment of the present invention.

In more detail, FIG. 56 illustrates a detailed configuration of a user's wireless terminal device 300 in the communication network or network configuration shown in FIG. 3, each of which is a configuration for explaining an embodiment of the present invention. However, the present invention is not limited to the technical features only by the implementation method shown in FIG.

Referring to FIG. 56, a wireless terminal apparatus 300 of a user according to an exemplary embodiment of the present invention includes a policy receiver 320, a policy storage unit 330, a storage area 340, and a verification unit 350. And a processor 360, an updater 370, and a controller 310 for controlling each of the components.

Referring to FIG. 56, the policy receiver 320 may include, from the policy server 200, a policy including at least one policy information-applied application information for reducing network load and one or more network usage control policy information for each application. Information-receiving function, and the policy storage unit 330 stores the policy information received by the policy receiving unit 320 on the storage area 340.

The policy receiver 320 and the policy storage unit 330 according to the present invention may change the policy information stored on the storage area 340 or the policy information stored on the storage area 340 whenever new policy information is transmitted. Renew or upgrade

The storage area 340 according to an embodiment of the present invention classifies and stores the policy information stored through the policy storage unit 330 into application information of policy application and network usage control policy information for each application. An area allocated to a memory or a network reduction application in the wireless terminal device 300 of the user, or an IC chip or a USIM chip, may be used as the storage area 340.

The verification unit 350 according to an exemplary embodiment of the present invention first confirms one or more policy information previously stored on the storage area 340, and, if the policy information exists, includes the policy information in the policy information. Secondly confirming the applied policy application object information, and thirdly confirming whether the policy application object corresponding to the second confirmation result is provided in the user's wireless terminal device 300.

According to the present invention, the identification unit 350 matches a unique code or name for each application corresponding to the policy application object information to determine whether the policy application is provided in the user's wireless terminal device 300. You can check it.

In addition, the verification unit 350 may further perform a role of requesting policy information to a server on a communication network when policy information does not exist as a result of the primary verification.

Processing unit 360 according to an embodiment of the present invention, when the third application as a result of the verification unit 350, the policy application subject provided in the user's wireless terminal device 300, the storage, The network usage control policy information for the application pre-stored in the area 340 is applied to the application to control a network usage environment corresponding to the application for reducing network load.

That is, when the network usage control policy information is policy information for adjusting the number of times of access to a specific IP, a port, or a URL, the processor 360 specifies the policy application target application. Controls the number of times to access IP or Port or URL, and the network usage control policy information requests data to a specific IP or Port or URL. In the case of policy information for adjusting the number of times, the number of polling requests for data to a specific IP, port, or URL of the application to which the policy is applied is controlled. In case of policy information that adjusts the number of times data is received from a server with a specific IP or port or URL or ID, the application to which the policy is applied Control the number of pushes to receive data by a specific IP (IP) or port (Port) or URL (ID) or ID of the, the network usage control policy information is a specific IP (IP) or port ( In the case of policy information that adjusts the size or capacity of data transmitted through a port or URL or ID, after checking the size or capacity of data transmitted through the application to which the policy is applied, the size or capacity limit When the network usage control policy information is policy information for blocking the request and reception of user disapproval target data including advertisement data, the request for the user disapproval target data of the policy application target application is blocked. Or block reception, and the network access control policy information is assigned to the wireless terminal device 300 of the user. In the case of exceeding the limit, the policy information for blocking the data communication connection is blocked, and the data communication connection of the application to which the policy is applied is blocked. When the network overload is set, in the case of the policy information for blocking the data communication connection, the data communication connection of the policy application target application may be blocked.

According to an aspect of the present invention, the processing unit 360 controls the different network use environment according to the type or type of policy information, the application example of the network usage control policy information through the processing unit 360 as an example The explanation is as follows.

