Patent Description:
Big data refers to a large amount of structured or unstructured data set that exceeds capabilities of data collection, storage, management, and analysis of existing database management tools. Big data processing technology collects, stores, manages, and analyzes the large amount of structured or unstructured data set to extract values or analyze desired results.

The relationship between big data and statistics is complementary, and the situations of social or natural groups may be expressed numerically by statistical access to big data. Therefore, the big data processing technology is being applied as a base technology to apply and utilize statistical techniques for a large amount of data.

However, in general, the above statistical figures roughly represent tendency or propensity of a group, and there is a limit in that it is difficult to understand a specific relationship with individuals within a certain region or group. The big data refers to a large amount of structured or unstructured data set that exceeds capabilities of data collection, storage, management, and analysis of the existing database management tools. The big data processing technology collect, store, manage, and analyze the large amount of structured or unstructured data set to extract values or analyze desired results.

However, the above statistical figures roughly represent tendency or propensity of a group, and there may be a limit in that it is difficult to understand a specific relationship with individuals within a certain region or group. <CIT> discloses an anomaly-detection computer system.

An object of the disclosure is to provide provides an electronic apparatus capable of generating a device group including a plurality of devices with relatively high similarity in a network by calculating similarity between the devices connected to the network and a method for controlling the same.

According to an aspect of the present disclosure, an electronic apparatus includes: a communication interface; and a processor configured to receive log data of a plurality of devices, the plurality of devices being connected to a network through the communication interface, the network corresponding to an internal private network to which a public internet protocol IP address is allocated, acquire operation time information of each of the devices from the received log data, the operation time information corresponding to a time index based on the log data of each of the plurality of devices, the time index including compressed time slots, which is generated by compressing time data into a bitmap in a predetermined time unit and which represents a time zone in which each device connected to the network appears, calculate similarity of the operation time between the plurality of devices based on the acquired operation time information, identify a device group including two or more devices among the plurality of devices in which the calculated similarity of the operation time between the two or more devices is equal to or greater than a predetermined reference value, and assign a cluster identification, ID, to the identified device group to manage the two or more devices included in the identified device group, wherein the processor is configured to identify the device group by generating a graph-based cluster in which the two or more devices are connected to each other, the device group being utilized for a predetermined target service.

The processor may extract a timestamp of each of the devices from the received log data, and generate a time index indicating the operation time information from the extracted timestamp, and the time index may include a bitmap-based compressed time slot.

The calculated similarity may have a value between <NUM> and <NUM>, the processor may be configured to identify the device group including a corresponding device when the calculated similarity of the operation time between the plurality of devices is equal to or greater than the predetermined reference value, and remove a corresponding device from the device group when the calculated similarity of the operation time between the plurality of devices is smaller than the predetermined reference value.

The processor may represent the determined device group as a graph in which two or more devices of the device group are connected to each other. The processor may be configured to provide an image represented by the graph based-cluster in which the two or more devices are connected to each other to at least one external apparatus through the communication interface or may display the image represented by the graph-based cluster in which the two or more devices are connected to each other on a display.

According to another aspect of the present disclosure, a method of controlling an electronic apparatus includes: receiving log data of a plurality of devices, the plurality of devices being connected to a network through a communication interface, the network corresponding to an internal private network to which a public internet protocol, IP, address is allocated; acquiring operation time information of each of the devices from the received log data, the operation time information corresponding to a time index based on the log data of each of the plurality of devices; the time index including compressed time slots, which is generated by compressing time data into a bitmap in a predetermined time unit and which represents a time zone in which each device connected to the network appears; calculating similarity of the operation time between the plurality of devices based on the acquired operation time information; identifying a device group including two or more devices in which the calculated similarity of the operation time between the two or more devices is equal to or greater than a predetermined reference value, and assigning a cluster identification, ID, to the identified device group to manage the two or more devices included in the identified device group, and wherein the identifying the device group comprises generating a graph-based cluster in which the two or more devices are connected to each other, the device group being utilized for a predetermined target service.

The acquiring of the operation time information may include: extracting a timestamp of each of the devices from the received log data; and generating the time index indicating the operation time information from the extracted timestamp, and the time index may include a bitmap-based compressed time slot.

