一個偵測個人資料洩漏的雲端服務建置

連志誠；劉韋辰；陳琮文

貝氏定理 ； 個人資料洩漏 ； 雲端服務 ； Bayes' Theorem ； Information Leakage ； Personal Information Protection Act

電腦稽核

27期（2013 / 01 / 01）

102 - 111

繁體中文

個人資料保護法於2012年10月1號正式上路。若各個企業中有內部員工及客戶之個人資料遭受洩漏，對企業將會有重大影響。所以組織必須採取適當的控管及安全措施，防止個人資料被竊取、竄改、毀損或洩漏。本研究中我們討論一個偵測個人資訊洩漏的雲端服務。將以雲端供應商微軟的Windows Azure服務元件進行建置，以便提供企業存取此服務進行個資洩漏偵測，這個服務可以擷取企業內部伺服器傳送的相關封包並進行蒐集相關資訊，再將蒐集到的資訊和封包來檢測個人資料洩漏。然後，將蒐集到的主機位置、傳輸時間和個人資料，利用貝氏定理計算有可能疑似洩漏個人資料的封包的嫌疑程度。這種方法使企業不需花費巨大成本建置偵測系統，即可偵測洩漏個人資料之嫌疑人。

Protection of personal information has currently become an important issue in Taiwan. The Personal Information Protection Act of Taiwan was officially adopted on October 2012. Enterprises could be trapped in lots of risks suffered from the leakages of staff and customers' personal information. So, enterprises, in general, should take appropriate controls and security measures to prevent personal information being stolen, tampered with, damaged or leaked. In this paper, we proposed a cloud service based on Microsoft Windows Azure to detect the leakage of personal information from corporations. The proposed approach could be used to detect the leakage of personal information by collecting the packets, which are transmitted into and from the specific corporation and include some sensitive date. Then, the suspected host location, transmission time and personal data are inputs to calculate the possibility of the susceptibility by Bayes' Theorem. Our approach provides the benefit that enterprises could detect the susceptibility of the leakage of personal information from cloud services.

1. 行政院法務部，電腦處理個人資料保護法，1995 年。
2. Wireshark. Introduction to wireshark, 2011. http://www.wireshark.org/
3. 行政院法務部，個人資料保護法，2010 年。
4. Verizon Inc., 2010 data breach investigations report, Verizon Inc , 2010 .
5. Armbrust, M.(2010).A view of cloud computing.Communications of the ACM,53,50-58.
6. D'Arcy, John,Hovav, Anat,Galletta, Dennis(2009).User awareness of security countermeasures and its impact on information systems misuse: A deterrence approach.Information Systems Research,20(1),79-98.
7. Easttom, Chuck,Taylor, Jeff(2010).Computer Crime, Investigation, and the Law.Course Technology PTR.
8. Foster, I.,Zhao, Yong,Raicu, I.,Lu, S.(2008).Cloud Computing and Grid Computing 360-Degree Compared.Grid Computing Environments Workshop
9. Identity Theft Resource Center=ITRC(2012).,Identity Theft Resource Center.
10. Me, G.,Spagnoletti, P.(2005).Situational crime prevention and cyber-crime investigation: the online pedo-pornography case study.The International Conference on Computer as a Tool, 2005. EUROCON 2005
11. Scarfone, Karen,Souppaya, Murugiah,Hoffman, Paul(2011)."Guide to Security for Full Virtualization Technologies," Recommendations of the National Institute of Standards and Technology(NIST).
12. Sukhai, Nataliya B.(2004).Hacking and cybercrime.Proceedings of the 1st annual conference on Information security curriculum development, InfoSecCD '04,New York, NY, USA:
13. Willison, Robert,Siponen, Mikko(2009).Overcoming the insider: reducing employee computer crime through situational crime prevention.Communications of the ACM,52(9),133-137.
14. 方國偉、趙立威(2011)。讓雲觸手可及─微軟雲端運算實踐指南。台北:博碩文化股份有限公司。
15. 李國華(2010)。碩士論文(碩士論文)。國防大學資訊管理研究所。
16. 邱志傑(2012)。善用免費工具個資盤點也能DIY。資安人，34-38。
17. 楊文誌(2010)。雲端運算Cloud Computing 技術指南。台北:松崗圖書。

1. 連志誠(2015)。一個運用海量資料分析企業競爭力的方式。電腦稽核，31，9-20。