Apparatus and method for identifying an access network of a networked terminal

1. An apparatus for identifying an access network, the apparatus comprising:

a packet capturing unit configured to capture a plurality of packets transmitted or received by a server;

a flow classifying unit configured to classify each of the captured packets into individual flows with reference to at least one of an origination address, a destination address, and a port number;

a round trip time (RTT) calculating unit configured to calculate RTT values from the packets classified into a flow of the individual flows;

an access network determining unit configured to determine that an origination address included in a packet classified into the flow is an address accessing the server through a first communication network when the RTT calculated values exceed a reference value; and

a storage unit configured to store the address accessing the server through the first communication network.

2. The apparatus of claim 1 , wherein the reference value is set to a value in a range of 25 to 60 milliseconds (ms).

3. The apparatus of claim 1 , wherein the first communication network comprises a 3G mobile communication network.

4. The apparatus of claim 1 , wherein the flow is a Transmission Control Protocol (TCP) flow.

5. The apparatus of claim 1 , wherein the RTT values comprise a time difference between a transmission time of a ‘SYN+ACK packet’ transmitted from the server and a reception time of a corresponding ‘ACK packet’.

6. The apparatus of claim 1 , wherein the access network determining unit compares a first count comprising a number of cases in which the calculated RTT values exceed the reference value with a second count comprising a number of cases in which the calculated RTT values do not exceed the reference value, and determines that the origination address is a terminal address accessing through the first communication network when the first count is greater than the second count, with respect to a plurality of flows received from the origination address.

7. The apparatus of claim 1 , wherein the access network determining unit excludes a terminal address from a list of the first communication network when a sum of a number of cases in which the calculated RTT values exceed the reference value and a number of cases in which the calculated RTT values do not exceed the reference value is a preset number, with respect to a plurality of flows received from the terminal address.

8. The apparatus of claim 5 , further comprising a user agent (UA) inspecting unit configured to inspect a UA item in header information of a packet captured through the flow and to exclude the packet's origination address from a list of the first communication network when the UA item is not a system configured to use the first communication network.

9. The apparatus of claim 8 , wherein the packet captured through the flow is an ‘HTTP request packet’ transmitted to the server after transmission of the ‘ACK packet’.

10. The apparatus of claim 1 , further comprising an address converting unit configured to convert the origination address of a terminal on the respective flows into a network address to allow the access network determining unit to determine the access network with respect to the network address.

11. The apparatus of claim 10 , wherein the origination address of the terminal comprises an Internet Protocol (IP) address of 32 bits, and the network address comprises a range of bits selected from upper 24 to 31 bits in the 32 bit IP address.

12. The apparatus of claim 1 , further comprising an IP determining unit configured to determine whether the origination address of a terminal is an address received from overseas and to exclude the origination address of the terminal from a list of the first communication network.

13. The apparatus of claim 1 , further comprising a network operator classifying unit configured to determine a network operator for the origination address of a terminal with reference to a network operator IP list database.

14. A method for identifying an access network, the method comprising:

capturing with a packet capturing unit a plurality of packets transmitted or received by a server;

classifying with a flow classifying unit each of the captured packets into individual flows with reference to at least one of an origination address, a destination address, and a port number;

calculating with a round trip time (RTT) calculating unit, RTT values from the packets classified into a flow of the individual flows;

determining with an access network determining unit that an origination address included in a packet classified into the flow is an address accessing the server through a first communication network when the RTT calculated values exceed a reference value; and

storing with a storage unit the address accessing the server through the first communication network.

15. The method of claim 14 , wherein the reference value is set to a value in a range of 25 to 60 milliseconds (ms).

16. The method of claim 14 , wherein the RTT values comprise a time difference between a transmission time of a ‘SYN+ACK packet’ transmitted from the server and a reception time of a corresponding ‘ACK packet’.

17. The method of claim 14 , wherein the access network determining unit compares a first count comprising a number of cases in which the calculated RTT values exceed the reference value with a second count comprising a number of cases in which the calculated RTT values do not exceed the reference value, and determines that the origination address is a terminal address accessing through the first communication network when the first count is greater than the second count, with respect to a plurality of flows received from the origination address.

18. The method of claim 14 , wherein the access network determining unit excludes a terminal address from a list of the first communication network when a sum of a number of cases in which the calculated RTT values exceed the reference value and a number of cases in which the calculated RTT values do not exceed the reference value is a preset number, with respect to a plurality of flows received from the terminal address.

19. The method of claim 16 , further comprising inspecting with a UA inspecting unit a UA item in header information of a packet captured through the flow and to exclude the packet's origination address from a list of the first communication network when the UA item is not a system configured to use the first communication network.

20. One or more non-transitory computer-readable storage media having stored thereon a computer program that, when executed by one or more processors, causes the one or more processors to perform acts comprising:

capturing with a packet capturing unit a plurality of packets transmitted or received by a server;

classifying with a flow classifying unit each of the captured packets into individual flows with reference to at least one of an origination address, a destination address, and a port number;

calculating with a round trip time (RTT) calculating unit, RTT values from the packets classified into a flow of the individual flows;

determining with an access network determining unit that an origination address included in a packet classified into the flow is an address accessing the server through a first communication network when the RTT calculated values exceed a reference value; and

storing with a storage unit the address accessing the server through the first communication network.