JP6280836B2 - Identification device, identification method, and identification program - Google Patents

Description

  The present invention relates to an identification device, an identification method, and an identification program.

Many methods have been proposed for identifying the type (type) such as an OS (Operating System) of a terminal device as a counterpart in a communication network.
For example, the technology according to Non-Patent Document 1 identifies the type of a partner terminal device by sending a communication packet to the partner terminal device to be identified and analyzing the reaction (Non-Patent Document 1). 1). As information used for identification, various headers and options of TCP / IP (Transmission Control Protocol / Internet Protocol) are used.

  In addition to the above-described method of dynamically transmitting a communication packet to a partner terminal device, as in the technique according to Non-Patent Document 2, by statically monitoring the communication content of the partner terminal device, A method for identifying the type of the partner terminal device has also been proposed (see Non-Patent Document 2). Also in this method, various types of TCP / IP headers and options are used to identify the terminal device.

The above-described identification using TCP / IP information is generally called Shallow Packet Inspection (SPI). On the other hand, there is also a method called Deep Packet Inspection (DPI) that performs identification using information of a higher application layer. .
By using Deep Packet Inspection, for example, as in the technique according to Non-Patent Document 3, it is possible to acquire various information of the application layer and identify the partner terminal device (see Non-Patent Document 3). ).

Remote OS detection via TCP / IP Stack FingerPrinting (2nd Generation), [online], [February 12, 2013 search], Internet <URL: http: // nmap. org / book / osdetect. html> Official p0f homepage, [online], [February 12, 2013 search], Internet <URL: http: // lcamtuf. coredump. cx / p0f. shml> Deep packet inspection meets' Net neutrality, CALEA, [online], [February 12, 2013 search], Internet <URL: http: // artechnica. com / hardware / news / 2007/07 / Deep-packet-inspection-meets-net-neutrality. ars>

  By the way, identifying an individual terminal device (individual identification) is very important in advertising, marketing, and the like, and its technology is required. However, conventionally, when individual identification of a terminal device is performed, it is necessary for the user of the terminal device to actively register identification information (ID), which may be troublesome for the user. There were many. For example, the terminal device identification method in the prior art is intended to determine the type of OS and the like, and is not necessarily suitable for individual identification of the terminal device.

Specifically, among the technologies described above, in Shallow Packet Inspection, the type of the corresponding terminal device is identified from features such as various headers and options of TCP / IP. However, with this method, the classification accuracy of the OS type is limited, and it is insufficient for performing individual identification of the terminal device.
On the other hand, in Deep Packet Inspection, more detailed information may be obtained than Shallow Packet Inspection, but information that can be obtained only by Deep Packet Inspection in simple session units is limited, and individual identification of terminal devices is performed. It was insufficient for this.
Moreover, when performing individual identification of a terminal device, it is preferable to improve the accuracy of individual identification.

  The present invention has been made in view of such circumstances, and it is an object of the present invention to provide an identification device, an identification method, and an identification program capable of accurately identifying an individual terminal device.

  (1) In order to solve the above-described problem, an identification device according to the present invention is based on a communication monitoring unit that acquires information on a communication packet to be monitored, and information on the communication packet acquired by the communication monitoring unit. Whether the communication flow restructuring unit reconstructs the communication flow and the communication flow reconstructed by the communication flow building unit corresponds to the first traffic estimated to have occurred due to an operation performed by a person. Or a traffic determination unit that determines whether the second traffic is estimated to have occurred without being caused by an operation performed by a person, and the traffic determination unit has determined that the second traffic is supported By analyzing the communication protocol of the communication flow, the terminal individual identification information component for acquiring information related to the individual identification of the terminal device that transmitted the communication packet And an information storage unit for storing information indicating characteristics of the communication packet obtained based on information acquired by the terminal individual identification information analysis unit and information of the communication packet acquired by the communication monitoring unit; .

  (2) In the identification device according to (1), the information indicating the characteristics of the communication packet includes information on an identifier in the network, and further, based on information stored in the information storage unit Thus, a configuration may be used that includes a terminal individual identification unit that outputs information on the in-network identifier for each terminal device that is assumed to be the same terminal device individual.

  (3) In the identification device according to (2), the information indicating the characteristics of the communication packet further includes time information and network information, and the terminal individual identification unit includes the network A configuration in which the information of the internal identifier is output together with the time information and the network information may be used.

  (4) In the identification device according to any one of (1) to (3) described above, the terminal individual identification information analysis unit may include User-Agent information in the HTTP protocol, or TCP fingerprint information, header information output by a Web browser, installed plug-in information, plug-in version information, clock skew information of the terminal device, or the terminal A configuration may be used in which one or more of information on a host that is an access destination of the device or information on browsing setting of a moving image application of the terminal device is acquired.

  (5) In order to solve the above-described problem, in the identification method according to the present invention, the communication monitoring unit acquires information on the communication packet to be monitored, and the communication flow construction unit is acquired by the communication monitoring unit. The communication flow is reconstructed based on the information of the communication packet, and the traffic determination unit is estimated to have occurred due to an operation performed by a person for the communication flow reconstructed by the communication flow construction unit. It is determined whether it corresponds to the traffic of 1 or the second traffic estimated to have occurred without being caused by an operation performed by a person. By analyzing a communication protocol of the communication flow determined to correspond to the second traffic, information related to individual identification of the terminal device that transmitted the communication packet is obtained. The information storage unit stores information obtained by the terminal individual identification information analysis unit and information indicating the characteristics of the communication packet obtained based on the communication packet information obtained by the communication monitoring unit. To do.

