一個偵測個人資料洩漏的雲端服務建置

個人資料保護法於2012年10月1號正式上路。若各個企業中有內部員工及客戶之個人資料遭受洩漏，對企業將會有重大影響。所以組織必須採取適當的控管及安全措施，防止個人資料被竊取、竄改、毀損或洩漏。本研究中我們討論一個偵測個人資訊洩漏的雲端服務。將以雲端供應商微軟的Windows Azure服務元件進行建置，以便提供企業存取此服務進行個資洩漏偵測，這個服務可以擷取企業內部伺服器傳送的相關封包並進行蒐集相關資訊，再將蒐集到的資訊和封包來檢測個人資料洩漏。然後，將蒐集到的主機位置、傳輸時間和個人資料，利用貝氏定理計算有可能疑似洩漏個人資料的封包的嫌疑程度。這種方法使企業不需花費巨大成本建置偵測系統，即可偵測洩漏個人資料之嫌疑人。

關鍵字

貝氏定理；個人資料洩漏；雲端服務

並列摘要

Protection of personal information has currently become an important issue in Taiwan. The Personal Information Protection Act of Taiwan was officially adopted on October 2012. Enterprises could be trapped in lots of risks suffered from the leakages of staff and customers' personal information. So, enterprises, in general, should take appropriate controls and security measures to prevent personal information being stolen, tampered with, damaged or leaked. In this paper, we proposed a cloud service based on Microsoft Windows Azure to detect the leakage of personal information from corporations. The proposed approach could be used to detect the leakage of personal information by collecting the packets, which are transmitted into and from the specific corporation and include some sensitive date. Then, the suspected host location, transmission time and personal data are inputs to calculate the possibility of the susceptibility by Bayes' Theorem. Our approach provides the benefit that enterprises could detect the susceptibility of the leakage of personal information from cloud services.