A method and system for sniffing network behavior of mobile terminal users

Abstract

The present invention relates to the technical field of network sniffing, and in particular to a method and system for sniffing network behavior of mobile terminal users, comprising an operator, a user mobile device and a network control terminal, including a sensitive word data storage module composed of a storage module that memorizes a specific sensitive word library and a cloud storage module, for storing sensitive words for network reference by the network control terminal, wherein the network control terminal comprises a signal tower, on which various signal base stations are mounted, and after being transmitted to a designated area through optical fiber, wireless network connection and coverage are performed, and the present invention enables network operators to greatly improve their linkage with network police, speeds up the response time of network police, and prevents the best IP anti-tracking and illegal and criminal behavior recording time from being missed, and at the same time, the network can be cut off in time for the IP of an illegal website, and the illegal IP is traced based on the independent IP of the operator's network terminal to avoid the spread of illegal IP information.

Description

Technical Field

[0001] The present invention relates to the technical field of network sniffing, and in particular to a method and system for sniffing network behavior of a mobile terminal user. Background Art

[0002] Network sniffing was originally a tool for network managers. With a sniffer, network administrators can always understand the actual situation of the network, find network vulnerabilities and test network performance. When network performance drops sharply, the sniffer can be used to analyze network traffic and find out the source of network congestion. Network sniffing is the basis for the implementation of network monitoring systems.

[0003] However, the network behavior sniffing adopted for mobile terminal users mostly monitors and supervises the users' online browsing in real time. However, the current network supervision is relatively weak, and most of them can only block the network connection of the site in one direction, and do not have the ability to track backwards. This has led to the emergence of negative and unhealthy websites on the Internet. At the same time, the linkage between network operators and Internet police is poor, and they are unable to give timely feedback and conduct timely monitoring and control of users who violate the rules. Summary of the invention

[0004] Technical issues solved

[0005] In view of the above-mentioned shortcomings of the prior art, the present invention provides a method and system for sniffing the network behavior of mobile terminal users, which solves the problems of poor network supervision, operators only implementing simple prohibitions on web pages and failing to conduct reverse network tracking in a timely manner, missing the best tracking opportunity, poor linkage between operators and network police, and slow information feedback.

[0006] Technical Solution

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0008] In a first aspect, a mobile terminal user network behavior sniffing system in the present invention includes an operator, a user mobile device and a network control terminal, including:

[0009] A sensitive vocabulary data storage module composed of a storage module that memorizes a specific sensitive vocabulary library and a cloud storage module is used to store sensitive vocabulary for network reference by a network control terminal, wherein the network control terminal includes a signal tower, on which various signal base stations are mounted, and which are transmitted to a designated area via optical fiber for wireless network connection and coverage;

[0010] The cloud storage module is used for network search and storage. It serves the sensitive word data storage module and plays an updating role for the sensitive word data storage module.

[0011] A sensitive word screening unit, used to cooperate with the sensitive word data storage module to trigger web page screening and compare with the data stored in the sensitive word data storage module;

[0012] The network disabling module is used to generate a trigger according to the sensitive word screening unit. If no sensitive words are screened out, the network is available. If sensitive words are found, the network disabling module will be triggered to block the network.

[0013] The terminal user declaration module is used for users to choose their own complaint channel. The request can be transmitted through the network, requiring the operator to re-use the sensitive word screening unit through the sensitive word data storage module for re-inspection.

[0014] Furthermore, the cloud storage modules installed in the sensitive vocabulary data storage modules connected to multiple sites of the network control terminal share information with each other through the local area network. Whenever a single group of cloud storage modules obtains new vocabulary and updates the records, the cloud storage module will send a signal to enable it to interact with the cloud storage module and update synchronously.

[0015] Furthermore, when the sensitive word screening unit retrieves a sensitive word, the network disabling module will be triggered by the sensitive word screening unit at the first time. At this time, a prompt of denying access will appear on the browsing page of the user's mobile device. At the same time, the sensitive word screening unit will continue to perform a global search and make further judgments based on the global sensitive word ratio of the website page. If the vocabulary is less than the critical value, a warning prompt box will be triggered when the user refreshes the webpage, and the user can choose whether to browse it.