For example, the network usage control policy information for the application to which the policy is applied,

<xml version "1.0" encoding = "UTF-8">

<policy>

<description> Rules for block app </ description>

<rule>

<rule_id> T_2012_B_02_103030_P2 </ rule_id>

<rule_act> B_03_P_01 </ rule_act>

<app_id> T_2012_A_08_2089_K2_09_3092 </ app_id>

<target_ip> 192.168.0.255 </ target_ip>

<port> 80 </ port>

<refresh> 30 sec </ refresh>

</ rule>

<sign> e5c6e5ccec361baebcf79859e49c5526 </ sign>

</ policy>

In this case, the processing unit 360 according to the present invention recognizes that the application network blocking policy for 2012 is based on "<rule_id> T_2012_B_02_103030_P2 </ rule_id>", and in "<rule_act> B_03_P_01 </ rule_act>". Recognize that the policy enforcement method is applied immediately, recognize that the policy application ID is from "A_08_2089_K2" to "09_3092" based on "<app_id> T_2012_A_08_2089_K2_09_3092 </ app_id>", and apply the policy application mask Recognizing that the value is K2, based on "<sign> e5c6e5ccec361baebcf79859e49c5526 </ sign>", it is checked whether the policy document has not been tampered with on the network, and "<target_ip> 192.168.0.255 </ target_ip>" and "< port> 80 </ port> "based on 192.168.0.255 and the port is 80. Refresh timeout is 30sec through" <refresh> 30 sec </ refresh> ". Set it to your Apple It is to control the network usage environment for the application.

The processing example through the processing unit 360 described above is merely an example, and may be formed in various forms according to the nature or type of the policy.

The update unit 370 according to the exemplary embodiment of the present invention, when the network usage control policy information for the policy application target is changed, controls the network usage of the policy application target application previously stored on the storage area 340. It performs the role of processing the upgrade of policy information.

57 is a diagram illustrating a case of applying policy information for each application according to an embodiment of the present invention.

Referring to FIG. 57, when the policy application target application is an application maintaining the keep-alive state, the network usage control policy information is set as a policy controlling the execution of the application itself to control the execution of the application. In the case of an application that executes frequent polling, the network usage control policy information is set as a policy to control the number of polling cycles or the polling period to control the number of polling cycles or cycles of the application, and the user's wireless terminal device 300 Network usage control policy information is set to a policy that blocks all applications in the background from accessing the network, recognizing that the traffic attempt itself is meaningless when the available data limit expires. Ha You can do that.

58 is a diagram illustrating a policy information application process in the user's wireless terminal device 300 according to an embodiment of the present invention.

First, the user's wireless terminal device 300 is a policy information for the network load reduction from the policy server 200 through the policy receiver 320 (or network load reduction application)-policy application target application information and respective applications After receiving the policy information including one or more network usage control policy information for each, and stores the received policy information on the storage area 340 through the policy storage unit 330 (or network load reduction application). (S1410).

Thereafter, the user's wireless terminal device 300 determines whether the network load reducing application is driven, and then drives the network load reducing application (S1415).

The process (S1415) may be omitted, and the order of the process (S1410) may be changed.

Thereafter, the user's wireless terminal device 300 checks the policy information for reducing the network load through the verification unit 350 (or an application for network load reduction) (S1420).

If, in step S1420, the policy information for reducing the network load is not confirmed (S1425), the user's wireless terminal device 300 requests policy information from the policy server, and the policy receiver 320 (or the network load). A policy information for reducing network load-policy information including policy application target information and at least one network usage control policy information for each application-from the policy server 200 through a policy application; A process of storing the received policy information on the storage area 340 through the storage unit 330 (or an application for reducing network load) is performed (S1430).

If the policy information for reducing the network load is checked in step S1420 (S1435), the user's wireless terminal device 300 checks the application of the policy application through the verification unit 350 (or the network load reducing application). (S1440).

If the application of the policy is confirmed through the process (S1440) (S1445), the wireless terminal device 300 of the user is previously stored on the storage area 340 through the processing unit 360 (or network load reduction application). The network usage control policy information corresponding to the application target application is checked (S1450).

If the policy application target application is not identified through the process (S1440), the wireless terminal device 300 of the user repeats the process (S1440) (S1455).

