Device and a method for detecting keep-alive and a recording medium thereof

A device for detecting keep-alive, comprising:

• a collecting unit for collecting or capturing a plurality of packets transceiving between a plurality of wireless terminals and a plurality of servers;
• a preprocessing unit for mapping collecting or capturing time information of the packets which collected or captured by the collecting unit to at least one of identification information of wireless terminal, server identification information and port information;
• a slot allocation unit for allocating the mapped packets to each time slots on a timeline which generated according to the collecting or capturing time information;
• an ID(identification) assigning unit for assigning IDs to each sections on the timeline, wherein the assigning unit assigning same IDs to sections having time slots in which the packets are continuously allocated within a predetermined range;
• and
• a keep-alive detection unit for setting the sections which assigned same IDs to periodic sections, and for determining the periodic sections as keep-alive when the port information of the packets allocated to the time slots on the periodic sections is continuously unchanged.

A method for detecting keep-alive, comprising:

• collecting or capturing, a plurality of packets transceiving between a plurality of wireless terminals and a plurality of servers;
• mapping, collecting or capturing time information of the packets to at least one of identification information of wireless terminal, server identification information and port information;
• allocating, the mapped packets to each time slots on a timeline which generated according to the collecting or capturing time information;
• assigning, IDs to each sections on the timeline, wherein the assigning unit assigning same IDs to sections which having the time slots in which the packets are continuously allocated within a predetermined range;
• setting, the sections which having same IDs to periodic sections;
• and
• determining, the periodic sections to keep-alive sections when port information of the packets allocated to the time slots on the periodic sections is continuously unchanged.