Monitoring and handling system for enterprise data outbound traffic abnormity violation behaviors

Abstract

The invention discloses a monitoring and disposal system for enterprise data exit traffic abnormity illegal behaviors. The system comprises an exit traffic monitoring and preliminary screening module, an encrypted traffic compliance evaluation module and an exit traffic statistics, supervision and disposal module. In the flow registration stage, the flow monitoring server is used for carrying out registration configuration on declarated enterprise export equipment to generate an initial black and white list rule; in the flow monitoring and handling stage, an exit flow monitoring and preliminary screening module is used for preliminarily screening out abnormal flow with exit risks from exit flow of enterprise exit equipment based on the latest black and white list rules and in combination with a large language model; the encrypted traffic compliance evaluation module is used for carrying out compliance evaluation on abnormal traffic in combination with a large language model; and the exit traffic statistics supervision processing module is used for obtaining a processing strategy corresponding to the illegal behavior according to the compliance evaluation result and the related information of the enterprise exit equipment, and dynamically updating the black and white list rule. According to the invention, enterprise abnormal exit flow data can be effectively monitored and handled.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of data security governance, and specifically relates to a monitoring and disposal system for abnormal and illegal behaviors of enterprise data outbound traffic. BACKGROUND

[0002] Enterprise data outbound traffic monitoring and illegal behavior disposal is an important research direction in the field of data security governance, and has received extensive academic attention and practical exploration in recent years. Its research background can be traced back to the rapid development of global digital economy and the growing demand for cross-border data flow, but also reflects the attention to potential security risks and compliance issues in cross-border data flow. Traditional data outbound management methods are usually based on laws and regulations and enterprise self-checking, but these methods have some significant shortcomings. For example, enterprises lack real-time monitoring means for outbound traffic in the process of data outbound, and cannot fully identify and control abnormal data flow; on the other hand, existing security assessment mechanisms are often limited to static pre-check, making it difficult to find illegal behaviors in dynamic data transmission in time. In addition, due to the complexity and different requirements of data regulation rules in different countries, enterprises face great technical and management difficulties in meeting cross-border data compliance requirements.

[0003] With the development of information technology and the improvement of data protection needs, researchers have begun to explore more efficient and comprehensive data outbound monitoring and disposal technologies. Among them, the technology based on traffic monitoring and abnormal behavior identification has attracted widespread attention. By deploying traffic monitoring devices and combining black and white list mode, the enterprise export traffic can be preliminarily screened to detect suspected outbound risk data traffic. In addition, the compliance analysis technology for encrypted traffic has also been valued by researchers. This technology can further judge whether there is illegal behavior by identifying key features in encrypted traffic, thereby providing a reliable basis for the disposal of abnormal data.

[0004] In recent years, international data governance cooperation and the promotion of technical standards have also provided a new research perspective for the compliance management of enterprise data outbound. For example, by establishing data outbound transmission protocols and mutual recognition mechanisms, the efficiency of cross-border data flow can be improved while ensuring compliance. However, the existing data outbound management technology still has great limitations, especially in the accuracy of cross-border traffic monitoring and the flexibility of illegal behavior disposal. For example, the existing traffic monitoring framework is mostly limited to static rule matching, which cannot adapt to the dynamic changes of outbound data in real time; in the identification and analysis of encrypted traffic, the common technology lacks the ability to handle complex encryption protocols, resulting in high-risk illegal behaviors that may be missed.

[0005] Currently, there is no complete existing solution for outbound data auditing. Expanding the scope, cloud service providers such as Oracle and Tencent Cloud offer some outbound data auditing capabilities, but these capabilities are often limited to single services and designed from the perspective of the enterprise's own data security, failing to meet the regulatory authorities' goal of monitoring complete outbound data. Specifically, existing research lacks a complete processing flow and solutions for sensitive data. Most current research focuses on specific topics, such as the sensitivity analysis of encrypted data packets or the behavioral analysis of data packets based on a certain protocol. However, data security is broad; achieving rational and standardized governance requires comprehensive consideration beyond just the content of data packets, including a comprehensive assessment of relevant enterprise behaviors and reporting. Furthermore, most existing data security protection systems are deployed as software gateways, meaning they are only deployed on some enterprise relay nodes or sensitive terminals, allowing sensitive data to potentially leak out through other relay nodes that violate monitoring.

[0006] Therefore, in response to the above problems, there is an urgent need to propose a new monitoring and handling system for abnormal and illegal outbound data flows of enterprises. Summary of the Invention

[0007] To address the aforementioned problems in existing technologies, this invention provides a monitoring and handling system for abnormal and irregular outbound data flows from enterprises. The technical problem to be solved by this invention is achieved through the following technical solution: A monitoring and handling system for abnormal and non-compliant outbound data traffic of enterprises includes: an outbound traffic monitoring and initial screening module and an encrypted traffic compliance assessment module installed at the data exit point of the enterprise's outbound equipment; and an outbound traffic statistics, supervision, and handling module installed on the regulator's traffic monitoring server; the enterprise's outbound equipment corresponds to the client, and the traffic monitoring server corresponds to the server; wherein: During the traffic registration phase: the traffic monitoring server is used to register and configure the export devices of enterprises that have declared their status, and to generate initial blacklist and whitelist rules based on the declaration data of the export devices of enterprises; During the traffic monitoring and handling phase: The export flow monitoring and screening module is used to perform preliminary screening of the export flow of enterprise export equipment based on the latest blacklist and whitelist rules and combined with the big language model, and to detect abnormal flow with outbound risk. The encrypted traffic compliance assessment module is used to perform compliance assessment on the abnormal traffic by combining a large language model, and obtain the compliance assessment result. The outbound traffic statistics, supervision and processing module is used to derive the corresponding handling strategy for violations based on the compliance assessment results and relevant information on the enterprise's export equipment; and to update the blacklist and whitelist rules when the rule update conditions are met.

[0008] In one embodiment of the present invention, the declaration data for enterprise export equipment includes: data type of transmission, daily maximum transmission amount, outbound traffic transmission frequency, transmission interval information, and enterprise encrypted traffic verification method.