Subsequently, the user's wireless terminal device 300 applies the policy corresponding to the network usage control policy information identified in step S1450 through the processor 360 (or an application for reducing network load) to the policy application target application. The network use environment is controlled (S1460).

Although not separately shown on the figure, the process (S1460) is, when the network use control policy information is policy information for adjusting the number of times to connect to a specific IP (IP) or port (Port) or URL (URL), A process of counting the number of times per connection to a specific IP, port, or URL of the application to which the policy is applied, comparing the counting value with a preset number of times in the policy information, and comparing results If the counting value corresponds to a predetermined number of times per time on the policy information, the method may further include blocking access to a specific IP, a port, or a URL of the application to which the policy is applied.

In operation S1460, when the network use control policy information is policy information for adjusting the number of times of requesting data to a specific IP, a port, or a URL, the policy application target application may be executed. Counting the number of polling requests for data to a specific IP, port or URL, comparing the counting time with the preset number of times per policy information, and comparing the results If the counting value corresponds to a predetermined number of times per time on policy information, the method may further include blocking a data request to a specific IP, port, or URL of the application to which the policy is applied. .

In addition, the process (S1460), when the network use control policy information is policy information for adjusting the number of times of receiving data by a specific IP (IP) or port (Port) or URL (URL) or ID (ID), Counting the number of pushes to receive data to a specific IP (IP) or port (URL) or URL of the application to apply the policy, and compares the counting value and the number of times set in the policy information If the counting value matches the preset number of times per policy on the policy information, a process of blocking data push reception to a specific IP, port, or URL of the application to which the policy is applied is blocked. It may further include.

In addition, the step (S1460), the network use control policy information is a policy information for adjusting the size or capacity of the data transmitted to a specific IP (IP) or port (Port) or URL (URL) or ID (ID) In this case, the process of checking the size or capacity of the data transmitted to a specific IP (IP), port (Port) or URL (URL) of the application to apply the policy, and as a result of the check, the data size is the data set in the policy information When exceeding the size or capacity of the, may further include the step of blocking data transmission to a specific IP (IP) or port (Port) or URL (URL) of the policy application target.

In operation S1460, when the network usage control policy information is policy information for blocking request and reception of user unauthorized target data including advertisement data, a specific IP to which a policy application target application is accessed is accessed. Alternatively, the process of checking whether the port or URL requests or receives the user approval target data, and as a result of the check, the specific IP or port or URL connected to the application to which the policy is applied is connected. If)) is not a request or destination of the user approval target data, the method may further include the step of blocking access to the specific IP or Port or URL of the policy application target application.

In operation S1460, when the network usage control policy information exceeds a data communication limit allocated to the wireless terminal device 300 of the user, the data communication allocated to the wireless terminal device 300 of the user may be used. Comparing the limit with the amount of data communication used up to now; and when the data communication limit allocated to the user's wireless terminal device 300 is exceeded, blocking the data communication connection of the application to which the policy is applied. It may further include.

In operation S1460, when the network usage control policy information is policy information for blocking a data communication connection when an overload of a communication network of an area where the user's wireless terminal device 300 is located is set, The process of counting the communication delay time due to the overload of the communication network in the region where the wireless terminal device 300 is located, the process of comparing the predetermined time on the counting value and the policy information, the result of the comparison, the counting value on the policy information If the predetermined time is exceeded, the method may further include blocking a data communication connection of the policy application target application.

59 is a diagram illustrating a network usage analysis process according to application of policy information according to an embodiment of the present invention.

First, the analysis server 100 receives and / or confirms the network usage information from the user's wireless terminal device 300 or the communication company server before applying the network usage control policy information for the user's wireless terminal device 300, and then The data is stored on the storage medium 150 (S1510).

Thereafter, the analysis server 100 receives and / or confirms network usage information from the user's wireless terminal device 300 or a communication company server after applying the network usage control policy information for the user's wireless terminal device 300, and then The storage medium 150 stores the data on the storage medium 150 (S1515).

Thereafter, the analysis server 100 compares network usage information before and after applying the network usage control policy information to the wireless terminal device 300 of the user through the storage medium 150 (S1520).

