Fuente: Wipo "IOT" The present invention relates to an operation method of a network management device which comprises the steps of: extracting source IP addresses communicating with a specific destination IP address of an IoT management server from session data over a certain period of time as IoT device candidates; calculating a statistical value of a first IoT identification index for each IoT device candidate from the session data; and comparing the statistical value of the first IoT identification index for each IoT device candidate with a reference value to identify a candidate for a specific source IP address as an IoT device. The first IoT identification index comprises the number of destination IP addresses to which the corresponding IoT device candidate is connected and/or the number of uniform resource identifiers (URI) used in a request transmitted by the corresponding IoT device candidate. According to an embodiment, in a network in which large traffic of tens of Gbps occurs, the IoT device communicating with an IoT management server can be identified even without basic information on the session data. COPYRIGHT KIPO 2023