[0009] In one embodiment of the present invention, before the start of the traffic monitoring and processing phase, the traffic monitoring server is further configured to acquire the plaintext data stream and the corresponding encrypted data stream cached by the enterprise's egress device within a preset time period, as the egress traffic to be detected by the enterprise's egress device during the traffic monitoring and processing phase.

[0010] In one embodiment of the present invention, during the flow monitoring and handling stage, the outbound flow monitoring screening module, based on the latest blacklist and whitelist rules and combined with a large language model, performs preliminary screening of the outbound flow of enterprise outbound equipment to detect abnormal flow with outbound risk. This process includes: The export flow monitoring screening module uses the latest whitelist or blacklist rules to filter the destination IPs of the export flow of the enterprise's export equipment and obtain the destination IP screening results. The export flow monitoring screening module calculates the transmission rate by using the transmission time and data size of the export flow of the enterprise's export equipment, and uses the transmission rate to screen the export flow of the enterprise's export equipment to obtain the transmission rate screening result. The export flow monitoring screening module uses a large language model to identify the IP header characteristics of the export flow of the enterprise's export equipment, and performs IP header screening on the export flow of the enterprise's export equipment to obtain the IP header screening results. Based on the destination IP filtering results, the transmission rate filtering results, and the IP packet header filtering results, abnormal traffic with outbound risk is detected through comprehensive analysis.

[0011] In one embodiment of the present invention, the export traffic monitoring screening module uses the whitelist or blacklist in the latest blacklist / whitelist rules to screen the destination IPs of the export traffic of the enterprise's export devices, and obtains the destination IP screening results, including: When using a whitelist, if the destination IP in the outbound traffic of the enterprise's outbound device matches the IP in the whitelist, the destination IP filtering result is to allow the corresponding outbound traffic; otherwise, the corresponding outbound traffic is blocked for subsequent filtering. When using a blacklist, if the destination IP in the outbound traffic of the enterprise's outbound device matches an IP in the whitelist, the destination IP filtering result is to block the corresponding outbound traffic for subsequent filtering; otherwise, the corresponding outbound traffic is allowed.

[0012] In one embodiment of the present invention, during the traffic monitoring and handling phase, the encrypted traffic compliance assessment module, in conjunction with a large language model, performs a compliance assessment on the abnormal traffic to obtain a compliance assessment result, including: The encrypted traffic compliance assessment module performs a consistency judgment on the plaintext data stream and the corresponding ciphertext data stream in the abnormal traffic; The encrypted traffic compliance assessment module inputs the abnormal traffic into the large language model to obtain a traffic quota assessment factor, which represents the proportion of important data or personal information contained in the abnormal traffic. The encrypted traffic compliance assessment module uses a large language model to determine whether the plaintext data stream contains illegal information, and uses ciphertext analysis to determine the protocol type and application type of the ciphertext data stream. The protocol type and application type are then input into the large language model for sensitivity consistency judgment. The compliance assessment results are obtained by combining all judgments; wherein, the compliance assessment results include consistency judgment results, traffic quota assessment factors, violations of inconsistent data sensitivity, and other violations.

[0013] In one embodiment of the present invention, during the traffic monitoring and handling stage, the outbound traffic statistics and supervision handling module, based on the compliance assessment results and relevant information about the enterprise's export equipment, derives a handling strategy corresponding to the violation, including: By multiplying the traffic quota assessment factor and the data packet size of the abnormal traffic, the estimated transmission traffic size of important data or personal information transmitted by the enterprise's export equipment can be obtained; The outbound traffic statistics, supervision and processing module uses the estimated transmission traffic volume, the daily average maximum transmission amount declared by the enterprise's export equipment and the upper limit of the transmission traffic window of the enterprise's export equipment to determine whether there is a violation that exceeds the declaration range; wherein, the initial value of the upper limit of the transmission traffic window of the enterprise's export equipment is determined based on the declaration data. If the scope of the declaration is exceeded, warnings and notifications will be issued as a strategy for handling violations. If a positive response is received from the enterprise's export equipment after the alarm and notification, the outbound traffic statistics and supervision module will temporarily expand the upper limit of the transmission traffic window within a predetermined time period, and detect whether the enterprise's export equipment has once again violated the declaration range for the temporarily expanded upper limit of the transmission traffic window. If so, a violation will be recorded. Based on the preset relationship table that represents the correspondence between violation and handling strategy, the violation level and violation handling strategy corresponding to the current number of violations will be determined.

[0014] In one embodiment of the present invention, the preset relationship table includes the following contents: If the number of violations is less than 3, it is considered a minor violation, and the violation handling strategy is to issue an alarm and notification. The number of violations is [3,5], which is considered a general violation. The violation handling strategy is a traffic restriction strategy. The number of violations is in the range (5, 10), which is considered a serious violation. The violation handling strategy is port blocking. The number of violations falls within the range of (10, 20), which constitutes a serious violation. The appropriate action for handling this violation is IP blocking. If the number of violations exceeds 20, it is considered a particularly serious violation, and the appropriate action is to immediately disconnect the network.

[0015] In one embodiment of the present invention, during the traffic monitoring and handling stage, the outbound traffic statistics and supervision handling module, based on the compliance assessment results and relevant information about the enterprise's export equipment, derives a handling strategy corresponding to the violation, including: If the compliance assessment results received by the outbound traffic statistics and supervision module contain violations with inconsistent data sensitivity, it will be considered a particularly serious violation, and a warning message will be issued while taking corresponding violation handling strategies.

[0016] In one embodiment of the present invention, during the traffic monitoring and handling stage, the outbound traffic statistics and supervision handling module, based on the compliance assessment results and relevant information about the enterprise's export equipment, derives a handling strategy corresponding to the violation, including: If the compliance assessment results received by the outbound traffic statistics and supervision module contain other violations, the corresponding handling strategy for the violations will be given according to the preset relationship table.