  (6) In order to solve the above-described problem, an identification program according to the present invention includes a step in which a communication monitoring unit acquires information on a communication packet to be monitored, and a communication flow construction unit is acquired by the communication monitoring unit. The step of reconstructing the communication flow based on the information of the communication packet to be performed, and the traffic determination unit is generated due to an operation performed by a person for the communication flow reconstructed by the communication flow construction unit Determining whether to correspond to the estimated first traffic or to correspond to the second traffic estimated not to be caused by an operation performed by a person, and the terminal individual identification information analysis unit Analyzing the communication protocol of the communication flow determined to correspond to the second traffic by the traffic determination unit. Acquiring information relating to the individual identification of the terminal device that has transmitted the information, the information storage unit is information acquired by the terminal individual identification information analysis unit, and information of the communication packet acquired by the communication monitoring unit And a step of storing information indicating characteristics of the communication packet obtained based on the identification program.

  According to the present invention, it is possible to accurately identify an individual terminal device.

It is a block diagram showing a schematic structure of an identification device concerning one embodiment of the present invention. It is a flowchart which shows an example of the procedure of the process which determines the foreground traffic and the background traffic in the identification device which concerns on one Embodiment of this invention. It is a figure which shows an example of the terminal identification information memorize | stored in the terminal identification information database which concerns on one Embodiment of this invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.
In the present embodiment, traffic estimated to be generated due to an operation performed by a person (user) is referred to as foreground traffic. The foreground traffic can be said to be traffic presumed to have been generated by an operation performed by a person (user) operating the terminal device, for example.
Further, in the present embodiment, traffic estimated to have occurred without being caused by an operation performed by a person (user) is referred to as background traffic. It can be said that the background traffic is, for example, traffic estimated to be generated by an operation (processing) of the terminal device that is not conscious of a person (user) operating the terminal device.
Here, as foreground traffic and background traffic, traffic generated due to an operation performed by a person (user) and traffic generated not due to an operation performed by a person (user), respectively. In the present embodiment, it is said that there may be some error in this distinction (determination) and it is estimated. For this reason, for example, as foreground traffic and background traffic, the traffic occurred due to the operation performed by the person (user) and the operation performed by the person (user), respectively. A case where it is determined by being completely distinguished from traffic is also included as an example of the configuration of the present embodiment.
In the present embodiment, for convenience of explanation, names such as foreground traffic and background traffic are used. However, any other name may be used as these names.
In the present embodiment and the like, the word “analysis” is used for convenience of explanation, but other words such as “analysis” may be used instead of “analysis”.

FIG. 1 is a block diagram showing a schematic configuration of an identification apparatus 1 according to an embodiment of the present invention.
FIG. 1 shows a line 2 through which communication packets flow.
The identification device 1 according to the present embodiment includes a communication monitoring unit 11, a communication protocol analysis unit 12, a terminal identification information database (information storage unit) 13, and a terminal individual identification unit 14.
The communication protocol analysis unit 12 includes a communication flow construction unit 31, a flow database 32, a traffic determination unit (foreground / background traffic determination unit) 33, and a terminal individual identification information analysis unit 34.
In the identification device 1 according to the present embodiment, as an example, various processes and controls are performed by executing software (for example, a program) stored in advance by a CPU (Central Processing Unit).

The identification device 1 according to this embodiment is connected to a line 2.
Here, various lines may be used as the line 2. For example, various network lines such as a core network line and a service provider line may be used.

In the communication system according to the present embodiment, the identification device 1 is provided in the server device. The server device is connected to the line 2.
In the communication system according to the present embodiment, a terminal device or a base station device that performs wired communication is connected to the line 2.
In the communication system according to the present embodiment, a terminal device that performs wireless communication is connected to the line 2 connected to the base station device by wirelessly communicating with the base station device.
In such a communication system according to the present embodiment, a terminal device that performs wired communication or a terminal device that performs wireless communication communicates (transmits or receives) a communication packet via the line 2.

An example of an operation performed in the identification device 1 according to the present embodiment is shown.
The communication monitoring unit 11 is connected to the line 2 and monitors communication packets that flow through the line 2 (for example, communication packets that flow on the network).
In the present embodiment, the communication monitoring unit 11 monitors a communication packet flowing on the line 2 (for example, a communication packet flowing on the network) in real time.
As another configuration example, the communication monitoring unit 11 inputs a communication packet saved (stored) in an electronic file in advance from an external storage device or an external communication device, and monitors the communication packet. It is also possible to target.

When the communication monitoring unit 11 acquires a communication packet to be monitored from the line 2 (as another configuration example, an external storage device or an external communication device), the communication protocol analysis unit 12 To the terminal identification information database 13.
In this embodiment, the communication packet monitored by the communication monitoring unit 11 is used to create a terminal identification information database in the communication protocol analysis unit 12 and the terminal identification information database 13.

The communication protocol analyzer 12 performs the following operation.
The communication flow constructing unit 31 constructs (reconstructs) a session (communication flow) based on the communication packet input from the communication monitoring unit 11, and sets the reconstructed session information (flow information) as a traffic determining unit. To 33.
As a specific example, the communication flow construction unit 31 has communication packet attributes (for example, a source IP address, a destination (destination) IP address, a source port number, a destination port number, a protocol number, etc.). A common communication packet is regarded as the same communication flow, and is used as information of one communication flow. Such information of one communication flow may be stored in the flow database 32 by the traffic determination unit 33 together with the communication time, for example.