As a result of the comparison through the process (S1520), if there is no difference, the process (S1510) to (S1520) is repeated (S1525).

Then, if there is a comparison result through the process (S1520), if there is a difference (S1530), the analysis server 100 stores the comparison result on the storage medium 150, and / or the comparison result to a third server on the communication network Transmit (S1535).

Subsequently, if the network utilization comparison analysis of the application server 400 corresponding to the application provided in the user's wireless terminal device 300 is not additionally required (S1540), the analysis process is terminated and the user's wireless terminal device ( If the network usage comparison analysis of the application server 400 corresponding to the application provided in 300 is further required (S1545), the analysis server 100 corresponds to an application provided in the user's wireless terminal device 300. After receiving and / or confirming the network usage information from the application server 400 or the communication server 500 before applying the network usage control policy information for the application server 400, and storing it on the storage medium 150 ( S1550).

Thereafter, the analysis server 100 applies the network usage control policy information to the application server 500 corresponding to the application provided in the user's wireless terminal device 300, and then uses the application server 400 or the network server to communicate the network usage information. After receiving and / or confirming from the server 500, it is stored on the storage medium 150 (S1555).

Thereafter, the analysis server 100 compares network utilization information before and after applying the network usage control policy information for the application server 500 through the storage medium 150 (S1560).

Thereafter, the analysis server 100 stores the comparison result through the process (S1560) on the storage medium 150, and / or transmits the comparison result to a third server on the communication network (S1565).

On the other hand, each or all of the components of the wireless terminal device 300 may be configured in the form of a program such as a policy agent.

Accordingly, the policy receiver 320 receives the application identification information from the policy server 200 that allows the use of a network regardless of initiating an overseas communication network connection, and the policy server 200 through the communication network. And receiving various kinds of information such as network usage blocking policy information and network usage blocking policy information.

The policy storage unit 330 according to an embodiment of the present invention stores the application identification information in the storage area 340 that permits the use of the network regardless of initiating the connection to the overseas communication network received by the policy receiver 320. Can play a role.

According to the present invention, the policy storage unit 330, in addition to the application identification information that allows the use of the network regardless of initiating the overseas communication network access, network use blocking policy information or network use blocking policy information and the like storage area ( 340 can be stored further.

The storage area 340 according to an exemplary embodiment of the present invention may store and manage application identification information allowing network use regardless of initiating an overseas communication network connection.

In addition, the storage area 340 may further store network use blocking policy information, network use blocking policy information, and the like, in addition to application identification information allowing network use regardless of initiating an overseas communication network connection.

The processor 360 according to an exemplary embodiment of the present invention uses a network previously stored in the storage area 340 among a plurality of network using applications based on the network usage blocking policy information received by the policy receiver 320. It may serve to block network access to all applications except the application corresponding to the allowed application identification information.

In addition, when the processing unit 360 further receives network use disconnection policy information from the policy server 200 on the communication network in the policy receiver 320, based on the received network use release policy information, It can further play the role of unblocking network access to the application.

Confirmation unit 350 according to the embodiment of the present invention, by checking whether the currently connected communication network is an overseas communication network or a domestic communication network, the role of confirming whether the overseas communication network connection start and end connection of the wireless terminal device 300. Perform.

According to the present invention, the processor 360 determines that the currently connected communication network is changed from the immediately connected overseas communication network to the domestic communication network as a result of the confirmation by the confirmation unit 350, and determines that the connection to the overseas communication network is terminated. It further performs the role of releasing the network connection blocking for the applications provided in (300).

The process for the case where the policy agent provided in the wireless terminal device 300 determines the self-use of network use release rather than the network use release release policy information (S770) will be described with reference to FIG. 60.

FIG. 60 is a view illustrating a network use release policy operating process in a wireless terminal device according to termination of an overseas communication network according to another embodiment of the present invention.

In the case of determining the network use release by itself rather than the network use release policy information, the policy agent of the wireless terminal device 300 is a communication network that the wireless terminal device 300 immediately connected to is an overseas communication network, If it is confirmed that the conversion to the domestic communication network, it confirms the termination of the overseas communication network based on this (S810).