[0017] The beneficial effects of this invention are: 1) Capture all enterprise traffic at the enterprise's traffic exit point to enhance the coverage of the enterprise's exit point. Theoretically, the coverage can reach 100%, enabling auditing of all enterprise traffic. 2) The traffic capture function is implemented in hardware and is not coupled with the enterprise's business logic. At the same time, it can avoid the enterprise's interference with traffic capture and prevent the enterprise from bypassing traffic audit through some illegal means, thus protecting data security to the greatest extent. 3) A traffic screening scheme was proposed, which, based on blacklist and whitelist schemes, can improve the accuracy of identification while maximizing the efficiency of enterprise data transmission. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the structure of a monitoring and handling system for abnormal and illegal outbound data flows of enterprises, provided in an embodiment of the present invention. Figure 2 The above is a flowchart illustrating the overall framework of a monitoring and handling system for abnormal and illegal outbound data flows of enterprises, as provided in an embodiment of the present invention. Figure 3 This is a schematic diagram of the processing flow of the export flow monitoring and screening module in a monitoring and handling system for abnormal and illegal outbound data flow of enterprises provided in an embodiment of the present invention. Detailed Implementation

[0019] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0020] In view of the current existing technology, the present invention mainly faces the following technical problems: 1) Insufficient monitoring of compliance in cross-border data flows: Enterprises face significant challenges in actually implementing relevant compliance requirements. Existing monitoring methods lack comprehensive coverage and in-depth analysis of enterprises' outbound data flows, making it difficult to effectively identify abnormal and non-compliant behaviors in cross-border data flows; 2) Lack of a clear and enforceable framework for handling violations: While the current management system has a clear legal framework, it lacks a clear strategy and enforcement framework for handling violations of corporate data export regulations. For example, companies may have abnormal traffic in cross-border data flows, but fail to identify, classify and handle it in a timely manner, especially in terms of limited technical means for compliance analysis of encrypted traffic. 3) Insufficient monitoring technology for abnormal and irregular outbound traffic of enterprises: There is a lack of in-depth research on monitoring technology for traffic transmission behavior in enterprises' outbound data activities, especially in terms of encrypted traffic analysis and abnormal traffic identification, no systematic solution has been formed; To address the above issues, the inventors conducted a comprehensive survey of relevant national laws and regulations. Through research and comparison of security assessment reports, they summarized different violations and their impacts, and formulated handling strategies based on the frequency and consequences of violations. Simultaneously, by combining deep learning, traffic interception, and other technologies with the aforementioned handling strategies, they implemented a complete monitoring and handling system for abnormal violations in enterprise cross-border data traffic. Applied to the important scenario of compliance management for cross-border data transmission, the system is designed for real-time monitoring and anomaly handling of enterprise cross-border data traffic.

[0021] Please see Figure 1 and Figure 2 It is understood that the monitoring and handling system for abnormal and irregular cross-border data flows by enterprises may include: The system includes an export traffic monitoring and initial screening module and an encrypted traffic compliance assessment module located at the data export point of the enterprise's export equipment, as well as an outbound traffic statistics, supervision, and processing module located on the regulator's traffic monitoring server; the enterprise's export equipment corresponds to the client side, and the traffic monitoring server corresponds to the server side; among which: During the traffic registration phase: the traffic monitoring server is used to register and configure the export devices of enterprises that have declared their status, and to generate initial blacklist and whitelist rules based on the declaration data of the export devices of enterprises; During the traffic monitoring and handling phase: The export flow monitoring and screening module is used to perform preliminary screening of the export flow of enterprise export equipment based on the latest blacklist and whitelist rules and in combination with the Large Language Model (LLM) to detect abnormal flow with outbound risk. The encrypted traffic compliance assessment module is used to perform compliance assessment on the abnormal traffic by combining a large language model, and obtain the compliance assessment result. The outbound traffic statistics, supervision and processing module is used to derive the corresponding handling strategy for violations based on the compliance assessment results and relevant information on the enterprise's export equipment; and to update the blacklist and whitelist rules when the rule update conditions are met.

[0022] The system consists of a comprehensive electronic device, which may include multiple data egress devices, traffic monitoring devices (including an egress traffic monitoring screening module and an encrypted traffic compliance assessment module), and a traffic monitoring server. The system operation is divided into a traffic registration phase and a traffic monitoring and processing phase. For ease of understanding of the embodiments of this invention, these two phases will be described separately.

[0023] (I) Traffic Registration Phase: During the traffic registration phase, the traffic monitoring server registers and configures the export devices of enterprises that have already declared their status, generates initial blacklist and whitelist rules based on the declaration data of the enterprise export devices, and stores them locally on the traffic monitoring server for preliminary screening of data traffic.

[0024] The traffic registration phase corresponds to the enterprise declaration process. During this process, the enterprise's export equipment declaration data includes: the type of data transmitted, the maximum daily transmission limit, the frequency of outbound traffic transmission, the transmission interval information, and the enterprise's encrypted traffic verification method. The enterprise's export equipment declaration data is reviewed by the regulatory authorities before traffic transmission is permitted.

[0025] Furthermore, before the traffic monitoring and processing phase begins, the traffic monitoring server is also used to acquire the plaintext data stream and the corresponding encrypted data stream cached by the enterprise's egress device within a preset time period, as the egress traffic to be detected by the enterprise's egress device during the traffic monitoring and processing phase.

[0026] Because determining encrypted traffic is a difficult problem in academia, it is impossible to recover encrypted traffic if the company refuses to provide the key. Therefore, in order to achieve traffic supervision, regulators need to require companies to provide unencrypted data for processing. Thus, it is possible to obtain the plaintext data stream and the corresponding ciphertext data stream cached by the company's outgoing device within a preset time period.

[0027] Because the total outflow of data from a company's daily operations is substantial, processing and analyzing all outflowing data would overload monitoring equipment, reduce data flow and transmission rates, and negatively impact the company's revenue. However, to prevent companies from illegally sending data overseas from IPs or ports other than the declared export IPs, it is necessary to screen all outflow traffic.

[0028] To resolve this contradiction, this invention considers first performing a coarse-grained preliminary screening of the various dimensions of outbound traffic flow, excluding data that is significantly unlikely to be outbound business. Specifically, the enterprise outbound traffic flow preliminary screening module in the traffic monitoring equipment can sequentially perform preliminary screening of data from the following main dimensions.