The calculated similarity may have a value between <NUM> and <NUM>, and the identifying of the device group includes identifying the device group including a corresponding device when the calculated similarity of the operation time between the plurality of devices is equal to or greater than the predetermined reference value, and the identifying of the device group may include removing a corresponding device from the device group when the calculated similarity of the operation time between the plurality of devices is smaller than the predetermined reference value.

The method may further include representing the determined device group as a graph in which two or more devices of the device group are connected to each other and providing an image represented by the graph to at least one external apparatus through the communication interface, or displaying the image represented by the graph.

According to still another aspect of the present disclosure, there is provided a computer-readable non-volatile recording medium in which a program of a method executable by a processor of an electronic apparatus is recorded, the method including: receiving log data of a plurality of devices connected to a network through a communication interface; acquiring operation time information of each of the devices from the received log data; calculating similarity of the operation time between the plurality of devices based on the acquired operation time information; and determining a device group including two or more devices with the relatively high calculated similarity among the plurality of devices.

According to the electronic apparatus and the method for controlling the same of the disclosure as described above, by calculating the similarity between the plurality of devices connected to the network and generating the device group including the devices with relatively high similarity in the network, it is possible to understand the relationship of devices in the network and use the understood relationship for marketing such as target services.

In the drawings, the same reference numbers or signs refer to components that perform substantially the same function, and the size of each component in the drawings may be exaggerated for clarity and convenience. However, the technical idea and the core configuration and operation of the disclosure are not limited only to the configuration or operation described in the following examples. In describing the disclosure, if it is determined that a detailed description of the known technology or configuration related to the disclosure may unnecessarily obscure the subject matter of the disclosure, the detailed description thereof will be omitted.

In embodiments of the disclosure, terms including ordinal numbers such as first and second are used only for the purpose of distinguishing one component from other components, and singular expressions include plural expressions unless the context clearly indicates otherwise. Also, in embodiments of the disclosure, it should be understood that terms such as 'configured', 'include', and 'have' do not preclude the existence or addition possibility of one or more other features or numbers, steps, operations, components, parts, or combinations thereof. In addition, in the embodiment of the disclosure, a 'module' or a 'unit' performs at least one function or operation, and may be implemented in hardware or software, or a combination of hardware and software, and may be integrated into at least one module. In addition, in embodiments of the disclosure, at least one of the plurality of elements refers to not only all of the plurality of elements, but also each one or all combinations thereof excluding the rest of the plurality of elements.

<FIG> is a block diagram illustrating a network system according to an embodiment of the disclosure, and <FIG> is a diagram illustrating an example in which a plurality of devices are connected to a network according to an embodiment of the disclosure.

As illustrated in <FIG>, a network system according to an embodiment of the disclosure includes an external network <NUM> and at least one internal network <NUM> accessible to the external network <NUM>.

The external network <NUM> is implemented as a public network such as the Internet, and allocates a public internet protocol (IP) address.

In an embodiment, the internal network <NUM> is a network address translation (NAT) network, and a public IP address (hereinafter, NAT IP Or NAT Gateway IP) may be allocated to a router <NUM> operating as a gateway to connect to the external network <NUM>.

The internal network <NUM> is implemented as a local network, and a unique IP address is allocated to each of the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> connected to the internal network <NUM>. In an embodiment, the internal network <NUM> is implemented in the form of a private network.

The router <NUM> converts transmission side addresses, that is, unique IP addresses, of packets output from each of the devices <NUM>, <NUM>, <NUM>, and <NUM> connected to the internal network <NUM> into a public IP address, and transmits the public IP address. In addition, the router <NUM> converts a destination address of a response packet to the transmitted packet into the unique IP address of the internal network <NUM> and transmits the unique IP address to the corresponding device. That is, the devices <NUM>, <NUM>, <NUM>, and <NUM> connected to the internal network <NUM> constituted by the NAT appear to be connected to the external network <NUM> such as the Internet through the public IP allocated to the router <NUM> from the outside.

The NAT has the advantage of solving the problem of a limited number of public IP addresses by allowing each request that goes out of or enters the network, that is, the internal network <NUM> to go through an address change process by the above operation. Accordingly, the NAT is a network configuration technique widely used in public institutions or enterprises that require private networks, and many internet service providers (ISPs) companies that provide Internet networks supplied to homes have also used the NAT network structure.