If it is confirmed in step S810 that the connection to the overseas communication network is terminated (S820), the policy agent of the wireless terminal device 300 accesses the network to the applications that blocked the network connection according to the start of the connection to the overseas communication network. Release the block (S830).

If, as a result of the check in step S810, the connection to the overseas communication network is not terminated (S840), the policy agent of the wireless terminal device 300 repeats the step (S810).

FIG. 61 is a diagram illustrating a network use blocking process of the wireless terminal device 300 according to an overseas communication network connection start according to another embodiment of the present invention.

First, the policy agent provided in the wireless terminal device 300 stores the application identification information in the storage area 340 that allows the use of the network regardless of initiation of the overseas communication network access (S210).

Thereafter, the policy agent provided in the wireless terminal device 300 checks whether the immediately connected communication network is a domestic communication network and whether the currently connected communication network is converted to an overseas communication network, thereby confirming whether to start an overseas communication network connection (S220).

As a result of the check in step S220, when it is confirmed that an overseas communication network connection is started (S230), the policy agent provided in the wireless terminal device 300 uses a network previously stored in the storage area 340 among a plurality of network using applications. After checking the allowed application identification information (S240), a network connection (or background call connection, etc.) of a plurality of applications provided in the wireless terminal device 300 except for the application corresponding to the identified application identification information is blocked by itself (S250). ).

62 is a diagram illustrating a network use disconnection process according to termination of an overseas communication network connection according to an embodiment of the present invention.

The policy agent provided in the wireless terminal device 300 checks whether the immediately connected communication network is an overseas communication network, and whether the currently connected communication network is converted into a domestic communication network, and confirms whether the overseas communication network is terminated (S310).

Subsequently, as a result of checking in step S310, when terminating the connection to the overseas communication network (S320), the policy agent provided in the wireless terminal device 100 releases the network connection blocking for the application in which the network use is blocked ( S330).

The method according to the present invention described above may be stored in a computer-readable recording medium that is produced as a program for execution on a computer, and examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape , Floppy disks, optical data storage devices, and the like, and also include those implemented in the form of carrier waves (eg, transmission over the Internet).

The computer readable recording medium can be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. In addition, functional programs, codes, and code segments for implementing the method can be easily inferred by programmers in the art to which the present invention belongs.

In addition, although the preferred embodiment of the present invention has been shown and described above, the present invention is not limited to the specific embodiments described above, but the technical field to which the invention belongs without departing from the spirit of the invention claimed in the claims. Of course, various modifications can be made by those skilled in the art, and these modifications should not be individually understood from the technical spirit or prospect of the present invention.

Claims (16)

