1293161 九、發明說明： 【發明所屬之技術領域】 本發明係關於一種多通訊埠内容湿^m 今风險官理方法及其系 統，尤指一種針對資訊流内容進行風險瞢裡+ 4 &狂之技術，而各 通訊埠資訊流的内容，將會依管理目的祐备 们被糸統性轉化應用 為管理決策。1293161 IX. Description of the invention: [Technical field to which the invention pertains] The present invention relates to a multi-communication, content, and risk management method and system thereof, and more particularly to a risk of information flow content 4 + + 4 & The technology of madness, and the content of each communication and information flow, will be applied to management decisions by the management of the purpose.
L先丽技術J 不論是網際網路或區域網路’其帶給人們在相互連炊 溝通上的便利毋庸置疑，然而高度便利性的背後亦潛㈣ 咼度的危險性，一般討論的網路安全， 隹 夕千果甲在封包安 全性的解析，鮮少著眼在網路資訊流的内容管理。有關於 封包的女全性解析，大多教+受各如厶 夕数止業會在網路設備與外部網路 之間架設防火牆’以遏止病毒入侵及垃圾郵件。但 = 卜部傳送的資訊流，在内容上是否符合安全規範，= 〜的技術執行自動化管理，反而訴諸在從業人員本身的、 署 由制度面來加以規範，例如要求從業人員簽 有法律政力的彳早0说中 鱼八 0保在協疋，錯此保護企業内機密或客戶 鍵貝斜不致外洩°然而前述的方式&努—— 消極且不切實際的。ώ认a J" A ^ ^ ^ 業人員有咅“立同路貧訊流通的便捷性，不論從 ee,,. 〜S…、’&，都十分容易將涉及企業内部的機@ $ 闕鐽資料透過網败从士 1钱社或 規範，是益法右 浊，此種狀況單靠宣導或保密協定的 疋無法有效遏止的。 1293161 【發明内容】 由上述可知，既有網路安全管理 安全性的解淤，i w、— θ 制大夕者重於封包 认八 少者眼於資訊流内容的安全〜 於企業的網路安全fg理，此對 文王e理無疑疋—大隱憂與挑戰。 ^ 本發^要目的在提供—種㈣ 流内容進行風險管理之方法。 了夕通讯埠貢訊 為達成前述目的採取的主要技 括下列步驟： 杈係7别述方法包， 將網路設備送出的資訊流進 的内容屬性予以分類儲存； 亚根據預先定義 利用預設的樣本、古五粗芬^一 訊流進行檢核比對；— ”條件對備份的資 險指：==果判_流的風險指數，並根據風 流内衮么…/ 進而依管理目的，將資訊 、、二由本系統轉化為管理決策之參考用。 利用前述技術可針對企辈 容進行風險管理，強調運用内:=外對内的資訊流内 關技術，以強化資安 ，、使用仃為分析的相 *理。“^曰、"斤能力與有效實施内容安全的 一面本發明更有別於現有網路 anti-vi「us、丨ps)著 文厓叫丨間wan、 疋網路安全的工具性產品 丄其不，、 識及成效管理，^u 、/ 纟可達到内容安全的智 過滹範本庫 止業冬識領域所發展的内容分類及 I應轭本庫，解析網路資訊流的 ^ 企業針對數位内容管理的麥策 H式’藉以提升 ’、乘仏值，降低網路不當資訊流 1293161 所造成的使用風險。 用系：發：二:二的在提供一種多通訊埠内容風險管理應 ”訊流備及防火牆網路設備送 。其包括有：理，並進而提供管理^策資訊 2知核組，係針對送入或送出的資訊流進行備份； 使用ϋ =類資料庫’係針對企業特性建立内容特徵及 Φ ‘，、、寺斂樣本，作為内容管理之檢核比對依據； :檢查過渡模組’係根據智識分類資料庫建立的特徵 險户數對:f份模組已備份之資訊流執行檢查，以分析其風 值則予摘=風險指數低則予放行，若風險指數高於-警戒 即時==模=成：…可依據管理政策分別執行 &理，或進行分批資訊的事後檢核追查。 :述多通訊埠内容風險管理應用系統適用於内 #外對内之雙向資訊流管理。 月·J述智識分類資料庫至少包括有·· 學習=本庫’/系運用文意解析技術’收集各類過濾庠的 徵；〜.，亚經過自動學習’萃取出各類樣本庫的樣本特 隹語料庫，係運用内容解析及關鍵語詞萃取原理， 木笔子郵件及不當資訊 料庫的樣本特徵； 的内…本，以萃取出各類語 内谷使用行為特徵庫，係將企業觀察資訊流内容的 6 1293161 =為，進行特徵分析，並對每一種特徵分別定義其風 前述文意解析技術係採用 技術。 文子探勘」（Text Mining 【實施方式】 ^帛圖所v本發明主要係將—多通訊璋内容風險 管理應用系統（10)橋接於網路防火牆（2〇)(或 Router)的後端，並以柊垃 π n、 橋接（Βηε1π)的方式安裝於防火牆（ 2〇)與各種網路設備（3〇)之間，尤指在防火 w)後，能夠接觸到SMTP/P0P3軸卩鳩㈣、L Xianli Technology J Whether it is the Internet or the regional network, it brings people the convenience of communicating with each other, but there is no doubt behind the high convenience. (4) The danger of ambiguity, the network in general discussion Security, 隹 千 果 在 在 in the analysis of packet security, rarely focus on the content management of the network information flow. Regarding the full-featured analysis of the female package, most of the teachings are subject to the slogan of setting up a firewall between the network device and the external network to curb virus intrusion and spam. However, if the information flow transmitted by Bu Department meets the safety regulations in the content, the technical execution of the technology is automatically managed. Instead, it is appealed to the practitioners themselves, and the department is regulated by the system. For example, the practitioners are required to sign legal power. The early 0 0 said that the fish eight 0 insurance in the agreement, the wrong to protect the confidentiality of the enterprise or the customer key slant does not leak. However, the aforementioned method & - negative and unrealistic. I admit that a J" A ^ ^ ^ industry staff has the convenience of "distributing the same road to the poor, regardless of the ee,.. ~S..., '&, are very easy to involve the internal machine @ $ 阙鐽 鐽 鐽 从 从 士 士 士 士 士 士 士 士 士 士 士 士 士 士 士 士 士 士 士 士 士 士 士 士 士 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 Management security, silencing, iw, θ 大 夕 夕 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者 者Challenge. ^ The purpose of this issue is to provide a method for risk management of (4) streaming content. The main steps taken by the communication company to achieve the above objectives are the following steps: The content attributes of the information sent by the device are classified and stored; the sub-predetermined sample is used according to the pre-defined sample, the ancient five rough fen ^ ^ flow for checking the comparison; - "conditions for the backup of the insurance refers to: == fruit Judging the risk index of the flow, and according to the turbulence ... / then according to management purposes, information ,, will be transformed by the two reference systems management decision-making purposes. The above technology can be used for risk management of enterprise resources, emphasizing the use of internal information technology within the internal:= external and internal information to strengthen the security, and use 仃 as the analysis. "^曰," 斤 capability and effective implementation of content security The present invention is more indistinguishable from the existing network anti-vi "us, 丨ps", which is called the wan, 疋 network security tool product 丄It does not, and recognizes the effectiveness management, ^u, / 纟 can achieve the content security of the wisdom of the model library, the industry classification of the development of the content of the field and I should yoke the library, the analysis of the network information flow ^ Enterprise targeted The digital content management of the Maizer H-type 'to enhance', take advantage of the value, reduce the risk of the use of improper network information flow 1293161. Department: send: two: two in the provision of a multi-communication, content risk management should be" Streaming and firewall network device delivery. It includes: rationality, and then provides management information policy 2 knowledge core group, which is to back up the information flow sent or sent; use ϋ = class database to establish content features and Φ ',, The sample of the temple is used as the basis for checking the content management; the inspection transition module is based on the number of characteristic insurance households established according to the intellectual classification database: the inspection of the information flow that has been backed up by the module is analyzed to analyze The wind value will be excerpted = if the risk index is low, the risk index will be released. If the risk index is higher than - the warning is immediate == modulo = Cheng: ... can be executed separately according to the management policy, or after the post-checking of the batch information. : The multi-communication, content risk management application system is applicable to the two-way information flow management within the internal and external. The monthly J-intelligence classification database includes at least