An electronic apparatus, comprising: a communication interface; and a processor configured to receive log data of a plurality of devices (201, 202, 203, 204), the plurality of devices being connected to a network through the communication interface, the network corresponding to an internal private network to which a public internet protocol, IP, address is allocated, acquire operation time information of each of the devices (201, 202, 203, 204) from the received log data, the operation time information corresponding to a time index based on the log data of each of the plurality of devices (201, 202, 203, 204), the time index including compressed time slots, which is generated by compressing time data into a bitmap in a predetermined time unit and which represents a time zone in which each device (210, 202, 203, and 204) connected to the network appears, calculate similarity of the operation time between the plurality of devices (201, 202, 203, 204) based on the acquired operation time information, identify a device group including two or more devices among the plurality of devices (201, 202, 203, 204) in which the calculated similarity of the operation time between the two or more devices is equal to or greater than a predetermined reference value, and assign a cluster identification, ID, to the identified device group to manage the two or more devices included in the identified device group, wherein the processor is configured to identify the device group by generating a graph-based cluster in which the two or more devices are connected to each other, the device group being utilized for a predetermined target service. a communication interface; and a processor configured to receive log data of a plurality of devices (201, 202, 203, 204), the plurality of devices being connected to a network through the communication interface, the network corresponding to an internal private network to which a public internet protocol, IP, address is allocated, acquire operation time information of each of the devices (201, 202, 203, 204) from the received log data, the operation time information corresponding to a time index based on the log data of each of the plurality of devices (201, 202, 203, 204), the time index including compressed time slots, which is generated by compressing time data into a bitmap in a predetermined time unit and which represents a time zone in which each device (210, 202, 203, and 204) connected to the network appears, calculate similarity of the operation time between the plurality of devices (201, 202, 203, 204) based on the acquired operation time information, identify a device group including two or more devices among the plurality of devices (201, 202, 203, 204) in which the calculated similarity of the operation time between the two or more devices is equal to or greater than a predetermined reference value, and assign a cluster identification, ID, to the identified device group to manage the two or more devices included in the identified device group, wherein the processor is configured to identify the device group by generating a graph-based cluster in which the two or more devices are connected to each other, the device group being utilized for a predetermined target service.