According to the embodiment of the disclosure, the internal network <NUM> may be implemented in various forms such as a private network of a public institution or an enterprise or a home network of a home. In addition, although <FIG> illustrates an example in which there is one internal network <NUM> connected to the external network <NUM>, the internal network <NUM> can be implemented in a form in which a plurality of internal networks are connected to the external network <NUM>.

The plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> connected to the internal network <NUM> are not limited in their implementation form, and may be implemented as various types of apparatuses capable of wired or wireless communication.

For example, when the internal network <NUM> is a home network of a home, as illustrated in <FIG>, each device <NUM>, <NUM>, <NUM>, and <NUM> may correspond to a display apparatus such as a TV, an image processing apparatus such as a set-top box (STB), a terminal apparatus such as a smart phone, a personal computer (PC) including a laptop or a desktop, or the like, respectively. In addition, each device <NUM>, <NUM>, <NUM>, and <NUM> may perform wired or wireless communication with the router <NUM>, and the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> may be implemented to enable wired or wireless communication with each other.

As illustrated in <FIG>, the network system according to the embodiment of the disclosure includes an electronic apparatus <NUM> capable of determining, that is, identifying a device group based on similarity between the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> connected to a predetermined network, that is, the internal network <NUM>.

The electronic apparatus <NUM> according to the embodiment of the disclosure may be implemented in various forms, and includes, for example, a server accessible through a public network such as the Internet. Here, when the electronic apparatus <NUM> is a server, the server may be implemented in the form of a cloud.

However, in the disclosure, the implementation form of the electronic apparatus <NUM> is not limited to the server, and for example, the electronic apparatus <NUM> may include various apparatuses capable of receiving data from the devices <NUM>, <NUM>, <NUM>, and <NUM> connected to the internal network <NUM> such as a terminal apparatus or a computer.

In addition, in <FIG>, the electronic apparatus <NUM> is illustrated in a form in which the electronic apparatus <NUM> is directly connected to a public network such as the Internet, that is, an external network <NUM>, but the connection type of the electronic apparatus <NUM> of the disclosure is limited to that illustrated in <FIG>. For example, the case where the electronic apparatus <NUM> is connected to the internal network <NUM> or is connected to another internal network accessible to the external network <NUM> is also included in the disclosure.

In addition, the electronic apparatus <NUM> of the disclosure may receive data from not only the devices <NUM>, <NUM>, <NUM>, <NUM> connected to the internal network <NUM>, but also other devices of the internal network that can be connected to the external network <NUM>.

Hereinafter, the configuration of the electronic apparatus <NUM> according to the embodiment of the disclosure will be described with reference to the drawings.

<FIG> is a block diagram illustrating the configuration of the electronic apparatus according to the embodiment of the disclosure. <FIG> is a block diagram illustrating a configuration of a processor of the electronic apparatus according to the embodiment of the disclosure.

As illustrated in <FIG>, the electronic apparatus <NUM> according to the embodiment of the disclosure includes a communication interface <NUM>, a storage <NUM>, and a processor <NUM>.

The components included in the electronic apparatus <NUM> are not limited to the above-described embodiment, and may be implemented by excluding or changing some components or including additional other components. For example, when the electronic apparatus <NUM> is implemented as a computer or a terminal apparatus, the electronic apparatus <NUM> may further include a display capable of displaying an image. The implementation scheme of the display may be implemented in various types such as liquid crystal, plasma, a light-emitting diode, an organic light-emitting diode, a surface-conduction electron-emitter, carbon nano-tube, and nano-crystal without any limitations.

The communication interface <NUM> is provided to enable communication with an external apparatus including the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> connected to the internal network <NUM> using a wired or wireless communication method. The communication interface <NUM> includes a wired and/or wireless communication module.

In an embodiment, the communication interface <NUM> may be implemented as a communication circuitry including communication modules (S/W module, chip, and the like) corresponding to various kinds of communication protocols. In another embodiment, the communication interface <NUM> may be implemented as a communication circuitry including a data input/output interface in which the communication modules (S/W module, chip, and the like) corresponding to various types of communication protocols, a port, and the like are combined.

According to an embodiment, the communication interface <NUM> may include a wired communication module such as Ethernet.