the following: · Learning = the library '/ is the use of literary analysis technology to collect the various types of filtering ; ;; ~., through the automatic learning 'extracting various sample libraries The sample special corpus is based on the principle of content analysis and key word extraction, the sample characteristics of the wooden pen mail and the inappropriate information database; the internal...the original, to extract the various types of intra-language use behavior characteristics library, the company will observe the enterprise The information flow content of 6 1293161 = for, the feature analysis, and each of the characteristics of the wind is defined by the aforementioned textual analysis technology. Text Mining [Text] [Embodiment] The present invention mainly relates to the multi-communication, content risk management application system (10) bridged to the back end of the network firewall (2) (or Router), and It is installed between the firewall (2〇) and various network devices (3〇) in the manner of πππ, bridge (Βηε1π), especially after the fire protection w), it can access the SMTP/P0P3 axis (4),
Http、旧、P2P...等所右眘 所,貝乱流的位置，以便針對各個資 訊執行截取及管理的動作。 胃 ==容風險管理應用系统（1。）係雙向地 ::内谷官理功施’意即由外部送入企業的資訊 企業内對：傳送的資訊流，均在内容管理之列。- :關前述多通訊痒内容風險管理應用系統（1㈧之 、、且成睛參閱第一圖所示，其包括有· 一備份模組（Ί !、 及力丄„ ，令資π、、亡可# 0 I A / ，丨小淡丨巧送入的資訊流進行備份 4貝讯Μ可月b疋外對内或内對外； 一智識分類資料庫（1 2 ) , ^ 容特n乃#用粁A、針對企業特性建立内 谷特欲及使用订為特徵樣本， 據； 勹鬥谷官理之檢核比對依 一檢查過濾模組（Ί 9、，此 $根據智識分類資料庫（ 7 1293161 1 2 )建立的特徵樣本，對備份模乡且 訊執行檢查，並分析其風 ）備知' 扞，芒/i? ^ 2 才數右風險指數低則予放 -右:險指數高於-警戒值則予摘截；其中： 如第三圖所示，該備份 分類資料庫㈠！，用以1 )中包含複數個的 1 )刀別储存經過備份模組（1 1 )備伤且分類的資訊流， QMTD/n^ j仏分類的類型為·· SMTP/p〇p3/,MAp/Web Majl ^The Http, the old, the P2P, etc. are located in the right place, in order to perform the interception and management actions for each information. Stomach == tolerance risk management application system (1.) is two-way: :: 内谷官理施施' means that information sent from outside the enterprise is within the enterprise: the information flow transmitted is in the content management. - : Turn off the above-mentioned multi-communication itch content risk management application system (1 (8), and look at the first picture, which includes a backup module (Ί!, and force 丄, π, 、, 死可# 0 IA / , 丨小淡巧巧入入的信息流 for backup 4贝讯Μ可月b疋外内内内内内内; 一智识分类库(1 2 ) , ^ 容特n乃# Use 粁A, establish a characteristic sample of the characteristics and use of the company for the characteristics of the enterprise, according to; 勹斗谷官理inspection comparison check filter module (Ί 9,, this $ according to the intellectual classification database (7 1293161 1 2 ) Established feature samples, check the backup model and analyze the wind, and analyze the wind.) 捍, 芒/i? ^ 2 Only the right risk index is low - right: the risk index is higher than - the warning value is extracted; wherein: as shown in the third figure, the backup classification database (1)!, for 1) contains a plurality of 1) knife storage is repaired by the backup module (1 1 ) The classified information flow, QMTD/n^ j仏 classification type is ·· SMTP/p〇p3/, MAp/Web Majl ^
