KR101164289B1 - System and method for extracting a history of web activities - Google Patents

Abstract

According to the present invention, when a user uses a web service provided by a web server through a communication terminal such as a computer terminal or a mobile phone, the user extracts and stores web activity information using content such as a product purchased or a video viewed, and then stores the web activity information again. The present invention relates to a web activity extraction method and system that enables a user to access a web server through a communication terminal and use a content to inquire a previous web activity history based on web activity information.

Web activity extraction system according to the present invention, a web server for providing a web page via a communication network; And a user terminal which captures an HTTP message using API hooking from the web page provided from the web server, and extracts content information from the HTTP message based on a specific extraction rule.

According to the present invention, it is possible to re-view the content that has been viewed in the past based on the web activity information extracted from the user terminal. In addition, specific content can be easily searched based on web activity information. In addition, when a web page is requested, a web page including the corresponding content in which the URL information of the content is recorded may be directly provided. In addition, by automatically recording information about the specific content, the user can easily manage the content in a convenient way.

Web Page, Capture, Content Info, HTTP, Web Activity, Extract, DLL, API, IAT

Description

System and method for extracting a history of web activities}

The present invention relates to a web activity extraction system and method, and more particularly, when a user accesses a web site provided by a web server and uses a web service through a communication terminal such as a computer terminal or a mobile phone, After extracting and storing web activity information using contents such as products or videos that have been viewed, the user can view previous web activity history based on the web activity information when the user wants to access the web server using a communication terminal. To a web activity extraction system and method.

In recent years, as the use of web pages using a computer terminal or a mobile phone terminal increases, a technique for extracting web activity has emerged.

Web activity includes an operation in which a user accesses a web site, purchases a product, or views or uses content such as music or a video.

Conventional techniques for extracting such web activities include analyzing the usage behavior of web page users or analyzing web log files of users accessing web pages.

Here, clickstream based analysis is used as a method of analyzing user usage behavior. The clickstream based analysis method is a method of analyzing web content clicked by a web page user, and such an analysis method cannot determine how exposed the web content is composed of more than one screen.

In addition, in case of clickstream analysis, it analyzes using only limited information stored in the log, so the time required to download web content and inactivity time passed by users without clicking properly due to other actions and interest in the content For example, various usage behavior information such as mouse movement amount and screen movement amount are excluded and remain in a state of analysis.

On the other hand, web log analysis analyzes the log files generated by the web server while providing services, and performs basic analysis such as traffic and error status, and visit path of the web server, Analyze basic Web site usage.

For this web log analysis, the application must be installed on the client terminal after receiving the HTML page by communicating with the web site to analyze the separate application, that is, rendering the HTML code. I had to install a plug-in for use.

Therefore, the conventional method of extracting web activity remains at the level of technically analyzing the web activity. Therefore, when the user uses the web service, the web activity information is stored, and when the user accesses the web service again, the previous web activity is stored. There is a demand for ways to utilize information.

In order to solve the above-described problems, the present invention, when a user uses a web service provided by a web server through a communication terminal such as a computer terminal or a mobile phone, the web using the content, such as the product purchased by the user or the video that was viewed Provides a web activity extraction system and method that extracts and stores activity information, and allows the user to retrieve previous web activity history based on the web activity information when the user wants to access the web server with the communication terminal and use the content. Has its purpose.

Web activity extraction system according to the present invention for achieving the above object, a web server for providing a web page through a communication network; And a user terminal for capturing an HTTP message using API hooking from the web page provided from the web server and extracting content information based on a specific extraction rule from the HTTP message.

In addition, the API hooking in the user terminal changes the address of the function of the import address table (IAT) that stores the address where the function is stored, and according to the command to request a web page to the web server. Call a specific function of the changed address, and capture the HTTP message by the specific function.

In addition, the API is provided in the form of DL (DLL) in Windows, the corresponding DL (DLL) information is present in the import address table (IAT) of the PE file.

In addition, the user terminal hooks a WinSock API called by a web browser to capture the HTTP message.

In addition, the user terminal extracts the content information based on the specific extraction rule defined for each web site and content type.

In this case, the specific extraction rule is described as an XML document, and a plurality of rules are described through one or more rule tags. Here, the rule tag includes a match rule tag for matching and extracting a specific string.

The user terminal stores the captured content information as web activity information.