Here, for example, the communication flow construction unit 31 includes information (for example, the address of the transmission source) that identifies the transmission source included in the communication packet and information (for example, the transmission destination) that identifies the transmission destination included in the communication packet. The session is reconstructed by using a set of communication packets whose combination with the address of the address matches. In this case, for example, a plurality of communication packets in which the transmission source information matches and the transmission destination information match (that is, communication packets in the same direction between the same devices) are aggregated, Two pieces of information in which the transmission source information of the communication packet and the transmission destination information of the other communication packet match and the transmission destination information of the one communication packet matches the transmission source information of the other communication packet. Communication packets (that is, communication packets in the opposite direction between the same devices) may be aggregated.
It should be noted that not only when the transmission source or transmission destination information of two communication packets match each other, but also when the transmission source or transmission destination information of two communication packets are similar to each other, Communication packets may be aggregated. For example, when the source or destination information of two communication packets are similar to each other, for example, a part of the address (for example, part or all after @) matches but the other part does not match May be used.
Further, the communication flow constructing unit 31 reconstructs a session using, for example, a set of a plurality of communication packets communicated in a predetermined time range. Various ranges may be used as the predetermined time range.

  The flow database 32 stores flow information and the like. Here, in the flow database 32, for example, flow information or the like may be initially stored, or the flow information or the like may be stored by the traffic determination unit 33 during operation, or the flow information may be stored in both of them. Information or the like may be stored. For example, initially stored flow information is information on cases such as initially set communication flows, and flow information stored during operation is a communication flow obtained as a result of learning during operation. It becomes information of case examples.

  Based on the flow information input from the communication flow construction unit 31, the traffic determination unit 33 determines whether the traffic corresponding to the flow information is foreground traffic or background traffic. Then, the traffic determination unit 33 outputs the flow information determined to be background traffic to the terminal individual identification information analysis unit 34, and does not output the flow information determined to be foreground traffic to the terminal individual identification information analysis unit 34. . That is, in this embodiment, the traffic determination unit 33 extracts only the flow information determined to be background traffic and outputs it to the terminal individual identification information analysis unit 34.

Here, the traffic determination unit 33 may use the flow information (communication flow case information) stored in the flow database 32 and the like when performing the above determination. As another configuration example, in the configuration in which the traffic determination unit 33 performs the above determination without using the flow information stored in the flow database 32, the flow database 32 may not be provided.
The flow information and the like stored in the flow database 32 includes, for example, information that can be used in the determination performed by the traffic determination unit 33, and is initially set or obtained by learning. The flow information and the like may include various information that can be used in the determination performed by the traffic determination unit 33.

  The terminal individual identification information analysis unit 34 analyzes the protocol information of the flow information based on the flow information (flow information determined to be background traffic) input from the traffic determination unit 33, thereby Information for identifying an individual device (terminal individual identification information) is analyzed, and information (terminal information) as a result of the analysis is output to the terminal identification information database 13.

With reference to FIG. 2, an example of the procedure of the process which determines the foreground traffic and the background traffic in the identification apparatus 1 which concerns on one Embodiment of this invention is shown.
FIG. 2 is a flowchart illustrating an example of a processing procedure for determining foreground traffic and background traffic in the identification device 1 according to an embodiment of the present invention.

(Step S1)
First, the communication monitoring unit 11 acquires (extracts) a communication packet.
(Step S2)
Next, the communication flow constructing unit 31 constructs (reconstructs) a communication flow based on the information of the communication packet acquired by the communication monitoring unit 11.
Subsequently, the traffic determination unit 33 performs the following processes (step S3) to (step S8) based on the communication flow information (flow information) constructed by the communication flow construction unit 31.

(Step S3)
The traffic determination unit 33 detects the number of contents in the flow information obtained by the communication flow construction unit 31, and determines whether the detected number of contents is smaller than a predetermined threshold (threshold regarding the number of contents). .
As a result of the determination, if the traffic determination unit 33 determines that the number of detected contents is smaller than the predetermined threshold (YES), the process proceeds to step S4. On the other hand, when the traffic determination unit 33 determines that the number of detected contents is equal to or greater than the predetermined threshold (NO), the traffic determination unit 33 proceeds to the process of step S8.
Here, as the number of contents, for example, the number of contents acquired simultaneously is used. Further, as the number of contents, for example, the number of contents included in one communication flow is used.

(Step S4)
The traffic determination unit 33 detects the number of access servers for the flow information obtained by the communication flow construction unit 31, and determines whether or not the detected number of access servers is smaller than a predetermined threshold value (threshold value regarding the number of access servers). Determine.
As a result of this determination, if the traffic determination unit 33 determines that the number of detected access servers is smaller than the predetermined threshold (YES), the process proceeds to step S5. On the other hand, when the traffic determination unit 33 determines that the number of detected access servers is equal to or greater than the predetermined threshold (NO), the traffic determination unit 33 proceeds to the process of step S8.
Here, as the number of access servers, for example, the number of servers that access simultaneously is used. Further, as the number of access servers, for example, the number of access servers included in one communication flow is used.

(Step S5)
The traffic determination unit 33 determines whether or not the flow information obtained by the communication flow construction unit 31 has communication periodicity (time-series periodicity).
As a result of this determination, if the traffic determination unit 33 determines that there is periodicity of communication (YES), the process proceeds to step S6. On the other hand, if the traffic determination unit 33 determines that there is no periodicity of communication (NO), the traffic determination unit 33 proceeds to the process of step S8.
Here, the traffic determination unit 33, for example, regarding the flow information obtained by the communication flow constructing unit 31, if periodic communication is included even if all communication is not periodic, communication periodicity A configuration may be used that determines that there is.
As the periodicity of communication, for example, the periodicity of transmission from the terminal device may be used, the periodicity of reception by the terminal device may be used, or transmission from the terminal device may be used. The periodicity of communication (transmission / reception) combined with reception by the terminal device may be used. Further, as the periodicity of communication, for example, the periodicity related to the start time of predetermined communication or the periodicity related to the time interval of predetermined communication may be used.
Further, as the time used when determining the presence or absence of periodicity, for example, a deviation (error) may be allowed within a predetermined range (for example, 5 minutes or 10 minutes).
Further, when determining the presence or absence of periodicity, for example, a Fourier transform process may be used.