  1. Collecting network usage status information between at least one application provided in at least one wireless terminal device and a communication network;
    Accumulating and storing the collected network usage state information on application storage information by storing the network usage state information on the storage medium, and obtaining network usage pattern information for each application by analyzing accumulated network usage state information for each application stored on the storage medium;
    Generating network usage control policy information for at least one policy application object through the obtained network usage pattern information; And
    And processing the generated network usage control policy information for the policy application object and the policy information for reducing network load including the policy application object information to be transmitted to the wireless terminal device or the communication server. Operation method of a server device for reducing the load.
  2. The method of claim 1,
    Collecting the network usage status information,
    And collecting or capturing a plurality of packets transmitted and received between a plurality of wireless terminal devices and a plurality of application servers by the application.
  3. The method of claim 1,
    The policy information for reducing network load includes one or more application information applied to a policy and network usage control policy information for each application.
    After receiving the policy information, the policy information is stored in a storage area, and the primary confirmation of one or more policy information previously stored on the storage area, and if the policy information is present as a result of the primary confirmation, applies the policy included in the policy information. Secondly confirms the application information, and thirdly confirms whether the policy application target application corresponding to the second verification result is provided in the wireless terminal device, and the third application check result, the policy application target provided in the wireless terminal device. If an application is provided, controlling network usage environment by applying network usage control policy information for the application previously stored in the storage area to the application.
  4. The method of claim 3, wherein the network usage environment,
    The number of network connections, the number of network connections, the number of data transmissions, the number of data receptions, the transmission data capacity, the reception data capacity, the data transmission time, the data reception time, the connection target network IP of the wireless terminal apparatus ( An IP) or a port or URL, a network IP to be blocked, or a port or URL, and at least one of a data communication limit and a network load. How it works.
  5. The network usage pattern information according to claim 1, wherein the network usage pattern information for each application includes information about the number of times that the analysis target application connects to a specific IP, a port, or a URL, and the analysis target application includes a specific IP ( Information on the number of times data is requested by IP) or port or URL, and the analysis target application data from a server to a specific IP or port or URL or ID. The number of times of receiving the information, the size or capacity information of the data transmitted by the analysis target application to a specific IP (IP) or port (Port) or URL (URL) or ID (ID), and the analysis target application advertising data Request and reception information of the user disapproval target data, including, and data allocated to the wireless terminal device by the analysis target application; If it exceeds the new limit, the data communication connection information and, if the overload of the network region to the wireless terminal device is positioned is set, the method of operating a server apparatus that includes at least one of a data communication connection information of the analysis target application.
  6. The method of claim 1,
    Acquiring the network usage pattern information,
    Mapping a packet transmission / reception subject and an object from the network usage state information, and processing the mapped packets by one or more data modeling and grouping the packets according to packet generation patterns; And
    And detecting similar data models among the plurality of data models grouped by the packet generation pattern as repeated generation patterns within an error range having a mutual time difference length.
  7. The method of claim 6,
    Acquiring the network usage pattern information,
    Periodic section when the detected repeated occurrence pattern occurs more than n times (one number of n = 2,3,4 ... n) consecutively, and more than n consecutively generated sections occupy a certain ratio or more than all sections. The method of operating a server device for reducing the network load further comprising the step of determining.
  8. The method of claim 1,
    Acquiring the network usage pattern information,
    Verifying domain names of servers, which are a transmission / reception subject or an object of a plurality of packets collected or captured from the network usage state information;
    Extracting signatures of the verified domain names;
    Comparing signatures extracted by the extractor with the unique signatures stored in the storage medium through a storage medium storing predetermined unique signatures; And
    Corresponding to the comparison result of the comparator, the extractor extracts, merges or merges the extracted signatures, and the servers corresponding to the same signatures among the partitioned or merged or the partitioned and merged signatures are either a single service or a single application. And grouping into groups of servers corresponding to the method.
  9. The method of claim 8,
    Acquiring the network usage pattern information,
    When the address information of the grouped servers is compared with the address information of the server stored on the storage medium, and as a result of the comparison, when at least one of the address information of the grouped servers matches the address information of the server stored on the storage medium, And setting the grouped servers as servers to which a service or an application connected with a matched server address on the storage medium is connected.
  10. The method of claim 1,
    Acquiring the network usage pattern information,
    Server grouping is performed based on the network usage pattern information, and the number of relationships between the servers is calculated by connecting and counting servers that appear within a predetermined time interval from the packets extracted from the network usage pattern information in pairs, A relative relationship value or a statistical relationship value is calculated by applying at least one of an absolute number of occurrences of each server or an absolute number of pairs of servers according to the counting to a relationship number, and based on the relative relationship value or the statistical relationship value Grouping the servers into one or more groups.
  11. The method of claim 1,
    The processing of transmitting the policy information may include:
    Upon receiving the wireless terminal device identification information of the user who initiates the connection to the overseas communication network from the communication server on the communication network, the policy agent identification information installed in the wireless terminal device is checked according to whether the wireless terminal device identification information subscribes to a data roaming service. And processing the network usage blocking policy information to be transmitted to a policy agent corresponding to the checked policy agent identification information.
  12. Collect network usage status information between at least one application and the communication network provided in at least one wireless terminal device, accumulate and store the collected network usage status information on the storage medium by connecting the application information and stored on the storage medium An analysis server for analyzing network usage state information accumulated for each application to obtain network usage pattern information for each application; And
    Generating network usage control policy information for at least one policy application target application through the obtained network usage pattern information, and generating network usage control policy information and policy application target application information for the generated policy application target application. And a policy server for processing policy information for reducing network load to be transmitted to the wireless terminal device or a communication server.
  13. The method of claim 12,
    The analysis server,
    And collecting or capturing a plurality of packets transmitted and received between a plurality of wireless terminal devices and a plurality of application servers by the application.
  14. The method of claim 12,
    The policy information for reducing network load includes one or more application information applied to a policy and network usage control policy information for each application.
    The policy server stores the policy information in a storage area, first checks one or more policy information previously stored on the storage area, and if the policy information exists, the policy application target application included in the policy information. Secondly confirming information, and thirdly confirming whether the policy application object corresponding to the second confirmation result is provided in the wireless terminal device, and tertiarily confirming the result, the policy application object provided in the wireless terminal device. Is provided, the server apparatus for controlling a network usage environment by applying network usage control policy information for the application previously stored in the storage area to the application.
  15. The method of claim 14, wherein the network usage environment,
    The number of network connections, the number of network connections, the number of data transmissions, the number of data receptions, the transmission data capacity, the reception data capacity, the data transmission time, the data reception time, the connection target network IP of the wireless terminal apparatus ( An IP) or a port or URL, a network IP to be blocked, or a port or URL, and at least one of a data communication limit and a network load. How it works.
  16. A nonvolatile recording medium having recorded thereon a program for executing the method according to any one of claims 1 to 11 on a computer.
PCT/KR2014/004292 2013-05-20 2014-05-13 Server apparatus for reducing wireless network load, operating method thereof, and recording medium WO2014189224A1 (en)