[0016] Furthermore, the sensitive word screening unit includes a homophonic associative word module and a graphic and text recognition module.

[0017] Furthermore, the sensitive word screening unit is connected to the terminal user reporting module through a sensitive word question trigger jump, and the terminal user reporting module is bidirectionally connected to the network control terminal.

[0018] In a second aspect, a method for sniffing network behavior of a mobile terminal user in the present invention comprises the following steps:

[0019] S10: The user sets up and installs a network control terminal to establish an information exchange channel between the operator and the user's mobile device;

[0020] S11: Differentiate the channel according to the connection mode between the operator and the network control terminal, and determine whether the channel is a data network or a WLAN;

[0021] And distinguish the network purpose and determine the location of the target IP address it is connected to;

[0022] S12: If the target IP to be connected is from overseas, the operator will record the IP address through the user's mobile device and call back the user. If it is a domestic IP, it will be released after screening;

[0023] S13: Screening for sensitive words based on the target IP address and specific search keywords, and capturing and translating the pictures or GIFs on the webpage by scanning and including them in the sensitive word screening candidates;

[0024] S14: making a detailed judgment based on the time the user stays on the webpage and the ratio of sensitive words to the full text of the webpage;

[0025] S15: If the percentage of sensitive words exceeds the prescribed level, access is denied and the search page of the webpage is disconnected from the network;

[0026] S16: triggering a network prompt according to the actual scope of sensitive words involved;

[0027] S17: After the network prompt is triggered, the web page will be jumped immediately to present green and healthy psychological guidance content, and legal education and prompt warnings will be carried out.

[0028] Furthermore, when the network connection target is an overseas network IP, the operator has the right to monitor and record it. Within 0-24 hours after the user's access, the operator needs to determine whether to conduct a two-way customer return visit based on the user's access content.

[0029] Furthermore, the sensitive word screening in this method monitors the global content of web pages in GIF and FLV animated short video formats, and then converts the content recognized by the image and text into text and includes it in the sensitive word screening items.

[0030] In a third aspect, a method for sniffing network behavior of a mobile terminal user in the present invention comprises the following steps:

[0031] S20: When a user joins the network, an agreement is drawn up and signed. If the user violates the agreement, the operator will supervise the user's network IP and account;

[0032] S21: When a user browses a web page using a protocol IP network, if sensitive word checking detects browsing of illegal networks, the operator will be informed, and then manually determined whether to track, supervise or control. After confirming the violation, the operator will make a judgment based on the severity of the violation and take corresponding management measures. If the violation is serious, the operator has the right to conduct reverse tracking of the original target network and contact the Internet police immediately to form a self-protection and emergency risk avoidance precaution;

[0033] S22: The operator conducts anti-tracking on the illegal IP and webpage according to the actual situation, and traces the illegal IP to its source;

[0034] S23: After determining the illegal IP, the operator will simultaneously share information with other similar service providers and exchange information with the Internet police department;

[0035] S24: The search prompt for the IP address of the illegal website is removed from the entire network, and a new firewall is created;

[0036] S25: Establish an independent sensitive word library and point-to-point network supervision for illegal websites and IP addresses;

[0037] S26: Conduct identity verification and investigation without informing the Internet user who logs into the illegal website IP address, or supervise the user in a compliant and illegal manner without infringing on the rights of citizens.

[0038] Furthermore, the method executes the steps of verifying illegal content and tracing the source in a loop until the operator finds the illegal source after tracing the illegal website IP or stops after manual settings are completed.

[0039] Beneficial Effects

[0040] Compared with the known public technology, the technical solution provided by the present invention has the following beneficial effects:

[0041] The present invention improves the current network behavior sniffing system and makes up for its shortcomings, so that the network operator can greatly improve the linkage with the network police, and the network police can respond faster, thereby avoiding missing the best IP anti-tracking and illegal and criminal behavior recording time. At the same time, for the IP of the illegal website, after the operator receives the signal, the network can be cut off in time, and the illegal IP can be traced based on the independent IP of the operator's network terminal. In this way, the spread of illegal IP information can be avoided more efficiently and perfectly, and the frequent occurrence of unhealthy network illegal information can be avoided. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0043] Figure 1 It is a schematic diagram of the system structure of the present invention;

[0044] Figure 2 A schematic diagram of a flow chart of a network identification and disconnection method of the present invention;

[0045] Figure 3 This is a flow chart of operator network police linkage in an embodiment of the present invention; DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] The present invention will be further described below in conjunction with the embodiments.