(Step S6)
The traffic determination unit 33 detects the number of uplink (UL) communication packets and the number of downlink (DL) communication packets for the flow information obtained by the communication flow construction unit 31. . Note that UL is a link that flows from the terminal device to a higher-level device (for example, a base station device or a server), and DL is a link that flows from the higher-level device to the terminal device.
Then, based on the detection result of the communication packet, the traffic determination unit 33 has {(number of UL communication packets) / (number of DL communication packets)} equal to or less than a predetermined threshold C, or {(DL The number of communication packets) / (the number of UL communication packets)} is equal to or smaller than a predetermined threshold value D is determined. Note that various values may be set as the predetermined threshold C and the predetermined threshold D, respectively.
As a result of this determination, if the traffic determination unit 33 determines that the above condition is satisfied (YES), the process proceeds to step S7. On the other hand, when the traffic determination unit 33 determines that the above condition is not satisfied, that is, {(number of UL communication packets) / (number of DL communication packets)} is greater than a predetermined threshold C, and If it is determined that {(number of DL communication packets) / (number of UL communication packets)} is greater than the predetermined threshold D (NO), the process proceeds to step S8.

(Step S7)
The traffic determination unit 33 determines that the communication traffic corresponding to the flow information obtained by the communication flow construction unit 31 is background traffic. Then, the traffic determination unit 33 ends the process of this flow.
(Step S8)
The traffic determination unit 33 determines that the communication traffic corresponding to the flow information obtained by the communication flow construction unit 31 is foreground traffic. Then, the traffic determination unit 33 ends the process of this flow.

  Here, in the example of FIG. 2, the background traffic uses an estimation that the number of contents is smaller than the foreground traffic. In general, foreground traffic tends to acquire more content at the same time than background traffic. As an example, foreground traffic includes traffic such as browsing of a web page generated by an operation performed by a person (user).

  Further, in the example of FIG. 2, the background traffic uses an estimation that the number of access servers is smaller than the foreground traffic. In general, foreground traffic tends to access many servers at the same time in order to obtain more content at the same time than background traffic. For example, even when a single Web page is created, the server may be different for each piece of information in the Web page, and information may be obtained from a number of destination (request destination) servers.

Further, in the example of FIG. 2, the estimation that the background traffic is periodic compared to the foreground traffic is used. In general, background traffic tends to have periodicity in terms of the presence or absence of regular communication as compared to foreground traffic. As an example, the background traffic includes traffic such as automatic software update that occurs (automatically) regardless of an operation performed by a person (user).
For example, in the background traffic, the period (for example, once every 10 minutes, once every 20 minutes, etc.) for automatically accessing the server from the terminal device and acquiring update information differs depending on the OS or application. As an example, an alarm clock application may be one in which a terminal device accesses a server and acquires update information once a day. As another example, in a mail application, a terminal device may access a server at a predetermined time interval to check whether there is a received mail or to receive it.
Conversely, in foreground traffic, traffic (for example, a large amount) occurs at random timing due to an operation performed by a person (user).

  In the example of FIG. 2, background traffic uses an estimation that the difference between the number of UL communication packets and the number of DL communication packets is large (the ratio is biased) compared to foreground traffic. . In general, background traffic tends to be biased toward either the amount of upload and the amount of download compared to foreground traffic. As an example, in a service that distributes information such as weather from a server to a terminal device, the amount of download (number of DL communication packets) is larger. Conversely, as an example, in a service in which measurement information of a person (user) is transmitted from the terminal device to the server and managed by the server, the upload amount (number of UL communication packets) is larger.

  The example of FIG. 2 is an example, and various conditions may be used as conditions for determining foreground traffic and background traffic, and one or more various conditions may be used. Good. In addition, as a condition for determining foreground traffic and background traffic, a condition using various parameters may be used, and various statistical information and heuristic information may be used. Further, as a method of determining foreground traffic and background traffic, for example, a flow for determining each of a plurality of parameters as in the present embodiment may be used, or each parameter may be weighted. A method of comprehensively determining a plurality of parameters may be used by determining the value obtained by giving the sum and the like.

As another viewpoint for determining the foreground traffic and the background traffic, for example, the background traffic tends to be limited to one or a small number of servers with which the terminal device communicates for each application, while the foreground traffic is limited. There is a viewpoint that the other party's server with which the terminal device communicates tends to vary depending on the preference of the person (user) in the traffic.
As another viewpoint for determining the foreground traffic and the background traffic, for example, there is an aspect in which the background traffic has some pattern and the foreground traffic tends not to have the pattern.

As another example of the process of determining foreground traffic and background traffic, the sessions are grouped for each combination of source information and destination information, and the autocorrelation calculation results for the occurrence timing of each session for each group. A process of identifying a session based on it (determining that background traffic is high when autocorrelation is high) may be used. In addition, a process of identifying a session in consideration of a calculation result of cross-correlation between occurrence timings between sessions of different groups (determining that background traffic is high when the cross-correlation is high) may be used. In addition, a process for identifying a session having a high cross-correlation with a session identified as background traffic from the background may be used.
In addition, when the difference between the occurrence timings of the sessions is small, a process for determining that the foreground traffic is used may be used. In addition, a process using a session identified as foreground traffic may be used as a comparison target session in this process.