According to an embodiment, the communication interface <NUM> may include a wireless LAN unit. The wireless LAN unit may transmit/receive data to and from each device <NUM>, <NUM>, <NUM>, and <NUM> to be communicated through an access point (AP) under the control of the processor <NUM>. The wireless LAN unit includes a Wi-Fi communication module.

According to an embodiment, the communication interface <NUM> is at least one of short-range communication modules such as Bluetooth, Bluetooth low energy, radio frequency (RF) communication, Wi-Fi direct, Zigbee, ultra wideband (UWB), near field communication (NFC), and the like. The short-range communication module is provided to support direct communication between the electronic apparatus <NUM> and each device <NUM>, <NUM>, <NUM>, and <NUM> wirelessly without an AP.

The communication interface <NUM> of the display apparatus <NUM> according to the embodiment of the disclosure may be constituted by one or two or more combinations of the wireless LAN unit, the short-range communication module, and the wired communication module depending on performance.

The storage <NUM> is configured to store various data of the electronic apparatus <NUM>. The storage <NUM> should store data even when power supplied to the electronic apparatus <NUM> is cut off, and may be provided as a writable nonvolatile memory (writable memory) to reflect fluctuations. The storage <NUM> may include at least one of a hard disk (HDD), a flash memory, an EPROM, or an EEPROM.

The storage <NUM> may further include a volatile memory such as a RAM, and the volatile memory may be provided as a DRAM or an SRAM having a faster read or write speed of the electronic apparatus <NUM> compared to the nonvolatile memory. That is, in the disclosure, the term storage is defined as terms including not only a nonvolatile memory, but also a volatile memory, a cache memory provided inside the processor <NUM>, and a memory card (for example, micro SD card, memory stick, and the like) that can be mounted on the electronic apparatus <NUM> through the connection unit <NUM>.

The storage <NUM> may store input/output signals or data corresponding to the operation of each component under the control of the processor <NUM>. The data stored in the storage unit <NUM> includes, for example, an operating system for driving the electronic apparatus <NUM>, various applications, image data, additional data, user information, documents, databases, related data, or the like that can be executed on the operating system.

In an embodiment, the storage <NUM> collects and stores log data received from the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM>, similarity between devices which is calculated using the log data, and data for a device group determined based on the calculated similarity. In addition, the storage unit <NUM> may install and store an application that operates to calculate the similarity between the devices and determine a device group based on log data of each device.

The processor <NUM> performs control to operate the overall components of the electronic apparatus <NUM>.

The processor <NUM> of the electronic apparatus <NUM> according to the embodiment of the disclosure may receive log data of the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> connected to a predetermined network through the communication interface <NUM>, obtain operation time information of each device <NUM>, <NUM>, <NUM>, and <NUM> from the received log data, calculate the similarity of the operation time between the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> based on the acquired operation time information, and determine (identify) a device group including two or more devices with the relatively high calculated similarity among the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM>.

Here, the network to which the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> are connected is the internal network <NUM> constituted by the NAT, and the processor <NUM> may classify and group the devices <NUM>, <NUM>, <NUM>, and <NUM> existing in a network one level lower than the public IP allocated to the internal network <NUM> based on locality sensitive.

The processor <NUM> includes at least one general-purpose processor that loads at least a part of the control program from the nonvolatile memory in which the control program is installed into the volatile memory and executes the loaded control program, and may be implemented as, for example, a central processing unit (CPU), an application processor (AP), or a microprocessor.

The processor <NUM> may be implemented in the form in which one or more cores consisting of a single core, a dual core, a triple core, a quad core, or multiples thereof are mounted. The processor includes a plurality of processors, for example, a main processor and a sub processor operating in a sleep mode (for example, a standby mode in which only standby power is supplied and the electronic apparatus does not operate). In addition, the processor, the ROM, and the RAM may be interconnected via an internal bus. In an embodiment, the processor <NUM> may be implemented as a form included in a main SoC mounted on a PCB embedded in the display apparatus <NUM>.