[0048] Example 1

[0049] A method and system for sniffing network behavior of a mobile terminal user in this embodiment, such as Figure 1 As shown, it includes an operator 1, a user mobile device 2 and a network control terminal 3, including,

[0050] The sensitive vocabulary data storage module 4, which is composed of a storage module that memorizes a specific sensitive vocabulary library and a cloud storage module 5, is used to store sensitive vocabulary for network reference by the network control terminal 3. The network control terminal 3 includes a signal tower, on which various signal base stations are mounted, and the signal tower is transmitted to a designated area through optical fiber for wireless network connection and coverage;

[0051] The cloud storage module 5 is used for network search and storage, and serves the sensitive word data storage module 4, and plays an updating role for the sensitive word data storage module 4;

[0052] The sensitive word screening unit 6 is used to cooperate with the sensitive word data storage module 4 to trigger web page screening and compare with the data stored in the sensitive word data storage module 4;

[0053] The network disabling module 7 is used to generate a trigger according to the sensitive word screening unit 6. If no sensitive words are screened out, the network is available. If sensitive words are found, the network disabling module 7 is triggered to block the network.

[0054] The terminal user declaration module 8 is used for the complaint channel selected by the user. It can transmit the request through the network and require the operator 1 to re-use the sensitive word screening unit 6 through the sensitive word data storage module 4 for re-inspection.

[0055] The present invention forms a new system for information interaction between the operator 1 and the user's mobile device 2, which further improves the protection of network security. The construction of a secure network is achieved through the screening of sensitive words. At the same time, the cloud storage module 5 uploaded by the sensitive word data storage module 4 is used to update the sensitive word data storage module 4 in real time and form a memory. Therefore, the longer the module is used, the more security it will bring to the network security. At the same time, the disabled IP can be reported to the operator 1 in time, so that the operator 1 can respond in time and make a quick response according to the actual degree of danger involved, thereby providing a safe browsing environment for the operator 1 and the user.

[0056] like Figure 1 As shown, the cloud storage modules 5 installed in the sensitive vocabulary data storage modules 4 connected to multiple sites of the network control terminal 3 share information with each other through the local area network. Whenever a single group of cloud storage modules 5 obtains new vocabulary and updates the record, the cloud storage module 5 will send a signal to enable it to interact with the cloud storage module 5 for information and update synchronously.

[0057] The cloud storage module 5 can screen new sensitive words based on network information and record them for the sensitive word data storage module 4, thereby promoting the growth of the sensitive word data storage module 4 to form a more comprehensive sensitive word library for system reference.

[0058] like Figure 1 As shown, when the sensitive word screening unit 6 retrieves a sensitive word, the network disabling module 7 will be triggered by the sensitive word screening unit 6 in the first place. At this time, a prompt of denying access will appear on the browsing page of the user's mobile device 2. At the same time, the sensitive word screening unit 6 will continue to perform a global search and make further judgments based on the global sensitive word ratio of the website page. If the vocabulary is less than the critical value, a warning prompt box will be triggered when the user refreshes the webpage, and the user can choose whether to browse it.

[0059] like Figure 1 As shown, the sensitive word screening unit 6 includes a homophonic associative word module and a graphic character recognition module.

[0060] Through the composition of the homophonic association word module and the graphic character recognition module, the screening effect of the sensitive word screening unit 6 in cooperation with the sensitive word data storage module 4 is greatly enhanced, making the vocabulary collection source of the sensitive word data storage module 4 more comprehensive and reducing the occurrence of missed screening.

[0061] like Figure 1 As shown, the sensitive word screening unit 6 is connected to the terminal user reporting module 8 through a sensitive word topic trigger jump, and the terminal user reporting module 8 is bidirectionally connected to the network control terminal 3.

[0062] This method can warn users, and for minors, this component can provide correct guidance and psychological counseling to minors in a timely manner.