[0029] For details, please see Figure 3 In the understanding and handling phase of traffic monitoring, the export traffic monitoring and initial screening module, based on the latest blacklist and whitelist rules and combined with a large language model, performs preliminary screening of the export traffic of enterprise export equipment to detect abnormal traffic with outbound risks. This process includes: Step a1: The export flow monitoring screening module uses the whitelist or blacklist in the latest blacklist and whitelist rules to screen the destination IP of the export flow of the enterprise's export equipment and obtain the destination IP screening result. Traffic acquired by monitoring devices at an enterprise's egress gateway carries the enterprise's destination information, particularly IP addresses. All business traffic at the enterprise's egress is initially screened, and the destination IP address of the data packets is used to determine if it is likely outbound traffic. If it exhibits significant characteristics, it is judged as non-outbound traffic and allowed to pass; otherwise, it is considered outbound data or has a certain probability of being outbound data, and the monitoring device will intercept it for further analysis of data characteristics and compliance with outbound behavior. This invention designs two traffic initial screening modes for the monitoring device: a relatively strict whitelist mode and a relatively lenient blacklist mode.

[0030] Specifically, step a1 above may include: When using a whitelist, if the destination IP in the outbound traffic of the enterprise's outbound device matches the IP in the whitelist, the destination IP filtering result is to allow the corresponding outbound traffic; otherwise, the corresponding outbound traffic is blocked for subsequent filtering. Specifically, the whitelist model involves regulatory authorities and enterprises collaborating to establish a whitelist database of IP addresses representing business destinations. This database contains whitelist information on the IP addresses representing the destinations of all of the enterprise's business activities. If the destination IP address detected by the export side is a legitimate domestic IP address of the enterprise (whitelisted IP address), it is directly allowed to pass. Other business traffic, including traffic with destination IP addresses located overseas and traffic with destination IP addresses located domestically but not on the whitelist, is considered data traffic with a probability of leaving the country. The monitoring equipment then imports this data into the next stage for data feature analysis.

[0031] When using a blacklist, if the destination IP in the outbound traffic of the enterprise's outbound device matches an IP in the whitelist, the destination IP filtering result is to block the corresponding outbound traffic for subsequent filtering; otherwise, the corresponding outbound traffic is allowed.

[0032] Specifically, the blacklist mode involves the monitoring equipment only intercepting traffic information (blacklisted IPs) whose destination IP is located outside the country in GEOIP, treating them as outbound data traffic, and then allowing the transmitted content to flow into the next stage for data feature analysis. Step a2: The export flow monitoring screening module calculates the transmission rate by using the transmission time and data size of the export flow of the enterprise's export equipment, and uses the transmission rate to screen the export flow of the enterprise's export equipment to obtain the transmission rate screening result. In addition to the destination IP, the initial screening stage can also easily obtain the sending time and data size of the outbound traffic of the enterprise's outbound devices. Based on this, the transmission rate can be calculated. Based on this characteristic of transmission rate, some data can be further filtered out. For example, if only 10-20 bytes of data are transmitted over a long period of time, it is obviously unlikely to be illegal outbound data. Therefore, the transmission rate screening results can be obtained in this way.

[0033] Step a3: The export flow monitoring screening module uses a large language model to identify the IP header characteristics of the export flow of the enterprise's export equipment, performs IP header screening on the export flow of the enterprise's export equipment, and obtains the IP header screening results. Besides the destination IP, the initial screening stage can also easily obtain the characteristics of the sent data packet header. For example, the IP packet header can be read using a large language model to quickly determine its packet type. Based on these characteristics, some data can be further filtered out. For example, there is a special type of IP packet called ICMP packet, which is used to control IP data transmission and cannot carry illegal data. Abnormal data can be excluded based on these dimensional characteristics to obtain the IP packet header screening results.

[0034] Step a4: Based on the destination IP filtering results, the transmission rate filtering results, and the IP header filtering results, abnormal traffic with outbound risk is detected.

[0035] This invention comprehensively utilizes the destination IP, transmission rate, and IP packet header characteristics to ultimately detect abnormal traffic with outbound risks and initiate the traffic monitoring and handling phase.

[0036] This invention proposes, but is not limited to, using encrypted traffic compliance analysis technology to protect the privacy of sensitive information in outbound enterprise data traffic. During the traffic registration phase, sensitive data (such as user identity information, data classification identifiers, transmission levels, etc.) in the outbound enterprise traffic is encrypted and stored. A blacklist / whitelist mechanism is used for initial screening of the transmitted traffic, preventing attackers from obtaining plaintext information during communication. This mechanism ensures the effectiveness and accuracy of data transmission while protecting the privacy of sensitive information.

[0037] Moreover, compared to existing blacklist and whitelist rules, this invention introduces blacklist and whitelist technology as an initial screening method, which can reduce service overhead and make the process of generating blacklist and whitelist rules more flexible. Unlike previous solutions that used a single dimension such as IP, this invention will flexibly generate blacklist and whitelist rules based on the declared data for dynamic adjustment, and has higher scenario adaptability.

[0038] (II) Flow Monitoring and Handling Phase: During the traffic monitoring and handling phase, the system monitors outbound traffic in real time, captures and analyzes suspected non-compliant traffic (abnormal traffic with outbound risk), and combines the encrypted traffic compliance assessment module to judge data transmission behavior, ultimately generating handling strategies to effectively deal with abnormal behavior.

[0039] In short, if enterprises periodically and proactively provide feedback to the encrypted traffic compliance assessment module regarding the scope, type, and sensitivity of their transmitted traffic data (this information includes the outbound traffic data reported by the enterprise, as well as explanatory information about the outbound traffic data), such as daily outbound data volume and outbound traffic classification and grading, the encrypted traffic compliance assessment module will record and statistically analyze this information. Simultaneously, it will conduct random checks based on the enterprise's self-stored records, requiring them to decrypt and retain outbound data for N days (where N is determined by the regulatory authority based on actual circumstances) and verify whether it corresponds to their actual outbound information and declared content. If the traffic is deemed reasonable, the module will continuously monitor the amount of traffic transmitted and predict the time when the limit is exceeded, issuing alerts and other handling strategies when the outbound traffic declaration limit is about to be exceeded. If the feedback is deemed unreasonable, the enterprise will be required to explain why its feedback differs from the actual output, and corresponding violations will be dealt with according to the actual situation.