The control program may include a program(s) implemented in at least one of a BIOS, a device driver, an operating system, firmware, a platform, and an application program (application). As an embodiment, the application program may be pre-installed or stored in the electronic apparatus <NUM> at the time of manufacturing of the electronic apparatus <NUM>, or installed in the electronic apparatus <NUM> based on data of the application program received from the outside when used later. The data of the application program may be downloaded to the electronic apparatus <NUM> from an external server such as an application market. Such an external server is an example of a computer program product of the disclosure, but is not limited thereto.

As an embodiment, the operation of the processor <NUM> as described above may be implemented as a computer program stored in a computer program product (not illustrated) separately provided from the electronic apparatus <NUM>.

In this case, the computer program product includes a memory in which an instruction corresponding to the computer program is stored, and a processor. When executed by the processor, the instruction may perform the operation of the processor <NUM> by receiving the log data of each device <NUM>, <NUM>, <NUM>, and <NUM>, obtaining the operation time information of each device <NUM>, <NUM>, <NUM>, and <NUM> from the received log data, calculating the similarity of the operation time between the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> based on the acquired operation time information, and determining the device group including two or more devices with the relatively high calculated similarity among the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM>.

As a result, the electronic apparatus <NUM> may download and execute the computer program stored in the separate computer program product to perform the operation of the processor <NUM>.

In addition, as an embodiment, the operation of the processor <NUM> may be implemented as a computer-readable program which is stored in a recording medium. The program stored in the recording medium, that is, data, is directly accessed and executed by the processor <NUM>, or downloaded and executed to the electronic apparatus <NUM> through a transmission medium implemented through a wired/wireless network to which a computer system is interconnected, thereby performing an operation.

In the electronic apparatus <NUM> according to the embodiment of the disclosure, , as illustrated in <FIG>, the processor <NUM> may include a log preprocessor <NUM>, a device indexer <NUM>, a similarity calculator <NUM>, and a device group determiner <NUM>.

Each of the components <NUM>, <NUM>, <NUM>, and <NUM> of the processor <NUM> as described above or a combination of two or more thereof may be implemented by a software module or a combination of a hardware module and a software module, or may be implemented by the computer program described above. Hereinafter, it will be understood that the operation performed by the log preprocessor <NUM>, the device indexer <NUM>, the similarity calculator <NUM>, and the device group determiner <NUM> is performed by the processor <NUM>.

Hereinafter, a process of calculating the similarity between devices and determining a device group performed according to the embodiment of the disclosure will be described in detail with reference to the drawings.

<FIG> is a flowchart illustrating a method of controlling an electronic apparatus according to an embodiment of the disclosure.

As illustrated in <FIG>, the electronic apparatus <NUM> receives the log data of the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> connected to an arbitrary network, for example, the internal network <NUM> of <FIG> through the communication interface <NUM> (<NUM>). In an embodiment, the processor <NUM> may periodically receive, that is, collect, log data from each device <NUM>, <NUM>, <NUM>, and <NUM> according to a predetermined time (for example, <NUM> hours, <NUM> hours, <NUM> hours, and the like).

The processor <NUM> acquires the operation time information of each device from the log data received in step <NUM> (<NUM>). In an embodiment, the processor <NUM> may acquire the operation time information of each device by extracting a timestamp of each device from log data and generating a time index from the extracted timestamp.

<FIG> are diagrams for explaining a process of acquiring operation time information of a device in the electronic apparatus according to the embodiment of the disclosure.

The processor <NUM> preprocesses the log data of each device <NUM>, <NUM>, <NUM>, and <NUM> received in step <NUM>. Here, the preprocessing of the log data may be performed by the log preprocessor <NUM> illustrated in <FIG>, and the preprocessing may include network log aggregation.

Specifically, the log preprocessor <NUM> may extract operation data of each device by performing preprocessing on the log data collected in step <NUM>. The operation data extracted according to the preprocessing may include timestamps <NUM>, <NUM>, and <NUM> as time values, and as illustrated in <FIG>, the extracted timestamps <NUM>, <NUM>, and <NUM> may match the identification information (identifier, ID) and IP address (NAT Gateway IP) of each device and may be stored in the storage <NUM>.

As illustrated in <FIG>, the timestamp represents a specific time as a character string, and the date and time when log data is generated or changed in the matched device may be checked using the timestamp.

The timestamps <NUM>, <NUM>, and <NUM> extracted by the log preprocessor <NUM> are output to the device indexer <NUM>.