Http ' IM、P2P...等資料。 忒#識分類資料庫（2 2 ) 含： 乙」係如弟四圖所示，至少包 複數的樣本庫（；[2 j ) 如「寺& # ^ ^ 係運用文意解析技術（例 如文子板勘」（Text Mining) 璺羽铲士 收票各類過濾庫的 子白乾本，並經過自動學習， 微，！；i 一八I 卞取出各類樣本庫的樣本特 支以一止業為例，各類樣本 務資料、業務資料、客戶資料的樣本特徵包含與財 嗖一， 貝枓、人事資料、研發資料、合 4貧料、客服客訴類等有關的相關字詞； 曰 複數的語料庫（1 2 2 )，俜谨田ώ Λ 二m — 係運用内谷解析及關餘兮五 祠卒取原理，收集電子郵件及者次^ '* s 不备為訊防治的内容筋太， 以卒取出各類語料庫的樣本特徵；i处 庫或不當資訊防治語料庫等； 〃月匕…罔路郵件語料 複數的内容使用行為特徵庫 察資訊流内容的使用行為# τ、將企業觀 為換式進行特徵分析，並對每一錄 特徵分別定義其風險指數。 母一種 又S理目的，該内容- 特徵庫（123)可經系統 使用仃為 n 愿用為顧客關#、、牡铱士 k資料庫」、風險防範決策支援資料痛 …、朿支 朿叉杈貝枓庫」、「營銷策略 1293161 決策支援資料庫」等決策支援參考資訊。 利用則述系、·先可用以對多通訊蜂的資訊流執行内 理： & 當資μ進人企業網路（如第—圖所示）《自企業網 路送出（如第五圖所示）時，合 — s先經過該多通訊埠内容風 險管理應用系統（10)的内容過濾管理程序。 首、先將啟動備份馳（11)將所有資料流的内容即 :伤’並予分類儲存，而經分類儲存的資訊流則再送入 才双查過濾模組（1 3 ) 5 Μ 康3硪分類資料庫（1 2 )提 以 料庫及特徵料執行檢查程序，並定義以 &風險指& ’在此—檢查程序中將預先定義―警戒值，作 為攔截或放行的判斷依據。若 ^ . 貝汛内容的風險指數高過 舌戒值，即依據管理政策分別執行即時搁截管理，或進行 H訊的事後檢核追m若資職㈣風險指數 L 則經系統備份後即直接放行。 、▲，兒月可瞭解本發明之具體技術内容及工作原 ，以該等設計至少具備下列優點與特色： “：:_易於管理稽查：本發明可針對資訊流及人員使用 二了τ統計’除了提保負責人員*主管進行稽查，透過 > 、表可瞭解内容官理之成效。而系統管理者可參考實 鈿成果報表，調整内容管理政策及因應之系統設定。 内谷管理政策.企業訂立内容管理政策後， :針：全體或群組別進行内容過濾、處理狀態等設定。並 、同時對照智識分類資料庫’逐筆檢核資訊流的内容，並 9 Ϊ293161 、仃風險指數的計算及核定。 —.積極的管理成效··經過本發 後，若資 不知月内合官理機制過濾 核出資訊：：内容，：直接放行而離開系統；若檢 分別執行g 士合的風險扣數同過誓戒值’則依據管理政策 理者等 攔截資訊流，並會執行進入審核、或通知管 批h =行動。對於高㈣戒值不多的資訊流則進行分 報止 檢核追查’對於整體而言’可提供風險評估 土：對於個別人員管理而言’可做為使用行為異常的報 一盖：上述可知’本發明確實可為企業的資訊流執行嚴密 :。勺内容管;里’對於企業的商業機密或關鍵資料提卜 機制，從而保障企業本身的權益及提高消費者； t賴感，故已具備突出的技術特徵與顯然的 並付合發明專利要件，爰依法提起申請。 , 【圖式簡單說明】 =一圖係本發明之系統安裝位置示意圖。 第二圖係本發明之一系統方塊圖。 /·、一圖係本發明備份模組之組成示意圖。 第四圖係' 本發明智識分類資料庫之組成示意圖。 第五圖係本發明又一系統方塊圖。 【主要元件符號說明】 (1 〇)多通訊埠内容風險管理應用系統 (1 1 )備份模組 （1 1 1 )分類資料庫 1293161Http 'IM, P2P... and other information.忒#Classification database (2 2 ) Contains: B) is shown in the figure of the fourth brother, at least the number of sample libraries (; [2 j ) such as "Temple &# ^ ^ is the use of semantic analysis techniques (such as Text Mining 璺 铲 铲 收 收 收 收 各类 各类 各类 各类 各类 各类 各类 各类 各类 各类 各类 各类 各类 各类 各类 各类 各类 各类 各类 各类 铲 铲 铲 铲 各类 铲 铲 铲 铲 铲 铲 铲 铲 铲 铲 铲 铲 铲 铲 铲 铲 铲 铲 铲For example, the sample characteristics of various sample business materials, business data, and customer data include related words related to Caiyiyi, Bessie, personnel data, R&D data, 4 poor materials, and customer service complaints; Corpus (1 2 2 ), 俜 ώ ώ ώ Λ m m m m 运用 运用 运用 运用 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内 内To take out the sample characteristics of various corpora; i library or improper information prevention corpus; etc.; 〃月匕...罔路邮件 corpus plural use content behavior characteristics library to check the use of information flow content τ, view of the enterprise Perform feature analysis for the change and separate each feature Yiqi risk index. The mother-type and the purpose of the purpose, the content - the feature library (123) can be used by the system 仃 is willing to use as customer-off #,, 铱 铱 k database, risk prevention decision support data pain... Decision support reference information such as “朿 朿 杈 杈 」 ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” ” μ into the corporate network (as shown in the figure - "sent from the corporate network (as shown in Figure 5), the - s first through the multi-communication content risk management application system (10) content filtering Management program. First, the first backup will start (11), the content of all data streams will be classified as: injury and classified, and the classified information will be sent to the double filter module (1 3 ) 5 Μ The Kang 3硪 classification database (1 2) carries out the inspection procedure with the library and the characteristic materials, and defines the & risk index & 'in this - the inspection program will pre-define