  Note that the tendency of foreground traffic and the tendency of background traffic may differ depending on, for example, the OS or application installed in the terminal device. Foreground traffic that does not satisfy the trend (for example, that satisfies the background traffic trend), or for background traffic that does not satisfy the trend (for example, foreground traffic trend) However, as a large tendency, it can be regarded as noise, and a practically sufficient accuracy can be determined.

Next, the analysis performed by the terminal individual identification information analysis unit 34 will be described in detail.
In this embodiment, the analysis result of the communication protocol information in the communication protocol analysis unit 12 is obtained by the analysis performed by the terminal individual identification information analysis unit 34 on the flow information determined to be background traffic. The communication protocol analysis unit 12 acquires terminal information such as OS information in the communication protocol information by analyzing the communication protocol information. The communication protocol analysis unit 12 outputs the acquired terminal information to the terminal identification information database 13.
In the present embodiment, the communication protocol analysis unit 12 acquires application information or the like in the communication protocol information when analyzing communication protocol information, and terminal information such as OS information based on the acquired application information or the like. To get. This acquisition may be performed by analogy, for example.

Here, in general, there is information in the communication protocol that explicitly includes information (terminal information) indicating the type of the terminal device that executes the communication protocol in the information of the application. In the present embodiment, the terminal individual identification information analysis unit 34 acquires such terminal information.
Further, the procedure for acquiring terminal information from communication protocol information is defined in advance for each communication protocol and is realized in the form of a program or the like.
Such a function of the terminal individual identification information analysis unit 34 corresponds to a function of Deep Packet Inspection.

  Here, information indicating the type of the terminal device is used as the terminal information. For example, information indicating the type of OS installed in the terminal device (OS information), information indicating the model name of the terminal device (model name information) ), Information indicating the number of the terminal device (number information), or the like can be used.

As an example, a case where a TCP / IP communication protocol is used will be described. As application information of the TCP / IP communication protocol, HTTP (Hyper Text Transfer Protocol) information, which is an application layer protocol, is used.
The communication flow construction unit 31 rearranges the obtained plurality of communication packets (communication packet group) as a process of reconstructing the communication flow based on the communication packets, and removes the TCP / IP (except for retransmission). Reproduce the session (communication flow). Then, the terminal individual identification information analysis unit 34 analyzes the application layer protocol (HTTP) placed on the TCP / IP session (communication flow). Thereby, the terminal individual identification information analysis part 34 analyzes a communication protocol in an application level, and acquires terminal information.

  As a specific example, the HTTP protocol often includes a user agent header (User-Agent: header) in the following format.

(User-Agent: header example)
User-Agent: Mozilla / 5.0 (*********; U; ****** NT 6.0; ja; rv: 1.9.0.6) Gecko / 200901913 13 Firefox .0.6 (.NET CLR 3.5.30729)

Here, “Mozilla / 5.0” is information indicating the browser version (browser type).
Further, “******* NT 6.0” is information indicating the OS version (OS type).
Note that the character string “Windows (registered trademark)” is used as “***-***” in the above (User-Agent: header example) and description thereof (provided that “(registered trademark)”). ”Is added for convenience and is not included in the character string.)

  In this example, since the User-Agent: header includes information indicating the OS version in addition to the information indicating the browser version, the terminal individual identification information analysis unit 34 uses the User-Agent: header. From this, it is possible to obtain OS information.

  As another example, when there is an application provided only to a specific OS, when it is specified that the application is used, the terminal individual identification information analysis unit 34 OS information can be obtained.

  Here, the User-Agent: header includes information indicating an application type, information such as a version number, information indicating an OS type, and the like. In addition, the number of terminal devices using the same User-Agent (all of the plurality of pieces of information included in the User-Agent are the same) is small, and there is often one.

As a specific example, a terminal device such as a smartphone often uses HTTP in various applications. As an example, a terminal device uses a “weather forecast application that is the 2.3 version”, and other terminal devices use “(same as above) weather forecast application. In this case, these two terminal devices are identified by the difference in their versions even though they are (same) weather forecast applications. Can do. As another example, it is also possible to identify each terminal device based on the fact that the same kind of application used by the terminal device is different (for example, the weather forecast application itself is different).
And, it is considered that there are few terminal devices in which the combination of such applications and versions is completely the same, especially when considering the combination of a plurality of applications. The terminal device can be identified (specified). For example, when a combination of a plurality of User-Agent information is used, a combination of information on a plurality of applications used by the same terminal device (for example, a terminal device using the same IP address) can be identified (specified).

  In addition, for example, an address of a mobile network such as 3GPP (for example, an IP address) and an address such as a WiFi (Wireless Fidelity) network (for example, an IP address) are different from each other. It becomes. In this embodiment, after identifying (specifying) an individual terminal device, linking between different networks (for example, between different intra-network identifiers) is performed. In this embodiment, this association is performed by the terminal identification information database 13 or the terminal individual identification unit 14.

In addition, for example, the terminal individual identification information analysis unit 34 analyzes one or more of the following (Information Example 1) to (Information Example 5) in addition to HTTP, and obtains the result. It can also be set as the structure which outputs, and it is preferable. Other information may also be used.
When information of a plurality of different fingerprints (Fingerprint) is used in combination, the accuracy can be further improved.

(Information Example 1) Information on a fingerprint of TCP can be used.
(Example 2 of information) Information on the fingerprint of the browser can be used. For example, information such as a header output by the Web browser, an installed plug-in, and a plug-in version can be used.
(Example 3 of information) Fingerprint information of a clock skew of a terminal device can be used. For example, information of a fingerprint of a device using a clock skew (Device) can be used.
(Example 4 of information) Information on the fingerprint of the access destination of the terminal device can be used. For example, information on the host (Host) of the access destination can be used.
(Example 5 of information) The information of the fingerprint of the application (other than HTTP) of the terminal device can be used. For example, the information of the browsing setting of the application of the moving image can be used.