The device indexer <NUM> generates a time index from the timestamps <NUM>, <NUM>, and <NUM> received from the log preprocessor <NUM>. The generated time index may appear as compressed time slots <NUM>, <NUM>, and <NUM>, as illustrated in <FIG>.

As illustrated in <FIG>, the time index, that is, the compressed time slots <NUM>, <NUM>, and <NUM> may match the device ID and IP address (NAT Gateway IP), which are identification information (identifier, ID) of each device, and may be stored in the storage <NUM>.

In an embodiment, the compressed time slot is generated by compressing time data into a bitmap in a predetermined time unit (for example, <NUM> minutes, <NUM> hour, <NUM> hours, and the like). The value of the compressed timeslot generated in the indexing step is operation time information representing a time zone in which each device <NUM>, <NUM>, <NUM>, and <NUM> connected to the internal network <NUM> operates, that is, an appearance time zone, which becomes a value representing the locality sensitive of the device.

For example, when one timeslot is defined as <NUM> hour, as illustrated in <FIG>, it may be confirmed at timeslots <NUM>:<NUM>, <NUM>:<NUM>, <NUM>:<NUM>, <NUM>:<NUM>, <NUM>:<NUM>, and <NUM>:<NUM> having a value of <NUM> that the device has operated.

The processor <NUM> calculates the similarity of the operation time between the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> based on the operation time information acquired in step <NUM> (<NUM>).

<FIG> and <FIG> are diagrams for explaining a process of calculating similarity of an operation time between devices in the electronic apparatus according to the embodiment of the disclosure.

The processor <NUM> may calculate the similarity between the plurality of devices <NUM>, <NUM>, <NUM>, and <NUM> based on the operation time information acquired in step <NUM>, that is, the compression time slot representing the time index. Here, the calculation of the similarity between devices may be performed by the similarity calculator <NUM> illustrated in <FIG>, and the calculation process of the similarity may include locality sensitive device similarity prediction.

In an embodiment, the similarity calculator <NUM> may calculate the similarity between the plurality of devices using a predetermined similarity calculation method. The method used for calculating the similarity in the disclosure is not limited, and for example, jaccard similarity or cosine similarity may be used.

The jacquard similarity has a value between <NUM> and <NUM>, and the higher the similarity is, the closer it is to <NUM>, and the lower the similarity is, the closer it is to <NUM>.

In an embodiment of the disclosure, when the similarity has a predetermined reference value, for example, <NUM> or greater, it is determined that the corresponding device pair has similar locality sensitive.

In an embodiment, the similarity calculator <NUM> calculates similarity between a plurality of devices having a specific locality sensitive representative value, that is, devices in a network to which the same public IP is allocated.

For example, referring to <FIG>, the similarity calculator <NUM> may derive a jaccard score <NUM> based on a compressed time slot <NUM> which is operation time information of a first device (Device ID <NUM>) connected to the internal network <NUM> to which public IP <NUM>. <NUM> is allocated and a compressed time slot <NUM> which is operation time information of a second device (Device ID <NUM>), thereby calculating the similarity between the first device (Device ID <NUM>) and the second device (Device ID <NUM>).

As illustrated in <FIG>, when the score <NUM> derived for the first device (Device ID <NUM>) and the second device (Device ID <NUM>) is <NUM>, the score <NUM> has a value close to <NUM>, and therefore, both the devices has similarity (similar locality sensitive) to each other.

The similarity calculator <NUM> may calculate the similarity between the devices <NUM>, <NUM>, <NUM>, and <NUM> with respect to each of the other devices in the same manner as described above.

For example, as illustrated in <FIG>, when the score derived for the first device (Device ID <NUM>) and the second device (Device ID <NUM>) is <NUM> and the score for the second device (Device ID <NUM>) and the third device (Device ID <NUM>) is <NUM>, it may be seen that the second device (Device ID <NUM>) has mutual similarity (similar locality sensitive) to the first device (Device ID <NUM>) (score <NUM>), and does not have mutual similarity (similar locality sensitive) to the third device (Device ID <NUM>) (score <NUM>). In other words, the second device (Device ID <NUM>) and the first device (Device ID <NUM>) form a device pair having relatively high similarity.