the warning value as the judgment of interception or release. According to. If ^. The risk of Bessie content The index is higher than the tongue ring value, that is, the immediate delivery management is performed according to the management policy, or the H-signal is checked afterwards. If the risk index L is released after the system is backed up, ▲, 儿月Knowing the specific technical content and working principle of the present invention, the design has at least the following advantages and features: "::_Easy to manage the audit: The present invention can be used for information flow and personnel use τ statistics' except for the responsible person* The supervisor conducts audits and can understand the effectiveness of the content management through the > and the table. The system administrator can refer to the actual results report, adjust the content management policy and the system settings. The internal management policy. After the company has established the content management policy, :Needle: Set the content filtering and processing status for all or groups. At the same time, the content of the information flow is checked one by one against the intellectual classification database, and the calculation and verification of the risk index are carried out. —. Positive management results··After this issue, if the funds do not know the monthly government and the mechanism to filter out the information:: content, direct release and leave the system; if the check is performed separately, the risk deductions are the same The swearing-off value is based on the management policy, etc., and intercepts the information flow, and will perform the entry review, or notify the approval of the h = action. For the information flow with high (four) ring value, the report will be checked and checked. For the whole, the risk assessment can be provided: for individual personnel management, it can be used as a report of abnormal use behavior: 'The invention can indeed enforce strict information flow for the enterprise: Spoon content management; in the 'business secrets or key information technology to protect the company's own rights and improve consumers; t, so it has outstanding technical characteristics and apparently pay and invent the patent requirements,提起 File an application in accordance with the law. [Simplified description of the drawing] = A diagram is a schematic diagram of the installation position of the system of the present invention. The second figure is a block diagram of one of the systems of the present invention. /·, a picture is a schematic diagram of the composition of the backup module of the present invention. The fourth figure is a schematic diagram of the composition of the intellectual classification database of the present invention. The fifth figure is a block diagram of still another system of the present invention. [Main component symbol description] (1 〇) multi-communication 埠 content risk management application system (1 1 ) backup module (1 1 1 ) classification database 1293161
(1 2 )智識分類資料庫 (1 2 1 )樣本庫 （1 3 )檢查過濾模組 (1 2 2 )語料庫 (1 2 3 )内容使用行為特徵庫 (2〇）防火牆 （3〇）網路設備 11(1 2) Intellectual Classification Database (1 2 1) Sample Library (1 3) Check Filter Module (1 2 2) Corpus (1 2 3) Content Usage Behavior Feature Library (2〇) Firewall (3〇) Network Road equipment 11