I resolve the problem.
First, I change my LAN ip manually and initially disconnect the wifi connection on my computer. For example, change 192.168.0.110=>anyone such as 192.168.0.111 with your subnet mask. I also get rid of my original ip on my router. Secondly, set the firewall and allow your wanted list program such as "google drive", messages chat software and something else. Then, when the internet is disconnected, I use the "sudo lsof -i" to show the PID and connection status. I find out a suspicious connection status and use "kill -9 thesuspiciousPID" to kill it. Why is is suspicious? When I reboot my computer after closing any potential threaten connection such as Google drive or Dropbox in few times, then I find out a trick thing about my connection making this matter. If I didn't connect to the internet, my terminal shows up the normal computer name. So, my direction is right for going to delete the suspicious process. The second point is the name of making my computer name. I find out a connection to a specific strange website which is owned by a organization. Moreover, it points to my mail host on the other machine.(i.e. This is quite daunting and I get the thriller.) Anyway, this make me know the potential threaten. Share for someone.