On the other hand, the web activity extraction method according to the present invention for achieving the above object, in the web activity extraction method of the system comprising a web server for providing a web page and a client terminal for receiving the web page from the web server (a) changing, by the client terminal, the address number of a function of an import address table (IAT) that stores the address number at which the function is stored; (b) calling, by the client terminal, a specific function of the changed address number corresponding to the command for requesting the web page; (c) the client terminal requesting the web page to the web server through the specific function; (d) the web server providing the web page to the client terminal; (e) the client terminal capturing an HTTP message from the web page; And (f) the client terminal extracting content information from the HTTP message.

In addition, the specific function performs a function of capturing the HTTP message by using hooking of the API.

In addition, the API is provided in the form of a DL (DLL) in Windows, the corresponding DL (DLL) information is present in the import address table (IAT).

Also, in the step (e), the HTTP message is captured by hooking a WinSock API called by a web browser.

In the step (f), the content information is extracted based on an extraction rule defined for each web site and for each type of content information.

In addition, the extraction rule is described in an XML document, and a plurality of rules are described through one or more rule tags.

The rule tag may also include a match rule tag that matches and extracts a specific string.

And (g) storing, by the client terminal, the content information as web activity information.

On the other hand, the client terminal according to the present invention for achieving the above object, Communication unit for transmitting and receiving an HTTP message with a web server for providing a web page; In order to extract the web activity information from the HTTP message, the address of the function of the import address table (IAT), which stores the address where the function is stored, is changed to the address of a specific function, and the web is transmitted to the communication unit. A control unit which controls the extraction of the web activity information by calling a specific function of the changed address when requesting the HTTP message to a server; A web activity extractor for capturing the HTTP message from the web page by the called specific function and extracting content information from the HTTP message; And a display unit for displaying the web page using the HTTP message received from the web server.

The web activity extractor may include a message capture module for capturing the HTTP message, a message analysis module for extracting the content information from the HTTP message, and a filter for removing data not related to the content information from the HTTP message. do.

The web activity extractor also loads a hook DLL on the web browser that captures the HTTP message upon creation of the web browser.

The message analysis module extracts the content information based on an extraction rule defined for each web site and for each type of content information.

In addition, the extraction rule is described in an XML document, a plurality of rules are described through one or more rule tags, and the extraction tag includes a match rule tag that matches and extracts a specific string.

The apparatus may further include a storage unit for storing the content information as the web activity information.

On the other hand, the web activity extraction method of the client terminal according to the present invention for achieving the above object, in the web activity extraction method of the client terminal receiving the web page from a web server for providing a web page, provides a web page A method of extracting a web activity of a client terminal receiving an HTTP message from a web server, the method comprising: (a) changing a number of functions of an import address table (IAT) that stores a number of stored addresses; (b) calling a specific function of the changed address number corresponding to the command for requesting the web page; (c) requesting the HTTP message to the web server through the specific function; (d) receiving the HTTP message from the web server; (e) capturing the received HTTP message; And (f) extracting content information from the HTTP message.

In addition, the specific function performs a function of capturing the HTTP message using hooking of an API.

In addition, the API is provided in the form of a DL (DLL) in Windows, the corresponding DL (DLL) information is present in the import address table (IAT).

Also, in the step (e), the HTTP message is captured by hooking a WinSock API called by a web browser.

In the step (f), the content information is extracted based on an extraction rule defined for each web site and for each type of content information.

In addition, the extraction rule is described in an XML document, and a plurality of rules are described through one or more rule tags.

The rule tag includes a match rule tag for matching and extracting a specific string.

On the other hand, in the recording medium in which the program according to the present invention for achieving the above object is recorded, (a) the process of changing the address of the function of the import address table (IAT) that stores the address where the function is stored ; (b) calling a specific function of the changed address number according to a command for requesting a web page; (c) capturing the HTTP message received from the web server by the specific function; And (d) a program for processing a process of extracting content information from the HTTP message.

According to the present invention, it is possible to re-view the content that has been viewed in the past based on the web activity information extracted from the user terminal. In addition, specific content can be easily searched based on web activity information. In addition, when a web page is requested, a web page including the corresponding content in which the URL information of the content is recorded may be directly provided. In addition, by automatically recording information about the specific content, the user can easily manage the content in a convenient way.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram schematically showing the configuration of a web activity extraction system according to an embodiment of the present invention.

Referring to FIG. 1, the web activity extraction system 100 according to the present invention includes user terminals 110 and 112, a communication network 120, and a web server 130.