[0063] Example 2

[0064] See also Figure 2 , the steps are as follows:

[0065] S10: The user sets up and installs the network control terminal 3 to establish an information communication channel between the operator 1 and the user's mobile device 2;

[0066] S11: Differentiate the channel according to the connection mode between the operator 1 and the network control terminal 3, and determine whether the channel is a data network or a WLAN;

[0067] And distinguish the network purpose and determine the location of the target IP address it is connected to;

[0068] S12: If the target IP to be connected is overseas, the operator 1 records the IP address and visits the user through the user's mobile device 2. If it is a domestic IP, it can be released after screening;

[0069] S13: Screening for sensitive words based on the target IP address and specific search keywords, and capturing and translating the pictures or GIFs on the webpage by scanning and including them in the sensitive word screening candidates;

[0070] S14: making a detailed judgment based on the time the user stays on the webpage and the ratio of sensitive words to the full text of the webpage;

[0071] S15: If the percentage of sensitive words exceeds the prescribed level, access is denied and the search page of the webpage is disconnected from the network;

[0072] S16: triggering a network prompt according to the actual scope of sensitive words involved;

[0073] S17: After the network prompt is triggered, the web page will be jumped immediately to present green and healthy psychological guidance content, and legal education and prompt warnings will be carried out.

[0074] The operator 1 and the user's mobile device 2 establish a network channel and connect according to the user's actual needs, and then verify the network IP. If it is detected that the connected IP address is overseas, it should be recorded and included in the monitoring options. At this time, the web page uses the sensitive word screening unit 6 for screening and identification. If sensitive words appear, the user's mobile device 2 sends a signal to the operator 1, and the operator 1 quickly cuts off the network connection. The user's web sharing data connection is rejected. At this time, the web page browsed by the user cannot be displayed and jumps at the same time. The operator 1 gives a prompt box according to the content of the sensitive word. After the user clicks to confirm or there is no operation for a few seconds, the web page will automatically jump to present the network health education promotion web page for the user to browse.

[0075] like Figure 1 As shown, when the network connection target is an overseas network IP, operator 1 has the right to monitor and record it. Within 0-24 hours after the user accesses, operator 1 needs to determine whether to conduct a two-way customer return visit based on the user access content.

[0076] This method can conduct queuing-up follow-up investigations based on the severity of the network violation, and implement real-time investigation and analysis for some serious cases with solid evidence, speeding up processing efficiency so that the Internet police can contact emergency situations in real time to initiate investigations and control.

[0077] like Figure 1 As shown, in this method, the sensitive word screening monitors the global content of web pages in GIF and FLV animated short video formats, and then converts the content recognized by the image and text into text and includes it in the sensitive word screening items.

[0078] The configuration of this module forms a gradually improved growth system for the sensitive word data storage module 4, which ensures the accuracy of sensitive word screening and prevents the sensitive word data storage module 4 from being unable to cope with the screening work due to network updates, or requiring tedious steps of manual disassembly and rewriting.

[0079] Example 3

[0080] See also Figure 3 , the steps are as follows:

[0081] S20: When the user joins the network, an agreement is drawn up and signed. When the user violates the agreement, the operator 1 supervises the user's network IP and account;

[0082] S21: When a user browses a web page using a protocol IP network, if sensitive word checking detects browsing of illegal networks, feedback is given to operator 1, and then manual determination is made as to whether to track, supervise or control. After confirming the violation, a judgment is made based on the severity of the violation and corresponding management measures are taken. If the violation is serious, operator 1 has the right to conduct reverse tracking of the original target network and contact the network police immediately to form a self-protection and emergency risk avoidance precaution;

[0083] S22: Operator 1 performs anti-tracking on the illegal IP and webpage according to the actual situation, and traces the illegal IP to its source;

[0084] S23: After determining the illegal IP, operator 1 simultaneously sends information sharing to other similar service providers and exchanges information with the Internet police department;

[0085] S24: The search prompt for the IP address of the illegal website is removed from the entire network, and a new firewall is created;

[0086] S25: Establish an independent sensitive word library and point-to-point network supervision for illegal websites and IP addresses;

[0087] S26: Conduct identity verification and investigation without informing the Internet user who logs into the illegal website IP address, or supervise the user in a compliant and illegal manner without infringing on the rights of citizens.