Priority Applications (18)

Application Number Priority Date Filing Date Title
KR20130056786A KR20140136604A (en) 2013-05-20 2013-05-20 Wireless Terminal Device and Method for Operation of Policy
KR1020130056785A KR20140136603A (en) 2013-05-20 2013-05-20 Recording Medium, Method and System for Operation of Policy
KR20130056787A KR20140136605A (en) 2013-05-20 2013-05-20 Method for Operation of Policy
KR10-2013-0056786 2013-05-20
KR10-2013-0056788 2013-05-20
KR20130056788A KR20140136606A (en) 2013-05-20 2013-05-20 Wireless Terminal Device and Method for Operation of Application
KR10-2013-0056785 2013-05-20
KR10-2013-0056787 2013-05-20
KR10-2013-0088633 2013-07-26
KR1020130088633A KR20150014023A (en) 2013-07-26 2013-07-26 Recording Medium, Method and Device for Detection of Periodicity
KR10-2013-0088675 2013-07-26
KR10-2013-0088672 2013-07-26
KR1020130088672A KR20150014027A (en) 2013-07-26 2013-07-26 Recording Medium, Method and Device for Detection of Keep Alive
KR1020130088675A KR20150014028A (en) 2013-07-26 2013-07-26 Recording Medium, Method and Device for Detection of Polling
KR10-2013-0099229 2013-08-21
KR20130099229A KR20150022063A (en) 2013-08-21 2013-08-21 Recording Medium, Method and Device for Server Grouping
KR10-2013-0101475 2013-08-27
KR20130101475A KR20150024957A (en) 2013-08-27 2013-08-27 Device for Server Grouping

Publications (1)

Publication Number Publication Date
WO2014189224A1 true WO2014189224A1 (en) 2014-11-27

Family

ID=51933745

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2014/004292 WO2014189224A1 (en) 2013-05-20 2014-05-13 Server apparatus for reducing wireless network load, operating method thereof, and recording medium

Country Status (1)

Country Link
WO (1) WO2014189224A1 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016144009A1 (en) * 2015-03-12 2016-09-15 엘지전자 주식회사 Method and terminal for controlling network traffic in wireless communication system