The terminal identification information database 13 is information obtained from the communication packet input from the communication monitoring unit 11 and the terminal obtained from the communication protocol analysis unit 12 (in this embodiment, the terminal individual identification information analysis unit 34). Based on the information, information related to these is also recorded and held (stored) as terminal identification information. Thereby, a terminal identification information database is created in the terminal identification information database 13.
In this embodiment, the terminal identification information database 13 is network-related information (information related to a network) including terminal information obtained by inputting from the communication protocol analysis unit 12 as terminal identification information and information on an in-network identifier. And the like are recorded.

Here, the intra-network identifier is an identifier that can identify a terminal device in the same network. For example, an address is used, and an IP address is used in a general IP network.
Further, as the network-related information, for example, network information (network information) and time information (time information) can be used in addition to the information on the in-network identifier.

For example, the network related information is acquired from the information of the communication packet obtained by being input from the communication monitoring unit 11 in the terminal identification information database 13 (or from the terminal information obtained by being input from the communication protocol analyzing unit 12). .
In the present embodiment, the terminal identification information database 13 includes, for example, information (for example, network related information) indicating the characteristics of a communication packet obtained based on the information of the communication packet obtained by being input from the communication monitoring unit 11. Has a function to acquire. This function corresponds to the function of Shallow Packet Inspection. As another configuration example, the communication monitoring unit 11 may have a Shallow Packet Inspection function, and information on the result may be output from the communication monitoring unit 11 to the terminal identification information database 13.

FIG. 3 is a diagram showing an example of terminal identification information stored in the terminal identification information database 13 according to an embodiment of the present invention.
In the present embodiment, the terminal identification information stored in the terminal identification information database 13 is configured by associating network-related information with terminal information.
In the example of FIG. 3, as network-related information, information specifying an in-network identifier assigned to a terminal device (intra-network identifier information), information specifying a network used by the terminal device (network information), Information (time information) that identifies the time at which the terminal device used the network is used. Note that various pieces of network-related information may be used in various combinations.
In the example of FIG. 3, information relating to HTTP, information relating to a TCP fingerprint, information relating to an output header of a Web browser, and the like are used as terminal information. Various pieces of terminal information may be used in various combinations.

The terminal individual identification unit 14 refers to the terminal identification information stored in the terminal identification information database 13 and, based on this, determines that it is the terminal device of the same individual (for example, estimated as such) ( Information on the detected terminal device is output.
In this embodiment, the terminal individual identification part 14 totals the information stored in the terminal identification information database 13, and for each terminal device determined to be the terminal device of the same individual, The information is output in association with time information (time information) or network information (network information). The intra-network identifier may be, for example, a group of two or more intra-network identifiers in different networks.

Here, the terminal device of the same individual is determined when, for example, all the pieces of information included in the terminal information in the terminal identification information match.
Further, the information on the identifier in the network, the time information, and the network information are acquired from the network related information in the terminal identification information obtained by being input from the terminal identification information database 13, for example.

As an example, based on the terminal identification information according to the example of FIG. 3, the terminal individual identification unit 14 determines that “a certain user's terminal device has a time period in the range of 00: 00: 00: 00 to 01: 00: 00: 00. In the network A, the communication using the address a is performed. However, the communication using the address b is performed in the network B in the time zone in which the time is in the range of 03: 00: 00: 00 to 05:00. And output the information. In this case, the terminal individual identification unit 14 uses the terminal information obtained for the terminal device that has performed communication using the address a in the network A and the terminal device that has performed communication using the address b in the network B. When it is determined that the obtained terminal information matches for all, a predetermined part, or a predetermined threshold (for example, the number or the ratio) or more, It is determined that these terminal devices are terminal devices of the same individual.
As a specific example, in a LTE (Long Term Evolution) system, a WiFi system, or the like, temporary identification information (address) is given to the terminal device when the terminal device is accommodated. Thereby, the identification information (address) used by the terminal device can change for each system (network).

  As described above, in the identification device 1 according to the present embodiment, for example, the communication device is statically monitored, and the individual pieces of terminal devices are identified by combining various information collected using Deep Packet Inspection. . In the identification device 1 according to the present embodiment, for example, an individual terminal device is uniquely identified by using a characteristic of a communication method unique to each terminal device. Thereby, in the identification device 1 according to the present embodiment, it is possible to identify the individual terminal device that has transmitted (sent) the communication packet obtained by the communication monitoring unit 11 to the communication network (line 2 in the present embodiment). it can.

  Thus, according to the identification device 1 according to the present embodiment, the individual identification of the terminal device can be performed effectively. For example, the individual identification of the terminal device can be performed at high speed, high accuracy, and low cost. It becomes possible. According to the identification device 1 according to the present embodiment, for example, it is possible to anonymize and specify each terminal device. In addition, according to the identification device 1 according to the present embodiment, it is possible to link the same terminal device between a plurality of different networks such as a mobile network such as 3GPP or a WiFi network. Can help improve the network.

Further, in the identification device 1 according to the present embodiment, the individual terminal device is identified using the background traffic information among the foreground traffic and the background traffic.
Thus, according to the identification device 1 according to the present embodiment, the individual identification of the terminal device can be performed with high accuracy.