Here, the user terminals 110 and 112 are mobile communication terminals that receive a web page from the web server 130 via a mobile communication network and the Internet, or a computer that receives a web page from the web server 130 via the Internet. It includes a wired terminal.

The user terminals 110 and 112 capture a HyperText Transfer Protocol (HTTP) message from a web page provided from the web server 130 and extract content information from the HTTP message.

When capturing HTTP messages, the user terminals 110 and 112 use an API (Application Program Interface) hooking function by changing an import address table (hereinafter referred to as an IAT) of a portable execution file. It will capture HTTP messages.

IAT is an Import Address Table that stores the address where the function is stored. Originally, the IAT stores the address where the API is basically used in the system. However, in the present invention, the My Callback function is defined instead of the API, and the address of the API is changed to the address of the My Callback function. will be. Here, the callback function has a function of capturing an HTTP message.

Therefore, when the user terminals 110 and 112 call a function for receiving a web page from the web server 130, the user terminal 110 and 112 call the callback function instead of the previous API based on the IAT, and the HTTP call through the callback function. It will capture the message. Such a function is called an "API hooking function" in the embodiment of the present invention.

The PE file is a data structure that contains all the information needed by the operating system in order to execute an executable file on Windows, and contains a general API function for getting a web page from the web server 130 through a web browser.

API is an application program interface. It is provided in the form of DL (DLL) in Windows, and the DLL information is present in the IAT table of the PE file. An API is an interface that allows an application to control the functionality provided by an operating system or programming language for use in an application. Mainly provided are interfaces for file control, window control, image processing, character control, and the like.

In other words, an API is a special method predetermined by a computer operating system or another application to make a processing request to an operating system or another application. Thus, the API is distinct from the graphical user interface or the command-line interface, which directly interacts with the user as the operating system or program interface. In addition, an API is a language or message format used when an application program communicates with a system program such as an operating system or a database management system. An API is implemented by calling a function that provides a link to a specific subroutine for execution within a program. Thus, an API has several program modules or routines that must already exist or be linked to perform the work requested by the function call.

The user terminals 110 and 112 hook an API to WinSock called by a web browser to capture an HTTP message.

In addition, the user terminals 110 and 112 extract content information based on an extraction rule defined for each web site and for each type of content information.

The user terminals 110 and 112 store the captured content information as web activity information.

The communication network 120 includes an internet network for wired communication or a mobile communication network for wireless communication.

Here, when the communication network 120 is the Internet network, the user terminal 110 may be a computer terminal.

In addition, when the communication network 120 is a mobile communication network, the user terminal 112 may be a personal digital assistant (PDA), a cellular phone, a personal communication service (PCS) phone, a global system for mobile (GSM) phone, a W-CDMA ( Wideband CDMA) phones, CDMA-2000 phones, Mobile Broadband System (MBS) phones and the like.

In addition, when the communication network 120 is a mobile communication network, the present invention provides a code division multiple access (CDMA), a wideband code division multiple access (WCDMA), and a high speed data packet connection. It can be applied to a network such as HSDPA: High Speed Data Packet Access (WSD) and Wibro.

The web server 130 provides a web service to the user terminals 110 and 112 through the communication network 120. Here, the web service includes a service for providing music files or a video to the user terminals 110 and 112, including a web page, or allowing the user terminals 110 and 112 to read or write data to the web server 130. do. In the embodiment of the present invention, for convenience of description, the web server 130 will be described as providing a web page to the user terminals 110 and 112.

2 is a configuration diagram schematically showing an internal configuration of a user terminal according to the present invention.

Referring to FIG. 2, the user terminals 110 and 112 according to the present invention include a communication unit 210, a storage unit 220, a control unit 230, a web activity extractor 240, and a display unit 250.

In the above configuration, each communication unit 210, the storage unit 220, the control unit 230, the web activity extractor 240 and the display unit 250 may be connected by a bus (Bus).

Here, the web activity extractor 240 includes a message capture module 240 and a message analysis module 250.

The communication unit 210 communicates with the web server 130 through the communication network 120 to receive a web page provided from the web server 130. That is, the communication unit 210 transmits and receives an HTTP message with a web server that provides a web page.

The storage unit 220 includes a data memory for storing data received through the communication unit 210. In addition, the storage unit 220 serves as a buffer through some storage areas. In addition, the storage unit 220 stores the HTTP message captured by the message capture module 240, and stores the location information and system specification information where the terminal is located.

The storage unit 220 stores the content information extracted from the HTTP message as web activity information.