[0088] This method is established for the use of illegal IP network addresses and subsequent work. An agreement is signed before the user joins the network. The agreement indicates that when the IP network is used for browsing in the future, if the sensitive word screening unit 6 screens out sensitive words, the operator 1 has the right to conduct real-time tracking and supervision, and to conduct further screening. After the operator 1 completes a series of operations such as network disabling, the independent branch of the operator 1 actively browses the illegal web page in this background, and records important information. Then, according to the prompt of the web page, the source is traced upward to the illegal IP web page. This is repeated until the initiator is found. At this time, the operator 1 should promptly report to the network police system and relevant departments to form a network wanted notice and stop the relevant network. If the circumstances are serious, the operator 1 has the right to conduct reverse tracking of the original target network and contact the network police as soon as possible to form self-protection and emergency risk avoidance precautions;

[0089] At this time, we will query the related login IPs based on the stopped network IP, and use various methods of communication to take the related search content of the illegal web page IP offline. At the same time, we will build a targeted firewall to prevent the web page from being jailbroken and re-coded and put online again, and ensure that the entire network chain will respond to the access to the illegal IP. At the same time, the relevant network police departments will exchange information and search and arrest the illegal IP network;

[0090] Then we will check the offline personnel, and conduct an uninformed identity investigation on those with serious circumstances. If the situation is true, we will inform and publicize it, and finally conduct a phased notification and specific scope of network monitoring and supervision.

[0091] like Figure 1 As shown, the method executes the steps of verifying illegal content and tracing the source in a loop until the operator 1 finds the illegal source after tracing the illegal website IP or stops after manual setting.

[0092] After blocking the relevant illegal IP networks and online sites based on real-time clue information, relevant personnel can conduct a tentative carpet search based on keywords to prevent hidden illegal IP web pages from surviving and being unblocked.

[0093] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements will not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A mobile terminal user network behavior sniffing system, comprising an operator (1), a user mobile device (2) and a network control terminal (3), characterized in that: include: A sensitive vocabulary data storage module (4) composed of a storage module for memorizing a specific sensitive vocabulary library and a cloud storage module (5), for storing sensitive vocabulary for network reference by a network control terminal (3), wherein the network control terminal (3) comprises a signal tower, on which various signal base stations are mounted, and which are transmitted to a designated area via optical fiber for wireless network connection and coverage; A cloud storage module (5) is used for storing network behavior data, which serves the sensitive word data storage module (4) and plays an updating role for the sensitive word data storage module (4); A sensitive word screening unit (6) is used to cooperate with the sensitive word data storage module (4) to trigger web page screening and compare with the data stored in the sensitive word data storage module (4); A network disabling module (7) is used to generate a trigger according to the sensitive word screening unit (6). If no sensitive words are screened out, the network is available. If sensitive words are found in the search, the network disabling module (7) is triggered to block the network. The terminal user declaration module (8) is used for the user to select a complaint channel by himself, and can transmit a request through the network to request the operator (1) to re-use the sensitive word screening unit (6) through the sensitive word data storage module (4) for re-inspection; When the sensitive word screening unit 6 retrieves a sensitive word, the network disabling module 7 will be triggered by the sensitive word screening unit 6 at the first time. At this time, a prompt of denying access will appear on the browsing page of the user's mobile device 2. At the same time, the sensitive word screening unit 6 will continue to perform a global search and make further judgments based on the global sensitive word ratio of the website page. If the vocabulary is less than the critical value, a warning prompt box will be triggered when the user refreshes the web page, and the user can choose whether to browse.

2. A mobile terminal user network behavior sniffing system according to claim 1, characterized in that: The cloud storage modules (5) installed in the sensitive vocabulary data storage modules (4) connected to the multiple sites of the network control terminal (3) all share information with each other through the local area network. Whenever a single group of cloud storage modules (5) obtains a new vocabulary and updates the record, the cloud storage module (5) will send a signal to enable it to exchange information with the cloud storage module (5) and update synchronously.