Here, the distinction between foreground traffic and background traffic will be described in detail.
For example, it is effective not only to specify the type and OS of the terminal device but also to identify the terminal device individually. Individual identification of a terminal device is, for example, various information collected using Deep Packet Inspection in a device that performs static monitoring of communication contents without requiring active ID registration of the user of the terminal device. Is possible by combining
By the way, in terminal devices such as smartphones and personal computers (PCs), traffic of various applications is generated. Such traffic is roughly classified into two types, foreground traffic and background traffic. In order to perform individual identification of a terminal device, it is necessary to accurately extract a unique feature of the terminal device from a communication packet. In general, foreground traffic affects the mood and interest of the user of the terminal device, and these changes may cause changes in characteristics, which may deteriorate the accuracy of individual identification of the terminal device. . Therefore, in this embodiment, when individual identification of a terminal device is performed, not all traffic is used, but only background traffic is used. In the identification device 1 according to the present embodiment, for example, the communication contents of a terminal device are statically monitored, and only communication packets that occur without the user of the terminal device being conscious are extracted, and Deep Packet Inspection is used. The individual information of the terminal device is identified by combining various information collected in this way.

[Configuration example according to the above embodiment]
Here, (Configuration Example 1) to (Configuration Example 6) according to the present embodiment are shown.
(Configuration example 1)
The identification device 1 includes a communication monitoring unit 11 that acquires information on a communication packet to be monitored, a communication flow building unit 31 that reconstructs a communication flow based on information on the communication packet acquired by the communication monitoring unit 11, The communication flow reconstructed by the communication flow construction unit 31 corresponds to the first traffic (foreground traffic in the present embodiment) that is estimated to have occurred due to an operation performed by a person, or The traffic determination unit 33 that determines whether or not the second traffic (background traffic in this embodiment) is estimated to have occurred without being caused by an operation performed by a person, and the traffic determination unit 33 By analyzing the communication protocol of the communication flow (only) determined to correspond to the second traffic, A terminal individual identification information analysis unit 34 for acquiring information related to individual identification of the terminal device that has transmitted the communication packet, information acquired by the terminal individual identification information analysis unit 34 (for example, terminal information), and the communication monitoring A terminal identification information database (information storage unit) 13 that stores information (for example, network-related information) indicating characteristics of the communication packet obtained based on the information of the communication packet acquired by the unit 11.

In the identification device 1 according to this (configuration example 1), an individual terminal device can be identified by information stored in the terminal identification information database (information storage unit) 13. Specifically, in the identification device 1 according to (Configuration Example 1), by outputting information stored in the terminal identification information database (information storage unit) 13 to an external device or the like, the external device or the like The individual terminal device can be identified based on the input information.
Note that, in the identification device 1 according to this (Configuration Example 1), the communication monitoring unit 11 that acquires information on the communication packet to be monitored may directly process the communication packet flowing on the line (network), for example, Alternatively, as another configuration example, processing may be performed on communication packet information stored in a file or the like.

(Configuration example 2)
In the identification device 1 described in the above (Configuration Example 1), the information indicating the characteristics of the communication packet includes information on an in-network identifier, and is further stored in the terminal identification information database (information storage unit) 13 A terminal individual identification unit 14 that outputs information on the identifier in the network is provided for each terminal device that is assumed to be the same terminal device individual based on the information.

(Configuration example 3)
In the identification device 1 described in (Configuration Example 2) described above, the information indicating the characteristics of the communication packet further includes time information and network information. The terminal individual identification unit 14 Information is output together with time information and network information.

(Configuration example 4)
In the identification device 1 described in any one of (Configuration Example 1) to (Configuration Example 3) described above, the terminal individual identification information analysis unit 34 is configured to use User-Agent information in the HTTP protocol, or TCP Fingerprint information, header information output by a web browser, installed plug-in information, plug-in version information, clock skew information of the terminal device, or the terminal device One or more of the information of the access destination host or the browsing setting information of the moving image application of the terminal device is acquired.

(Configuration example 5)
In the identification method performed in the identification device 1, the communication monitoring unit 11 acquires information on the communication packet to be monitored, and the communication flow construction unit 31 is based on the communication packet information acquired by the communication monitoring unit 11. The communication flow is reconstructed, and the traffic determination unit 33 corresponds to the first traffic that is estimated to be generated due to the operation performed by the person with respect to the communication flow reconstructed by the communication flow construction unit 31. Or the terminal individual identification information analysis unit 34 uses the traffic determination unit 33 to determine whether the second traffic estimated to have occurred without being caused by an operation performed by a person. By analyzing the communication protocol of the communication flow determined to correspond to the traffic of the terminal device, it is possible to identify the individual terminal device that has transmitted the communication packet. The terminal identification information database (information storage unit) 13 based on the information acquired by the terminal individual identification information analysis unit 34 and the information of the communication packet acquired by the communication monitoring unit 11. Information indicating characteristics of the obtained communication packet is stored.

(Configuration example 6)
A program (identification program) that is used and executed in the identification device 1 is acquired by the communication monitoring unit 11 by the communication monitoring unit 11 and the communication flow construction unit 31 by the communication monitoring unit 11. The communication flow is reconstructed based on the information of the communication packet to be generated, and the traffic determination unit 33 generates the communication flow reconstructed by the communication flow construction unit 31 due to an operation performed by a person. Determining whether to correspond to the first traffic estimated to have occurred or to correspond to the second traffic estimated to have occurred without being caused by an operation performed by a person, and terminal individual identification information analysis A communication protocol of the communication flow determined by the traffic determination unit 33 to correspond to the second traffic. And the terminal identification information database (information storage unit) 13 is acquired by the terminal individual identification information analysis unit 34 by acquiring information relating to individual identification of the terminal device that has transmitted the communication packet. Storing the information and the information indicating the characteristics of the communication packet obtained based on the information of the communication packet acquired by the communication monitoring unit 11.