The controller 230 controls an operation of capturing an HTTP message from a web page provided from the web server 130, extracting content information from the HTTP message, and storing the content information as web activity information. That is, in order to extract web activity information from the HTTP message, the controller 230 changes the address number of the function of the import address table IAT, which stores the address where the function is stored, to the address number of the specific function, When the communication unit 210 requests the HTTP message from the web server 130, the specific function of the changed address is called to control the extraction of the web activity information.

The web activity extractor 240 functions to capture an HTTP message from a web page and extract content information from the HTTP message by a specific function called.

In this case, the web activity extractor 240 includes a message capture module 242 for capturing an HTTP message and a message analysis module 244 for extracting content information from the HTTP message.

That is, when the web activity extractor 240 calls a function for receiving a web page, the web activity extractor 240 calls the mycallback function based on the IAT through the message capture module 242 and captures the HTTP message through the mycallback function. do. The web activity extractor 240 extracts the content information based on the extraction rule defined for each web site and the content information type through the message analysis module 244.

In this case, the extraction rule is described as an XML document, and a plurality of rules are described through one or more rule tags. Here, the extraction tag includes a match tag <match_rule> for matching and extracting a specific string.

The display unit 250 allows a web browser to be displayed and displays a web page through the web browser. That is, the display unit 250 displays a web page using the HTTP message received from the web server 130.

3 is a schematic diagram showing the configuration of a web activity extractor in a user terminal according to an embodiment of the present invention.

Referring to FIG. 3, the web activity extractor 240 in accordance with the present invention includes a message capture module 242, a filter 310, a message analysis module 244, and a hook DLL loader 320.

The filter 310 removes data, for example, CSS or JavaScript, which is not related to content information to be extracted from the HTTP message.

The hook DLL loader 320 serves to load the hook DLL 322 onto the web browser 330 from the web activity extractor 240 when the web browser 330 is generated on the display 250.

Accordingly, the web browser 330 of the display unit 250 includes the hook DLL 322. At this time, the hook DLL 322 hooks the WinSock API to obtain an HTTP message transmitted and received by the web browser 330 and delivers it to the message capture module 242.

The message capture module 242 delivers the HTTP message received from the hook DLL 322 to the filter 310 by matching the request / response pair.

The message analysis module 244 selects only an extraction rule such as a hash value using a key for the host information of the captured HTTP message, and performs string matching according to the extraction rule. Through the content information is extracted.

4 is a flowchart illustrating a web activity extraction method according to an embodiment of the present invention.

Referring to FIG. 4, the web activity extractor 240 in the user terminals 110 and 112 may use the address of a function related to an API of an import address table (IAT) that stores the address where a function is stored. The address of the MyCallback function is changed (S410).

Therefore, when a user requests a web page, the web activity extractor 240 refers to the changed IAT and calls a callback function instead of calling a function related to a general API.

Subsequently, when a user requests a web page as the user executes the web browser 330, the controller 230 calls a function related to an API through the web activity extractor 240, and includes a hook DLL loader ( The hook DLL 322 is loaded onto the web browser 330 through 320, and the callback function is called with reference to the changed address of the IAT as shown in FIG. 5 (S420).

5 is a diagram illustrating a process of calling a callback function with reference to a changed IAT when a web page is requested according to an embodiment of the present invention.

That is, as shown in FIG. 5, the web activity extractor 240 calls, for example, 'xxAPI' to request a web page from the web server 130, and the IAT indicates the address of '0031322', so the 'xxAPI' 'Reads the address "0031322" (S510), and since "0031322" refers to the address "0x002011" again,' xxAPI 'reads the address "0x002011" (S520). At this time, "0x002011" of IAT stores address "Ox201201" where mycallback function is stored, so 'xxAPI' does not call the general DLL of existing "0x10032" and does not call the existing DLL at "0x201201". The callback function will be called (S530). Subsequently, the callback function calls the original 'xxAPI' at the address "0x10032" (S540) to obtain data read from the socket and data to be written.

The web activity extractor 240 uses the WinSock API of the WIN32 API to allow the web browser 330 to send and receive an HTTP message. Accordingly, the web activity extractor 240 hooks the WinSock API called by the web browser 330, so that the web browser 330 can get data read from the socket and write data through the hook DLL 322.

The controller 230 transmits a message requesting a web page to a web server while the hook DLL 322 is loaded onto the web browser 330 (S430).

In this regard, the web server 130 transmits the web page to the user terminals 110 and 112 according to a conventional procedure, and the user terminals 110 and 112 receive the web page from the web server 130. (S440).