[0040] Specifically, during the traffic monitoring and handling phase, the encrypted traffic compliance assessment module, in conjunction with a large language model, performs a compliance assessment on the abnormal traffic to obtain compliance assessment results, including: Step b1, the encrypted traffic compliance assessment module performs a consistency judgment on the plaintext data stream and the corresponding ciphertext data stream in the abnormal traffic; Regulators require companies to retain both plaintext and corresponding encrypted data streams. They can retrieve and verify these streams when needed, as encrypted traffic cannot be fully recovered, making it impossible to determine if it violates regulations. Regulators mandate the retention of these streams and periodically initiate verification procedures, requiring companies to provide plaintext data and verifying their consistency. Inconsistencies result in a violation. The regulators' goal is to determine whether companies are sending reasonable data according to the declared requirements, and to intercept any data sent that does not comply with the declaration regulations.

[0041] Step b2, the encrypted traffic compliance assessment module inputs the abnormal traffic into the large language model to obtain the traffic quota assessment factor, which represents the proportion of important data or personal information contained in the abnormal traffic; This invention uses encryption algorithms combined with common sense to determine the proportion of important or personal data contained in abnormal traffic packets. It then uses a large language model to assign a reasonable initial value, such as 0.8, as a traffic quota assessment factor for subsequent over-issuance / over-quota violations of encrypted outbound traffic. Because data encryption can lead to data expansion, and enterprise data packets are not 100% data-rich, when an enterprise sends 100KB of data, we cannot simply assume that the enterprise sent 100KB of sensitive data. A factor is needed to describe how much sensitive data is in a data packet. Therefore, this invention uses a large language model to determine the proportion of sensitive data in a complete data packet. For example, with a traffic quota assessment factor of 0.8, we consider 80KB of sensitive data to be within 100KB of data.

[0042] Because companies do not cooperate with regulatory authorities, even general data they send may be judged as important data by this invention and used to occupy their declared quota. This way, companies can avoid non-cooperation.

[0043] It should be noted that during the operation of this system, the traffic quota assessment factor is also dynamically adjusted and is determined by the large language model. Step b3, the encrypted traffic compliance assessment module uses a large language model to determine whether the plaintext data stream contains illegal information, and uses ciphertext analysis to determine the protocol type and application type of the ciphertext data stream, and inputs the protocol type and application type into the large language model for sensitivity consistency judgment; The large language model can determine whether the plaintext data stream contains illegal information. This can be achieved by pre-setting illegal information and training the large language model. For details, please refer to the relevant application understanding of the large language model. It will not be elaborated here, nor is the specific type of large language model limited.

[0044] Existing ciphertext analysis techniques can be used to determine the protocol type and application type of the ciphertext data stream, without further explanation.

[0045] In the process of identifying the types and sensitivity of outbound data from enterprises, technologies such as encrypted traffic application type identification can be used to identify the application types and other characteristics of encrypted traffic, and then classify the applications. Some applications, such as social applications, may involve a large amount of personal information, which we consider to be highly sensitive. Specifically, the protocol type and application type can be input into a large language model for sensitivity consistency judgment. If the sensitivity level of the identified protocol type and application type does not match the enterprise's declaration, it indicates inconsistency in sensitivity, and can be directly identified as a violation of inconsistent data sensitivity.

[0046] At the same time, step b3 can also identify whether there are other violations. For example, for violations such as inconsistent data recipients, inconsistent data transmission channels, and inconsistent data transmission times, regardless of whether the data is encrypted, they can be judged by simple analysis of the protocol header. If a certain element is inconsistent with the declared situation, it is regarded as another violation.

[0047] Step b4: Combine all judgments to obtain the compliance assessment result; The compliance assessment results include consistency judgment results, traffic quota assessment factors, violations of inconsistent data sensitivity, and other violations.

[0048] In summary, the compliance assessment of this invention primarily considers whether enterprises have complied with the "filing" process for transmitting encrypted traffic. Regulatory authorities require enterprises to cache the corresponding plaintext and ciphertext data streams for a certain period. The processing client periodically requests plaintext corresponding to specified ciphertexts and checks: 1. Whether the plaintext corresponds to the ciphertext; 2. Whether the plaintext contains illegal information. This invention also applies some existing ciphertext analysis methods for preliminary qualitative analysis, determining its protocol type, application type, etc. A large language model can be used for plaintext evaluation, specifically to determine whether the corresponding plaintext provided by the enterprise contains illegal information. Since the protocol type and application type also indicate the sensitivity of the traffic segment to some extent, they are submitted as input to the large language model for judgment. This embodiment of the invention utilizes a large language model to assist in judgment, which can improve the efficiency and accuracy of the judgment.

[0049] In this embodiment of the invention, the large language model can be any existing large language model, such as GPT-4 in the OpenAI series, and there is no limitation.

[0050] The large language model of the present invention will be described in detail here.

[0051] This invention provides a method for determining the compliance of cross-border data transmission by enterprises based on Large Language Model (LLM) and Retrieval Enhancement Generation (RAG) technology. The solution first involves data collection and preprocessing, obtaining raw data from sources such as network packets, system logs, and API request records, and labeling key metadata (such as timestamps, source IPs, ports, and user identities) for audit tracing. After necessary unpacking, segmentation, cleaning, and anonymization, the data enters the preliminary screening and filtering stage. This stage utilizes a rule engine (such as regular expressions and keyword matching) combined with a pre-defined whitelist (allowed public information) and blacklist (explicitly prohibited high-risk data) to quickly identify content containing known sensitive formats (such as ID card numbers, credit card numbers, and confidential terms), and assigns a suspicion level (low / high) based on the matching strength. Data with no sensitive features is directly marked as safe and allowed, significantly reducing the burden of subsequent complex analysis.

[0052] For data flagged as suspicious or difficult to determine during the screening phase, the RAG retrieval process is initiated. This invention constructs a dedicated enterprise knowledge base containing fragmented textual content such as historical documents, compliance manuals, and business rules. This text is embedded with vectors and stored in a vector database (e.g., FAISS, Milvus) or a search engine (e.g., Elasticsearch). When suspicious data appears, the system constructs a query containing the data fragment and its contextual information, retrieving the most relevant compliance document fragments (Top-N) from the knowledge base in real time. This retrieved authoritative background information is merged, deduplicated, and combined with the original suspicious data to form a structured prompt, which is then input into a deep LLM for analysis. This prompt clearly defines the business context and security requirements, and explicitly instructs the LLM to determine sensitivity based on the retrieved knowledge base information.