In addition, when the score derived for the first device (Device ID <NUM>) and the third device (Device ID <NUM>) is <NUM>, the first device (Device ID <NUM>) has similar locality sensitive to the second device (Device ID <NUM>) (score <NUM>) and has also similar locality sensitive to the third device (Device ID <NUM>) (score <NUM>). However, the first device (Device ID <NUM>) has relatively higher similarity to the second device (Device ID <NUM>), and has relatively lower similarity to the third device (Device ID <NUM>).

The processor <NUM> determines (identifies) a device group including two or more devices with the relatively high calculated similarity among the plurality of devices based on the similarity calculated in step <NUM> (<NUM>). Here, the determination of the device group may be performed by the device group determiner <NUM> illustrated in <FIG>.

<FIG> are diagrams for explaining a process of determining a device group in the electronic apparatus according to the embodiment of the disclosure.

Specifically, the device group determiner <NUM> extracts a group of device pairs having relatively high similarity based on the mutual similarity score calculated in step <NUM>, for example, the Jacquard score. Here, the device group determiner <NUM> may selectively extract a device pair having a predetermined reference score, for example, a jaccard score of <NUM> or greater. In other words, the device group determiner <NUM> may consider that a device pair (for example, the second device (Device ID <NUM>), the third device (Device ID <NUM>) <NUM>, and a fourth device (Device ID <NUM>), and a sixth device (Device ID <NUM>) <NUM> of <FIG>) having a score having a value smaller than a reference score (for example, jaccard score of <NUM>) has an insignificant value, and may remove the device pair from the device group having similarity.

In step <NUM>, the device group determiner <NUM> may generate an image to represent a device group extracting a device pair having similarity equal to or greater than the reference score as described above as a graph. Here, the generated image may be represented as a graph in which two or more devices having relatively high similarity are connected to each other in the device group.

In an embodiment, the device group determiner <NUM> may include a graph-based cluster generator that generates an image.

The device group determiner <NUM> may connect between objects corresponding to a device pair derived as having mutual similarity of a reference score (for example, a jaccard score of <NUM>) or greater among devices of a network to which the locality sensitive representative value, for example, the public IP <NUM>. <NUM> is allocated.

As illustrated in <FIG>, the device group determiner <NUM> may connect an object <NUM> to the first device (Device ID <NUM>) derived as having mutual similarity to an object <NUM> corresponding to the second device (Device ID <NUM>) and connect the object <NUM> corresponding to the first device (Device ID <NUM>) to an object <NUM> corresponding to the third device (Device ID <NUM>) in <FIG>, for example. In the same way, the device group determiner <NUM> connects between objects <NUM>, <NUM>, and <NUM> corresponding to devices derived as having mutual similarity.

In addition, the device group determiner <NUM> may connect between objects <NUM>, <NUM>, and <NUM> corresponding to devices derived as having mutual similarity of a reference score (for example, a jaccard score of <NUM>) or greater among devices of a network to which the locality sensitive representative value, for example, the public IP <NUM>. <NUM> is allocated.

In <FIG>, devices corresponding to respective vertices (objects) connected by trunk lines have an operation time within a predetermined network (for example, internal network <NUM>) having a specific locality representative value (using the same public IP), and therefore, is interpreted as forming subgroups with similar common frequency of appearance.

The device group determiner <NUM> may generate a device group, that is, a cluster including devices connected to each other having similar operation times as described above.

For example, in the network using IP <NUM>. <NUM>, a device group <NUM> including devices (the first device (Device ID <NUM>), the second device (Device ID <NUM>), and the third device (Device ID <NUM>) in <FIG>) corresponding to objects <NUM>, <NUM>, and <NUM> connected by trunk lines is generated as illustrated in <FIG>. In the same way, a device group <NUM> including devices corresponding to the objects <NUM>, <NUM>, and <NUM> connected by trunk lines may be generated.

The device group determiner <NUM> may also generate a device group <NUM> including devices corresponding to objects <NUM>, <NUM>, and <NUM> connected by trunk lines in a network using IP <NUM>.

<FIG> illustrates that three device groups <NUM>, <NUM>, and <NUM> are determined based on the mutual similarity of the operation time in the network using IP <NUM>. <NUM>, and <FIG> illustrates, for example, the case where two device groups <NUM> and <NUM> are determined based on mutual similarity of operation time in the network using IP <NUM>. In this case, in the disclosure, the number of device groups generated in each network and the number of devices included are not limited.