The controller 230 displays the received web page on the web browser 330. At this time, the hook DLL 322 loaded on the web browser 330 captures an HTTP message from the web page and extracts the web activity extractor. By passing to the message capture module 242 of 240, to capture the HTTP message (S450).

The message capture module 242 delivers the HTTP message to the filter 310, and the filter 310 removes packet data such as CSS or JavaScript that is not correlated with the content information to be extracted, and then delivers the packet data to the message analysis module 244. do.

Accordingly, the web activity extractor 240 extracts content information from the HTTP message through the message analysis module 244 (S460).

At this time, the content information is included in the HTTP message, and its location is different for each web site and content type. Accordingly, the message analysis module 244 extracts the content information according to a specific extraction rule defined for each web site and for each type of content information. The content information may include, for example, a website address used by a user, information on a music file or a video file used, and product information purchased in a shopping mall. In addition, the content information may include information about a title, a picture, a tag, a price, and the like of the content.

Here, the specific extraction rule is a rule for extracting web activity related information from a web document, which is described as an XML document as shown in FIG. 6, and a plurality of rules are defined through one or more rule tags. Are described. 6 is a diagram illustrating an example of document contents of a specific extraction rule used in the message analysis module to which the present invention is applied. At this time, the extraction tag includes a match rule (<match_rule>) tag that matches and extracts a specific string as shown in FIG. 6.

The controller 230 stores the content information extracted through the web activity extractor 240 as the web activity information in the storage unit 220 (S470).

Therefore, when the user requests the web page again later, the control unit 230 displays the web activity information stored in the storage unit 220 through the display unit 250 to display the web activity information previously used by the user. For reference.

As described above, according to the present invention, when a user accesses a web site provided by a web server through a communication terminal such as a computer terminal or a mobile phone and uses a web service, content such as a product purchased by the user or a video that has been viewed Web activity extraction system that extracts and stores the web activity information using the web server, and allows the user to search the previous web activity history based on the web activity information when the user wants to access the web server using the communication terminal. The method can be realized.

As those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features, the embodiments described above are exemplary in all respects and are not intended to be limiting. You must do it. The scope of the present invention is shown by the following claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included in the scope of the present invention. do.

The present invention can be applied to a terminal using a web service provided by a web server, and can be applied to a terminal displaying a web page through a web browser.

In addition, it can be applied to a web service system that wants to revisit the product purchased by the user or to watch the video that the user has viewed again.

In addition, the present invention can be applied to a system that provides a service for viewing a history of a web service used by a user in the past.

1 is a schematic view showing the configuration of a web activity extraction system according to an embodiment of the present invention;

2 is a configuration diagram schematically showing an internal configuration of a user terminal according to the present invention;

3 is a block diagram schematically showing the configuration of a web activity extractor in a user terminal according to an embodiment of the present invention;

4 is a flowchart illustrating a web activity extraction method according to an embodiment of the present invention;

5 is a diagram illustrating a process of calling a callback function with reference to a changed IAT when a web page is requested according to an embodiment of the present invention; and

6 is a diagram illustrating an example of document contents of a specific extraction rule used in the message analysis module to which the present invention is applied.

Description of the Related Art

110, 112: user terminal 120: communication network

130: web server 210: communication unit

220: storage unit 230: control unit

240: Web Activity Extractor 242: Message Capture Module

244: message analysis module 250: display unit

310: filter 320: hook DLL loader

322: Hook DLL 330: Web Browser

Claims (31)