[0053] The LLM receives this enhanced Prompt and performs context-aware deep reasoning on suspicious content. The LLM output includes a clear judgment on whether the data contains sensitive information, a classification of the sensitive information type (e.g., personal privacy, trade secrets, financial data), a suggested sensitivity level (e.g., Public, Internal, Confidential, Strictly Confidential), and the confidence level of the judgment. To improve reliability, the LLM's judgment can be logically validated and conditionally combined with the preliminary results from the rule engine to form a final comprehensive judgment.

[0054] The system ultimately outputs sensitivity grading results and confidence levels, and can trigger corresponding security measures based on different levels. For example, it can automatically block or alert on the outward transmission of highly sensitive data, and initiate approval processes for medium-sensitive data. All key information from the processing steps (input ID, result, basis fragment, time, operator, etc.) is recorded in detail to ensure audit compliance traceability. The solution establishes a continuous optimization mechanism, including: collecting human feedback to analyze misjudgment cases; dynamically updating the knowledge base; continuously optimizing the Prompt design to improve the accuracy and controllability of LLM output; and evaluating or fine-tuning the LLM model itself to better align with the evolving business rules and security strategies of the enterprise, forming an intelligent compliance judgment closed loop that includes dynamic knowledge retrieval and semantic understanding.

[0055] In this embodiment of the invention, during the traffic monitoring and handling phase, the outbound traffic statistics and supervision handling module, based on the compliance assessment results and relevant information about the enterprise's export equipment, derives a handling strategy corresponding to the violation, including: Step c1: Multiply the traffic quota assessment factor and the data packet size of the abnormal traffic to obtain the estimated transmission traffic size of important data or personal information transmitted by the enterprise's export equipment; The outbound traffic statistics, supervision and processing module can directly multiply the data packet size of the abnormal traffic and the traffic quota assessment factor obtained by the encrypted traffic compliance assessment module to calculate the value of important data / personal information transmitted by the enterprise. This is called the estimated transmission traffic size, which is used to complete the final identification and handling of violations.

[0056] Step c2, the outbound traffic statistics, supervision and processing module uses the estimated transmission traffic size, the daily average maximum transmission amount declared by the enterprise's export equipment and the upper limit of the transmission traffic window of the enterprise's export equipment to determine whether there is a violation that exceeds the declaration range; The initial value of the upper limit of the transmission flow window for exported equipment by enterprises is determined based on the declared data; The outbound traffic statistics, monitoring, and handling module primarily determines in real time whether abnormal traffic transmission behavior occurs during an enterprise's outbound journey. This module mainly monitors, identifies, and handles violations involving excessive transmission. Initially, during initialization, the upper limit of the transmission traffic window is determined based on information such as the frequency and interval of outbound traffic transmission in the enterprise's declared data. For example, this upper limit can consist of four time window transmission limits: a five-minute window, a one-hour window, a three-hour window, and a twenty-four-hour window (the most common being a one-day window, corresponding to the average daily transmission data volume reported by the enterprise). The size of important / personal information transmitted by the enterprise within the corresponding time window is obtained by multiplying the actual outbound traffic volume by the traffic quota assessment factor (i.e., estimating the transmission traffic volume), and this value cannot exceed the declared size according to regulations. Enterprises can also choose whether to automatically adjust the upper limit during declaration. For upper limit rules that do not automatically adjust, the upper limit window will not be adjusted regardless of the size of the transmitted traffic data. If the enterprise chooses to automatically adjust the upper limit, the system will dynamically adjust the window size for the next cycle based on the actual data volume transmitted within the corresponding window, but the overall expansion or contraction will not exceed 20% of the enterprise's original declared value.

[0057] When a company's estimated transmission volume reaches 90% of the corresponding time window, it indicates that it exceeds the reporting scope. Step c3: If the violation exceeds the reporting scope, an alarm and notification will be issued as a violation handling strategy. If the violation exceeds the declared scope, the monitoring equipment will send alarms and notifications to the company as a violation handling strategy.

[0058] For example, if the amount exceeds the declared limit, the system calculates the company's average sending speed, such as 100G / hour. If the declared amount is 300G, an alarm and notification will be sent when it is close to 3 hours later.

[0059] Step c4: If a positive response is received from the enterprise's export equipment after the alarm and notification, the outbound flow statistics and supervision module temporarily expands the upper limit of the transmission flow window within a predetermined time period, and detects whether the enterprise's export equipment has once again violated the declaration range for the temporarily expanded upper limit of the transmission flow window. If so, a violation is recorded. Based on the preset relationship table that represents the correspondence between violation and handling strategy, the violation level and violation handling strategy corresponding to the current number of violations are determined.

[0060] Following an alert and notification, if the enterprise responds positively, the upper limit of the corresponding time window can be adjusted to 120% of the original value within three hours. If the temporarily expanded time window still does not meet the enterprise's needs, and the enterprise continues to over-send, it will be recorded as a violation, and an alert and notification will be issued according to the preset relationship table shown in Table 1 based on the cumulative number of violations. If the enterprise believes that the declared data cannot meet its actual sending needs after over-sending, the enterprise must re-complete the outbound traffic declaration process. During the declaration process, the enterprise's excess traffic will be cached, and the cached blocked traffic will be released after the enterprise completes the declaration.

[0061] Table 1. Enterprise Data Export Violations and Handling Strategies (Preset Relationship Table)

[0062] This invention uses a time window to intelligently determine whether the data exceeds the declaration scope, which can optimize the efficiency of enterprise data export and reduce unnecessary inspections.

[0063] In this embodiment of the invention, during the traffic monitoring and handling phase, the outbound traffic statistics and supervision handling module, based on the compliance assessment results and relevant information about the enterprise's export equipment, derives a handling strategy corresponding to the violation, including: If the compliance assessment results received by the outbound traffic statistics and supervision module contain violations with inconsistent data sensitivity, it will be considered a particularly serious violation, and a warning message will be issued while taking corresponding violation handling strategies.