The graphs represented as in <FIG> and <FIG> may be displayed through a display of the electronic apparatus <NUM> itself or a display of at least one external apparatus that can be connected through the communication interface <NUM>.

The device group determiner <NUM> assigns a cluster ID to each of the device groups determined as described above, and manages a plurality of devices included in the corresponding device group.

For example, as illustrated in <FIG>, the device group determiner <NUM> may assign a cluster ID <NUM> to the first device group including a plurality of devices corresponding to device IDs <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>, respectively and assign a cluster ID <NUM> to the second device group including a plurality of devices corresponding to device IDs <NUM>, <NUM>, <NUM>, and <NUM>, respectively, in the network including IP <NUM>. <NUM>, thereby managing the plurality of devices included in the corresponding device group.

In addition, the device group determiner <NUM> may assign a cluster ID <NUM> to a third device group including a plurality of devices corresponding to device IDs <NUM> and <NUM>, respectively, and assign a cluster ID <NUM> to the fourth device group including a plurality of devices corresponding to devices ID <NUM>, <NUM>, and <NUM>, respectively, in the network using IP <NUM>. <NUM>, thereby managing the plurality of devices included in the corresponding device group.

The electronic apparatus <NUM> according to the embodiment of the disclosure may acquire operation time information for a plurality of devices connected to a predetermined network as described above, calculate the similarity of the operation time between devices based on the operation time information, and determine the device group including two or more devices with relatively high calculated similarity, thereby understanding the relationship between the devices connected to the internal network that are difficult to identify from the outside, that is, the similarity, using the probability of big data and the graph theory based on the use of the same time zone.

In the embodiment of the disclosure as described above, the NAT network structure has been described as an example of configuring the predetermined network, that is, the internal network <NUM>, but the disclosure is not limited thereto. Therefore, in the case of the plurality of devices connected to the internal network <NUM> having the locality sensitive representative value in a certain form other than the IP of the NAT, it may be implemented to determine a lower group (device group) based on similarity from an upper group having the locality sensitive representative value as in the disclosure.

In addition, the embodiment of the disclosure has described, for example, the case where the operation time information based on the log data of each device, that is, the compressed time slot, is used as the index for calculating the similarity. However, since the disclosure is not limited to using the operation time information, it can be implemented to predict the similarity between devices using various kinds and types of data/information.

In addition, the embodiment of the disclosure has described, for example, the case of using the ID of each device as an identification means for distinguishing each device connected to the network, but other information for distinguishing a plurality of devices other than the device ID, for example, the device type, the model name, or the like can be processed and used.

Claim 1:
An electronic apparatus (<NUM>), comprising:
a communication interface (<NUM>); and
a processor (<NUM>) configured to receive log data of a plurality of devices (<NUM>, <NUM>, <NUM>, <NUM>), the plurality of devices being connected to a network (<NUM>) through the communication interface (<NUM>), the network (<NUM>) corresponding to an internal private network to which a public internet protocol, IP, address is allocated,
acquire operation time information of each of the devices (<NUM>, <NUM>, <NUM>, <NUM>) from the received log data, the operation time information corresponding to a time index based on the log data of each of the plurality of devices (<NUM>, <NUM>, <NUM>, <NUM>) , the time index including compressed time slots, which is generated by compressing time data into a bitmap in a predetermined time unit and which represents a time zone in which each device (<NUM>, <NUM>, <NUM>, and <NUM>) connected to the network (<NUM>) appears,
calculate similarity of the operation time between the plurality of devices (<NUM>, <NUM>, <NUM>, <NUM>) based on the acquired operation time information,
identify a device group including two or more devices among the plurality of devices (<NUM>, <NUM>, <NUM>, <NUM>) in which the calculated similarity of the operation time between the two or more devices is equal to or greater than a predetermined reference value, and
assign a cluster identification, ID, to the identified device group to manage the two or more devices included in the identified device group,
wherein the processor (<NUM>) is configured to identify the device group by generating a graph-based cluster in which the two or more devices are connected to each other, the device group being utilized for a predetermined target service.