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20090010264A (en) * 2007-07-23 2009-01-30 에스케이 텔레콤주식회사 Data traffic generator for the analysis of network performance and quality of service, and method of the same
KR20100072975A (en) * 2008-12-22 2010-07-01 주식회사 케이티 Apparatus and method for managing network traffic based on flow and session
KR20110054615A (en) * 2009-11-18 2011-05-25 주식회사 반딧불소프트웨어 Apparatus and method for controlling network through analysis network packet of personal computer
WO2011078793A1 (en) * 2009-12-24 2011-06-30 Empire Technology Development Llc Dynamic mobile application quality-of-service monitoring and reporting
KR20120117434A (en) * 2011-04-15 2012-10-24 엔에이치엔(주) Method and apparatus for measuring mobile traffic using vpn

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20090010264A (en) * 2007-07-23 2009-01-30 에스케이 텔레콤주식회사 Data traffic generator for the analysis of network performance and quality of service, and method of the same
KR20100072975A (en) * 2008-12-22 2010-07-01 주식회사 케이티 Apparatus and method for managing network traffic based on flow and session
KR20110054615A (en) * 2009-11-18 2011-05-25 주식회사 반딧불소프트웨어 Apparatus and method for controlling network through analysis network packet of personal computer
WO2011078793A1 (en) * 2009-12-24 2011-06-30 Empire Technology Development Llc Dynamic mobile application quality-of-service monitoring and reporting
KR20120117434A (en) * 2011-04-15 2012-10-24 엔에이치엔(주) Method and apparatus for measuring mobile traffic using vpn

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2016144009A1 (en) * 2015-03-12 2016-09-15 엘지전자 주식회사 Method and terminal for controlling network traffic in wireless communication system
US10362510B2 (en) 2015-03-12 2019-07-23 Lg Electronics Inc. Method and terminal for controlling network traffic in wireless communication system

Similar Documents

Publication Publication Date Title
WO2012070859A2 (en) Broadcast signal transmitting apparatus, broadcast signal receiving apparatus, and broadcast signal transceiving method in broadcast signal transmitting and receiving apparatuses
WO2015115723A1 (en) Wireless charging device and terminal, wireless charging system including same, method for controlling same, and recording medium having computer program recorded thereon
WO2015147576A1 (en) Apparatus and method for communicating voice data in a wireless network
WO2014062018A1 (en) Apparatus and method for processing an interactive service
WO2011122834A2 (en) Apparatus and method for performing random access in a wireless communication system
WO2014112800A1 (en) Smart home system using portable device
WO2013129781A1 (en) Device and method for providing emergency alert service through mobile broadcast
WO2014021636A1 (en) Wireless power transmission network and wireless power transmission method
WO2013119082A1 (en) Image display apparatus and method for operating same
EP2730146A1 (en) Method and terminal for performing detach procedure
WO2014209077A1 (en) Method and apparatus for performing device-to-device communication
WO2016024695A1 (en) Method and apparatus for profile download of group devices
WO2011087210A2 (en) Electronic device and operating method thereof
WO2015037926A1 (en) Method and system to enable secure communication for inter-enb transmission
EP2810445A1 (en) Video display apparatus and operating method thereof
WO2012091371A1 (en) Method for transmitting broadcast service, method for receiving the broadcasting service, and apparatus for receiving the broadcasting service
WO2013015571A2 (en) Electronic device and operating method thereof
WO2012173423A2 (en) Wireless data communication apparatus and wireless data communication method
WO2013187654A1 (en) Method and apparatus for encoding videos sharing sao parameter according to color component
WO2016017908A1 (en) Method and apparatus for controlling electronic device in wireless communication system supporting bluetooth communication
WO2009128653A2 (en) Multimedia encoding method and device based on multimedia content characteristics, and a multimedia decoding method and device based on multimedia content characteristics
WO2012064067A2 (en) Method for changing connections between heterogeneous networks, and policy-providing device and terminal device for supporting same
WO2010107234A2 (en) Data transmission method for wireless communication system involving relay
WO2014003394A1 (en) Apparatus and method for processing an interactive service
WO2011105695A2 (en) Electronic device and method for operating an electronic device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14801354

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase in:

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC ( EPO FORM 1205A DATED 14/03/2016 )

122 Ep: pct application non-entry in european phase

Ref document number: 14801354

Country of ref document: EP

Kind code of ref document: A1