[0064] Specifically, inconsistent data sensitivity is fatal. For example, if a company is only allowed to transmit Level 2 data, but it transmits Level 4 data, it could potentially endanger the security of relevant institutions. If the type of data transmitted does not match the declared type—for example, if the data is declared as ordinary data but actually transmitted as important or sensitive data—such behavior will be considered a particularly serious violation as shown in Table 1. The relevant data transmission will be immediately interrupted, and a warning will be issued to the company and relevant departments.

[0065] In this embodiment of the invention, during the traffic monitoring and handling phase, the outbound traffic statistics and supervision handling module, based on the compliance assessment results and relevant information about the enterprise's export equipment, derives a handling strategy corresponding to the violation, including: If the compliance assessment results received by the outbound traffic statistics and supervision module contain other violations, the corresponding handling strategy for the violations will be given according to the preset relationship table.

[0066] Specifically, in cases of inconsistent data recipients, inconsistent data transmission paths, and inconsistent data transmission times, these behaviors are considered as security and compliance risks according to the relevant provisions in Table 1. Depending on the number of violations, measures such as warnings, rate limiting, and disconnection will be taken against the enterprise.

[0067] Additionally, it should be noted that the initial version of the blacklist and whitelist rules is derived from data submitted by enterprises. Subsequent adjustments are dynamically made by the traffic monitoring server based on the enterprise's transmission status (e.g., transmission target, number of legitimate transmissions, etc.) (adjustments may become more lenient or stricter), as the blacklist and whitelist directly impact enterprise data transmission efficiency and the load on the traffic monitoring server. Therefore, in the outbound traffic statistics, supervision, and processing module, when the rule update conditions are detected (i.e., a significant change in the enterprise's transmission status, which can be categorized into certain standards or thresholds), the blacklist and whitelist rules are updated. The next time the traffic monitoring and processing phase occurs, the outbound traffic monitoring initial screening module will use the latest updated blacklist and whitelist rules.

[0068] In summary, this invention can combine recent enterprise traffic characteristics with dynamic traffic time windows to restrict the outflow of sensitive data. It can dynamically adjust based on recent traffic transmission information, avoiding overly rigid traffic restrictions from interfering with normal traffic transmission. It also simplifies the sensitive data reporting process and reduces related management costs. Furthermore, this invention constructs a two-tiered collaborative intelligent compliance analysis system: "rule pre-screening - RAG enhanced decision-making." It filters risk-free traffic at low cost through a rule engine, only initiating dynamic retrieval (RAG) based on a vectorized enterprise knowledge base for suspicious data, injecting real-time compliance context into the Large Language Model (LLM) to achieve domain-customized semantic understanding of cross-border data sensitivity. It uniquely integrates a four-level sensitivity classification mechanism (Public / Internal / Confidential / Strictly Confidential) that combines rules and LLM outputs, automatically linking metadata and retrieval criteria to form an auditable evidence chain. Simultaneously, it establishes a closed-loop optimization system of "human feedback - knowledge base update - prompt optimization - model fine-tuning," significantly reducing computational load while ensuring high-precision judgment and adapting to the continuous evolution of cross-border policies.

[0069] In response to relevant national laws and regulations, this paper summarizes and analyzes various potential risks of violations during data flow, identifies several problems that enterprises may encounter in cross-border data transfer, and, combining existing research methods, independently proposes a complete set of solutions for addressing enterprise data transfer violations. This solution is then implemented into a specific system: a monitoring and handling system for abnormal and illegal outbound data flows from enterprises. This system can be directly deployed at the enterprise's main egress gateway, enabling full auditing of the enterprise's data. Simultaneously, employing a preliminary screening mechanism, it can audit the entire enterprise's traffic while preventing disruption to data transfer efficiency.

[0070] Specifically, the present invention can achieve the following effects: 1) Capture all enterprise traffic at the enterprise's traffic exit point to enhance the coverage of the enterprise's exit point. Theoretically, the coverage can reach 100%, enabling auditing of all enterprise traffic. 2) The traffic capture function is implemented in hardware and is not coupled with the enterprise's business logic. At the same time, it can avoid the enterprise's interference with traffic capture and prevent the enterprise from bypassing traffic audit through some illegal means, thus protecting data security to the greatest extent. 3) A traffic screening scheme was proposed, which, based on blacklist and whitelist schemes, can improve the accuracy of identification while maximizing the efficiency of enterprise data transmission.

[0071] It should be noted that, in the description of this invention, the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," and "counterclockwise," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0072] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0073] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0074] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of protection of the present invention.

Claims

1. A monitoring and handling system for abnormal and irregular outbound data flows of enterprises, characterized in that, include: The system includes an export traffic monitoring and initial screening module and an encrypted traffic compliance assessment module located at the data export point of the enterprise's export equipment, as well as an outbound traffic statistics, supervision, and processing module located on the regulator's traffic monitoring server; the enterprise's export equipment corresponds to the client side, and the traffic monitoring server corresponds to the server side; among which: During the traffic registration phase: the traffic monitoring server is used to register and configure the export devices of enterprises that have declared their status, and to generate initial blacklist and whitelist rules based on the declaration data of the export devices of enterprises; During the traffic monitoring and handling phase: The export flow monitoring and screening module is used to perform preliminary screening of the export flow of enterprise export equipment based on the latest blacklist and whitelist rules and combined with the big language model, and to detect abnormal flow with outbound risk. The encrypted traffic compliance assessment module is used to perform compliance assessment on the abnormal traffic by combining a large language model, and obtain the compliance assessment result. The outbound traffic statistics, supervision and processing module is used to derive the corresponding handling strategy for violations based on the compliance assessment results and relevant information on the enterprise's export equipment; and to update the blacklist and whitelist rules when the rule update conditions are met.

2. The monitoring and handling system for abnormal and irregular outbound data flows of enterprises according to claim 1, characterized in that, The data submitted by enterprises for exporting equipment includes: data type of transmission, maximum daily transmission limit, frequency of outbound traffic transmission, transmission interval information, and enterprise encrypted traffic verification method.