A web server for providing a web page through a communication network; And Capture an HTTP message using API hooking from the web page provided from the web server, and extract a HTTP message from the HTTP message to a specific extraction rule. A user terminal for extracting content information based on the content; The API hooking changes an API address of an import address table (IAT) that stores an address where a function is stored, and requests a web page from the web server. And calling a specific function of the changed API address according to the command, and capturing the HTTP message by the specific function. delete The method of claim 1, The API is provided in the form of a DL (DLL) in Windows, the corresponding DL (DLL) information is present in the import address table (IAT). The method of claim 1, The user terminal hooks a WinSock API called by a web browser to capture the HTTP message. The method of claim 1, And the user terminal extracts the content information based on the specific extraction rule defined for each web site and for each type of content information. 6. The method of claim 5, The specific extraction rule is described in an XML document, and a plurality of rules are described through one or more rule tags. The method of claim 6, The rule tag, Web activity extraction system comprising a match rule tag for matching and extracting a specific string. The method of claim 1, And the user terminal stores the captured content information as web activity information. In the web activity extraction method of a system comprising a web server for providing a web page and a user terminal for receiving the web page from the web server, (a) changing, by the user terminal, the address number of a function of an import address table (IAT) that stores the address number where the function is stored; (b) invoking, by the user terminal, a specific function of the changed address number corresponding to the command for requesting the web page; (c) the user terminal requesting the web page to the web server through the specific function; (d) the web server providing the web page to the user terminal; (e) capturing, by the user terminal, an HTTP message from the web page; And (f) extracting, by the user terminal, content information from the HTP message; Web activity extraction method comprising a. The method of claim 9, The specific function is a web activity extraction method, characterized in that for performing the function of capturing the HTP message using the hooking (API). 11. The method of claim 10, The API is provided in the form of a DL (DLL) in Windows, and the DL (DLL) information is present in the import address table (IAT). The method of claim 9, In the step (e), a web activity extraction method comprising capturing the HTTP message by hooking a WinSock API called by a web browser. The method of claim 9, In the step (f), the web activity extraction method comprises extracting the content information based on an extraction rule defined for each web site and for each type of content information. The method of claim 13, The extraction rule is described in an XML document, and a plurality of rules are described through one or more rule tags. The method of claim 14, The rule tag, Web activity extraction method comprising a match rule tag for matching and extracting a specific string. The method of claim 9, (g) storing, by the user terminal, the content information as web activity information; Web activity extraction method characterized in that it further comprises. A communication unit for transmitting and receiving an HTP message with a web server providing a web page; In order to extract web activity information from the HTTP message, the address of the function of the import address table IAT, which stores the address where the function is stored, is changed to the address of the specific function, and A control unit for controlling the extraction of the web activity information by calling a specific function of the changed address when the HTTP message is requested from the communication unit to the web server; A web activity extractor that captures the HTP message from the web page by the called specific function and extracts content information from the HTP message; And A display unit which displays the web page using the HTTP message received from the web server; User terminal comprising a. The method of claim 17, The web activity extractor, A message capture module for capturing the HTP message; A message analysis module that extracts the content information from the HTP message; And And a filter for removing data not related to the content information from the HTP message. The method of claim 17, And the web activity extractor loads a hook DL (DLL) onto the web browser to capture the HTTP message upon creation of the web browser. The method of claim 18, The message analysis module extracts the content information based on an extraction rule defined for each web site and for each type of content information. 21. The method of claim 20, The extraction rule is described in an XML document, and a plurality of rules are described through one or more rule tags. 22. The method of claim 21, The extraction tag, the user terminal characterized in that it comprises a match rule tag for matching and extracting a specific string. The method of claim 17, A storage unit for storing the content information as the web activity information; The user terminal further comprises. In the web activity extraction method of a user terminal for receiving an HTTP message from a web server that provides a web page, (a) changing the address number of the function in the import address table IAT storing the address number in which the function is stored; (b) calling a specific function of the changed address number corresponding to the command for requesting the web page; (c) requesting the HTP message to the web server through the specific function; (d) receiving the HTP message from the web server; (e) capturing the received HTTP message; And (f) extracting content information from the HTP message; Web activity extraction method of the user terminal comprising a. 25. The method of claim 24, The specific function is a web activity extraction method of a user terminal, characterized in that to perform the function of capturing the HTP message using the hooking (API). The method of claim 25, The API is provided in the form of a DL (DLL) in Windows, the corresponding DL (DLL) information is present in the import address table (IAT) characterized in that the web activity extraction method of the user terminal. 25. The method of claim 24, In the step (e), the web activity extraction method of the user terminal, characterized in that to hook the WinSock API (API) called by the web browser to capture the HTTP message. 25. The method of claim 24, The step (f), the web activity extraction method of the user terminal, characterized in that for extracting the content information based on the extraction rule (extraction rule) defined for each web site, content type. 29. The method of claim 28, The extraction rule is described in an XML document, and a plurality of rules are described through one or more rule tags. 30. The method of claim 29, The rule tag, Web activity extraction method of the user terminal, characterized in that it comprises a match rule tag for matching and extracting a specific string. (a) changing the address of the function of the import address table IAT storing the address where the function is stored; (b) calling a specific function of the changed address number according to a command for requesting a web page; (c) capturing an HTP message received from the web server by the specific function; And (d) extracting content information from the HTP message; The recording medium on which a program for processing data is recorded.

Images