3. A mobile terminal user network behavior sniffing system according to claim 1, characterized in that: When the sensitive word screening unit (6) retrieves a sensitive word, the network disabling module (7) will be triggered by the sensitive word screening unit (6) at the first time. At this time, a prompt of denying access will appear on the browsing page of the user's mobile device (2). At the same time, the sensitive word screening unit (6) will continue to perform a global search and make further judgments based on the global sensitive word ratio of the website page. If the vocabulary is less than the critical value, a warning prompt box will be triggered when the user refreshes the webpage, and the user can choose whether to browse.

4. A mobile terminal user network behavior sniffing system according to claim 1, characterized in that: The sensitive word screening unit (6) comprises a homophonic associative word module and a graphic character recognition module.

5. A mobile terminal user network behavior sniffing system according to claim 1, characterized in that: The sensitive word screening unit (6) is connected to the terminal user reporting module (8) through a sensitive word topic trigger jump, and the terminal user reporting module (8) is bidirectionally connected to the network control terminal (3).

6. A method for sniffing network behavior of a mobile terminal user, the method being an implementation method of the mobile terminal user network behavior sniffing system according to any one of claims 1 to 5, comprising the following steps: S10: The user sets up and installs a network control terminal (3) to establish an information communication channel between the operator (1) and the user's mobile device (2); S11: differentiating the channel according to the connection mode between the operator (1) and the network control terminal (3), and determining whether the channel is a data network or a WLAN; And distinguish the network purpose and determine the location of the target IP address it is connected to; S12: If the target IP address is outside China, the operator (1) records the IP address and visits the user through the user's mobile device (2). If it is a domestic IP address, it will be released after screening; S13: Screening for sensitive words based on the target IP address and specific search content keywords, and capturing and translating pictures or GIFs on the webpage by scanning and including them in the sensitive word screening candidates; S14: making a detailed judgment based on the time the user stays on the webpage and the ratio of sensitive words to the full text of the webpage; S15: If the percentage of sensitive words exceeds the prescribed level, access is denied and the webpage search page is disconnected from the network; S16: triggering a network prompt according to the actual scope of sensitive words involved; S17: After the network prompt is triggered, the web page will be jumped immediately to present green and healthy psychological guidance content, and legal education and prompt warnings will be carried out.

7. A method for sniffing network behavior of a mobile terminal user according to claim 6, characterized in that: When the network connection target is an overseas network IP, the operator (1) has the right to monitor and record it. Within 0-24 hours after the user accesses the network, the operator (1) needs to determine whether to conduct a two-way customer return visit based on the user's access content.

8. A method for sniffing network behavior of a mobile terminal user according to claim 6, characterized in that: The sensitive word screening in the method monitors the global content of web pages in GIF and FLV animated short video formats, and then converts the content recognized by images and texts into text and includes it in the sensitive word screening items.

9. A method for sniffing network behavior of a mobile terminal user according to claim 6, characterized in that: The following auxiliary method is supplemented for a method for sniffing network behavior of a mobile terminal user, including the following steps: S20: When a user joins the network, an agreement is drawn up and signed. The operator (1) monitors the user's network IP and account when the user violates the agreement; S21: When a user browses a web page using a protocol IP network, if sensitive word checking detects browsing of illegal networks, the operator (1) is informed and then manually determines whether to track, supervise or control. After confirming the violation, the operator (1) makes a judgment based on the severity of the violation and takes corresponding management measures. If the violation is serious, the operator (1) has the right to conduct anti-tracking of the original target network and contact the Internet police immediately to form a self-protection and emergency risk avoidance precaution; S22: The operator (1) conducts anti-tracking on the illegal IP and webpage according to the actual situation, and traces the illegal IP to its source; S23: After determining the illegal IP address, the operator (1) simultaneously sends information to other similar service providers and exchanges information with the Internet police department; S24: Search prompts for offline illegal websites and IP addresses on the entire network, and creates a new firewall; S25: Establish an independent sensitive word library and point-to-point network supervision for illegal websites and IP addresses; S26: For Internet users who log in to illegal websites and IP addresses, conduct identity verification and investigation without informing the users, or supervise them in a compliant and illegal manner without infringing on citizens’ rights.

10. A method for sniffing network behavior of a mobile terminal user according to claim 6, characterized in that: The method executes the steps of verifying illegal content and tracing its source in a loop until the operator (1) finds the illegal source after tracing the illegal website IP address or stops after manual setting.

Images