3. The monitoring and handling system for abnormal and irregular outbound data flows of enterprises according to claim 1 or 2, characterized in that, Before the traffic monitoring and processing phase begins, the traffic monitoring server is also used to acquire the plaintext data stream and the corresponding encrypted data stream cached by the enterprise's egress device within a preset time period, as the egress traffic to be detected by the enterprise's egress device during the traffic monitoring and processing phase.

4. The monitoring and handling system for abnormal and illegal outbound data flows of enterprises according to claim 3, characterized in that, In the flow monitoring and handling phase, the export flow monitoring initial screening module, based on the latest blacklist and whitelist rules and combined with a large language model, performs preliminary screening of the export flow of enterprise export equipment, detecting abnormal flow with outbound risk. This process includes: The export flow monitoring screening module uses the latest whitelist or blacklist rules to filter the destination IPs of the export flow of the enterprise's export equipment and obtain the destination IP screening results. The export flow monitoring screening module calculates the transmission rate by using the transmission time and data size of the export flow of the enterprise's export equipment, and uses the transmission rate to screen the export flow of the enterprise's export equipment to obtain the transmission rate screening result. The export flow monitoring screening module uses a large language model to identify the IP header characteristics of the export flow of the enterprise's export equipment, and performs IP header screening on the export flow of the enterprise's export equipment to obtain the IP header screening results. Based on the destination IP filtering results, the transmission rate filtering results, and the IP packet header filtering results, abnormal traffic with outbound risk is detected through comprehensive analysis.

5. The monitoring and handling system for abnormal and irregular outbound data flows of enterprises according to claim 4, characterized in that, The export traffic monitoring screening module uses the latest whitelist or blacklist rules to filter the destination IPs of the export traffic of the enterprise's export devices, and obtains the destination IP filtering results, including: When using a whitelist, if the destination IP in the outbound traffic of the enterprise's outbound device matches the IP in the whitelist, the destination IP filtering result is to allow the corresponding outbound traffic; otherwise, the corresponding outbound traffic is blocked for subsequent filtering. When using a blacklist, if the destination IP in the outbound traffic of the enterprise's outbound device matches an IP in the whitelist, the destination IP filtering result is to block the corresponding outbound traffic for subsequent filtering; otherwise, the corresponding outbound traffic is allowed.

6. The monitoring and handling system for abnormal and illegal outbound data flows of enterprises according to claim 4, characterized in that, During the traffic monitoring and handling phase, the encrypted traffic compliance assessment module, in conjunction with a large language model, performs a compliance assessment on the abnormal traffic to obtain compliance assessment results, including: The encrypted traffic compliance assessment module performs a consistency judgment on the plaintext data stream and the corresponding ciphertext data stream in the abnormal traffic; The encrypted traffic compliance assessment module inputs the abnormal traffic into the large language model to obtain a traffic quota assessment factor, which represents the proportion of important data or personal information contained in the abnormal traffic. The encrypted traffic compliance assessment module uses a large language model to determine whether the plaintext data stream contains illegal information, and uses ciphertext analysis to determine the protocol type and application type of the ciphertext data stream. The protocol type and application type are then input into the large language model for sensitivity consistency judgment. The compliance assessment results are obtained by combining all judgments; wherein, the compliance assessment results include consistency judgment results, traffic quota assessment factors, violations of inconsistent data sensitivity, and other violations.

7. The monitoring and handling system for abnormal and irregular outbound data flows of enterprises according to claim 6, characterized in that, During the traffic monitoring and handling phase, the outbound traffic statistics, supervision, and handling module, based on the compliance assessment results and relevant information about the enterprise's export equipment, derives corresponding handling strategies for violations, including: By multiplying the traffic quota assessment factor and the data packet size of the abnormal traffic, the estimated transmission traffic size of important data or personal information transmitted by the enterprise's export equipment can be obtained; The outbound traffic statistics, supervision and processing module uses the estimated transmission traffic volume, the daily average maximum transmission amount declared by the enterprise's export equipment and the upper limit of the transmission traffic window of the enterprise's export equipment to determine whether there is a violation that exceeds the declaration range; wherein, the initial value of the upper limit of the transmission traffic window of the enterprise's export equipment is determined based on the declaration data. If the scope of the declaration is exceeded, warnings and notifications will be used as a strategy for handling violations. If a positive response is received from the enterprise's export equipment after the alarm and notification, the outbound flow statistics and supervision module will temporarily expand the upper limit of the transmission flow window within a predetermined time period, and detect whether the enterprise's export equipment has once again violated the declaration range for the temporarily expanded upper limit of the transmission flow window. If so, a violation will be recorded. Based on the preset relationship table that represents the correspondence between violation and handling strategy, the violation level and violation handling strategy corresponding to the current number of violations will be determined.

8. The monitoring and handling system for abnormal and irregular outbound data flows of enterprises according to claim 7, characterized in that, The preset relationship table contains the following: If the number of violations is less than 3, it is considered a minor violation, and the violation handling strategy is to issue an alarm and notification. The number of violations is [3,5], which is considered a general violation. The violation handling strategy is a traffic restriction strategy. The number of violations is in the range (5, 10), which is considered a serious violation. The violation handling strategy is port blocking. The number of violations falls within the range of (10, 20), which constitutes a serious violation. The appropriate action for handling this violation is IP blocking. If the number of violations exceeds 20, it is considered a particularly serious violation, and the appropriate action is to immediately disconnect the network.

9. The monitoring and handling system for abnormal and irregular outbound data flows of enterprises according to claim 8, characterized in that, During the traffic monitoring and handling phase, the outbound traffic statistics, supervision, and handling module, based on the compliance assessment results and relevant information about the enterprise's export equipment, derives corresponding handling strategies for violations, including: If the compliance assessment results received by the outbound traffic statistics and supervision module contain violations with inconsistent data sensitivity, it will be considered a particularly serious violation, and a warning message will be issued while taking corresponding violation handling strategies.

10. The monitoring and handling system for abnormal and irregular outbound data flows of enterprises according to claim 8, characterized in that, During the traffic monitoring and handling phase, the outbound traffic statistics, supervision, and handling module, based on the compliance assessment results and relevant information about the enterprise's export equipment, derives corresponding handling strategies for violations, including: If the compliance assessment results received by the outbound traffic statistics and supervision module contain other violations, the corresponding handling strategy for the violations will be given according to the preset relationship table.

Images