[Summary of the above embodiments]
Here, in the above embodiment, communication using TCP / IP is taken as an example, but the present invention is not necessarily limited thereto, and can be widely applied to communication services in general.
Similarly, the target communication protocol is not limited to a specific communication protocol. For example, the target communication protocol can be widely applied to communication protocols including information related to individual terminal devices (for example, types). is there. As a specific example of the communication protocol, for example, it is possible to apply to SMTP (Simple Mail Transfer Protocol) other than HTTP.

  In the above embodiment, the OS information, the model name information, and the number information are exemplified as information for identifying the type of the terminal device, but various other information may be used. Specifically, as information for identifying the type of the terminal device, for example, information indicating middleware version (middleware type) or a specific application version (specific application type) other than the OS as a main It is also possible to use information indicating

  Various terminal devices may be used. For example, a terminal device such as a mobile phone including a smartphone, a personal computer (PC), a home gateway, or a dedicated terminal can be used.

  As mentioned above, although embodiment of this invention was explained in full detail with reference to drawings, the concrete structure is not restricted to this embodiment, The design change etc. of the range which does not deviate from the summary of this invention are included.

  Further, a program for realizing all or part of the functions of the identification device 1 according to the embodiment described above is recorded on a computer-readable recording medium, and the program recorded on the recording medium is stored in a computer system. Processing may be performed by reading and executing.

The “computer system” mentioned here may include an operating system (OS) and hardware such as peripheral devices.
The “computer-readable recording medium” means a flexible disk, a magneto-optical disk, a ROM (Read Only Memory), a writable nonvolatile memory such as a flash memory, a portable medium such as a DVD (Digital Versatile Disk), A storage device such as a hard disk built in a computer system.

Further, the “computer-readable recording medium” refers to a volatile memory (for example, DRAM (DRAM) inside a computer system that becomes a server or a client when a program is transmitted through a network such as the Internet or a communication line such as a telephone line. Dynamic Random Access Memory)) that holds a program for a certain period of time is also included.
The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting a program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
Further, the above program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

DESCRIPTION OF SYMBOLS 1 ... Identification device, 2 ... Line, 11 ... Communication monitoring part, 12 ... Communication protocol analysis part, 13 ... Terminal identification information database (information storage part), 14 ... Terminal individual identification part, 31 ... Communication flow construction part, 32 ... Flow database, 33 ... traffic determination unit (foreground / background traffic determination unit), 34 ... terminal individual identification information analysis unit

Claims (6)

A communication monitoring unit for acquiring information of a communication packet to be monitored;
A communication flow constructing unit for reconstructing a communication flow based on information of a communication packet acquired by the communication monitoring unit;
The communication flow reconstructed by the communication flow construction unit corresponds to the first traffic estimated to have occurred due to an operation performed by a person, or does not result from an operation performed by a person A traffic determination unit for determining whether the second traffic estimated to have occurred corresponds to the second traffic;
Terminal individual identification information analysis for acquiring information related to individual identification of the terminal device that has transmitted the communication packet by analyzing a communication protocol of the communication flow determined to correspond to the second traffic by the traffic determination unit And
An information storage unit that stores information acquired by the terminal individual identification information analysis unit, and information indicating characteristics of the communication packet obtained based on information of the communication packet acquired by the communication monitoring unit;
An identification device comprising: The information indicating the characteristics of the communication packet includes information on an in-network identifier,
Furthermore, based on the information stored in the information storage unit, for each terminal device that is assumed to be the same terminal device individual, a terminal individual identification unit that outputs information of the identifier in the network,
The identification device according to claim 1. The information indicating the characteristics of the communication packet further includes time information and network information,
The terminal individual identification unit outputs information on the in-network identifier together with time information and network information.
The identification device according to claim 2. The terminal individual identification information analysis unit,
User-Agent information in the HTTP protocol,
Or TCP fingerprint information,
Alternatively, header information output by the Web browser, information on installed plug-ins, and information on the versions of the plug-ins,
Or information on the clock skew of the terminal device,
Or information on the host to which the terminal device is accessed,
Or information on the viewing settings of the video application of the terminal device,
Get one or more of
The identification device according to any one of claims 1 to 3. The communication monitoring unit obtains information about the communication packet to be monitored,
The communication flow construction unit reconstructs the communication flow based on the information of the communication packet acquired by the communication monitoring unit,
The traffic determination unit corresponds to the first traffic estimated to be generated due to an operation performed by a person with respect to the communication flow reconstructed by the communication flow construction unit, or is performed by a person Determine whether it corresponds to the second traffic estimated to have occurred without being caused by the operation,
Information relating to the individual identification of the terminal device that has transmitted the communication packet by analyzing the communication protocol of the communication flow determined by the traffic determination unit to correspond to the second traffic by the terminal individual identification information analysis unit Get
An information storage unit stores information acquired by the terminal individual identification information analysis unit and information indicating characteristics of the communication packet obtained based on information of the communication packet acquired by the communication monitoring unit.
Identification method. A communication monitoring unit acquiring information of a communication packet to be monitored;
A communication flow constructing unit reconstructing a communication flow based on information of a communication packet acquired by the communication monitoring unit;
The traffic determination unit corresponds to the first traffic estimated to be generated due to an operation performed by a person with respect to the communication flow reconstructed by the communication flow construction unit, or is performed by a person Determining whether it corresponds to second traffic estimated to have occurred without being caused by an operation;
Information relating to the individual identification of the terminal device that has transmitted the communication packet by analyzing the communication protocol of the communication flow determined by the traffic determination unit to correspond to the second traffic by the terminal individual identification information analysis unit Step to get the
An information storage unit storing information acquired by the terminal individual identification information analysis unit, and information indicating characteristics of the communication packet obtained based on information of the communication packet acquired by the communication monitoring unit; ,
Identification program for causing a computer to execute.

Images