TWI434173B - Monitor method, monitor apparatus and computer program product thereof for monitoring a data of a hardware - Google Patents

Description

Monitoring method, monitoring device and computer program product for monitoring data of one piece of hardware

The present invention relates to a monitoring method, a monitoring device and a computer program product thereof for monitoring data of a piece of hardware; more particularly, the present invention relates to avoiding improper transmission of data having private information. Monitoring methods, monitoring devices and their computer program products.

With the development of the information industry, computers and networks have become indispensable in daily life. For example, the use of computers to process a variety of materials or to search for information, shopping and data exchange on the Internet is a lifestyle that many people have become accustomed to. Furthermore, online credit card checkouts, online shopping orders, and web ATMs are frequently used Internet services.

In the case of applying the aforementioned network services, the user usually needs to transmit the data entrained with the related private information to the network service provider through the network, and the private information includes account/password information, identity card number or online. Transaction records, etc. In general, these data entraining private information about the user are transmitted through the browser interface. As a result, many hackers facilitate the use of browser interface vulnerabilities to steal data transmitted by these users to Internet service providers, leading to the emergence of today's private information being leaked.

For example, when a user uses a browser to enter an account/password on a webpage of a network service provider (such as Yahoo) and logs in to the member page, the user's computer is stored and stored using a storage path and a file name. The user has entered the account/password related to Yahoo. When the user wants to use the browser to log in to Yahoo's webpage again, the computer can access the account/password associated with Yahoo via the above storage path and data name. Information to log in directly to the member page. In this process, the hacker can use the browser vulnerability to execute malicious programs through the encoded scripting language (such as Javascript or VBscript), and send the data related to Yahoo's account/password to the browser through the browser. The network address specified by the customer first.

In response to this problem, the prior art provides a software for detecting malicious programs by analyzing different malicious programs and establishing a database of different kinds of malicious program features to further detect and detect these malicious program features. Prevents hackers from using malicious programs and transmitting information about the private information associated with the user to their pre-designated network address through the browser.

However, based on the nature of the scripting language, it is quite difficult to detect malware executed by the scripting language and it is impossible to create a database with common malware features. In other words, as long as the scripting language used to execute the malicious program is processed by other encoding methods, the software for detecting malicious programs cannot be detected and analyzed.

In view of this, in the case of the maturity of Internet services and the increasing proliferation of malicious programs, how to avoid the improper transmission of private information by malicious programs is an urgent problem for the industry.

It is an object of the present invention to provide a monitoring apparatus for monitoring data of a piece of hardware. The data has a private message, an identification message, and at least a first network transmission address. The monitoring device includes a storage unit and a processing unit. The storage unit is configured to store a tag information table and store the data according to the identification information. The processing unit is configured to record the identification information of the data and the at least one first network transmission address in the marking information table; accessing the data according to the identification information in response to an access system call; and simultaneously responding to the transmission system Call Arrange A transmission of one of the private information of the material. The access system call is related to the identification information, and the transmission system call has a second network transmission address. Finally, the processing unit determines, according to the identification information of the data recorded by the tag information table and the at least one first network transmission address, whether the at least one first network transmission address and the second network transmission address are Similarly, when the at least one first network transmission address and the second network transmission address are different, the processing unit outputs a signal.

Another object of the present invention is to provide a monitoring method for monitoring data of a piece of hardware. The data has a private information, an identification information, and at least a first network transmission address, and the data is stored in a storage unit according to the identification information. The monitoring method includes the following steps: causing a processing unit to record the identification information of the data and the at least one first network transmission address in a tag information table, wherein the tag information table is stored in the storage unit; Taking a system call, causing the processing unit to access the data according to the identification information, wherein the access system call is related to the identification information; in response to a transmission system call, the processing unit arranges one of the private information of the data transmission The transmission system call has a second network transmission address; the processing unit determines the at least one first according to the identification information of the data recorded by the mark information table and the at least one first network transmission address And determining whether the network transmission address and the second network transmission address are the same; and when the at least one first network transmission address and the second network transmission address are different, causing the processing unit to output a signal.

In addition, for the purpose of the foregoing paragraph, the present invention further provides a computer program product, which stores a program for monitoring a data monitoring method of a piece of hardware, and the program can be loaded into a monitoring device via a computer and executed. The monitoring method described in the previous paragraph can be completed.

In summary, the monitoring method, the monitoring device and the computer program product for monitoring data of one piece of hardware disclosed in the present invention can identify the information of the information having the private information and the network transmission bit to be transmitted. The address is stored in the tag information table. At the same time, according to the system call and the identification information stored in the marked information table, the present invention performs the network transmission URL stored in the marked information table and the network transmission scheduled to be transmitted when the information with the private information is scheduled to be transmitted. URL comparisons to avoid improper transmission of private information by malicious programs.

Other objects, advantages, and technical means and embodiments of the present invention will become apparent to those skilled in the <RTIgt;

The content of the present invention will be explained by way of embodiments. The present invention relates to a monitoring method for monitoring data of a piece of hardware, and a computer program product of the monitoring device, which has the advantages of preventing the data entrained with private information from being transmitted to The network transmission address specified by the malware. It should be noted that in the following embodiments and drawings, elements that are not directly related to the present invention have been omitted and are not shown; and the dimensional relationship between the elements in the drawings is only for easy understanding, and is not intended to limit the actual ratio. .

As shown in FIG. 1A, the first embodiment of the present invention is a monitoring device 11 for monitoring data of a hardware 1. The hardware 1 has a memory 13 and a display unit 15. The user can control the components of the hardware 1 by an operating system (not shown). The operating system may be various operating systems available on the market, such as a Microsoft Windows operating system, an Apple Macintosh operating system, a Linux operating system, or a Unix operating system. In the first embodiment, the operating system is Microsoft Windows operating system. The hardware 1 can be a personal computer (PC) or a Macintosh computer (Macintosh; MAC) sold by Apple Computer. In the first embodiment, the hardware 1 is a personal computer (Personal Computer). ;PC). It should be noted that the present invention does not limit the types of the operating system and the hardware 1. Those skilled in the art can also use other types of operating systems, hardware, and combinations thereof to complete the present invention, and thus will not be described herein. .

The monitoring device 11 comprises a storage unit 111 and a processing unit 113. The monitoring device 11 is electrically connected to the memory 13 and the display unit 15. The storage unit 111 is configured to store a tag information table 10. When the user prepares to transmit the private information 2 to the first network transmission address 20 through the browser (not shown) and the hardware 1, the processing unit 113 will use a storage path and a data name. The data 2 is stored in the storage unit 111 and/or the memory 13. The storage path and the data name are the identification information 22 of the data 2. At the same time, the processing unit 113 stores the identification information 22 of the data 2 and the first network transmission address 20 in the tag information table 10.

For example, when the user browses through the browser and the hardware 1, it is ready to transmit the private information of the account/password 2 to the first network transmission address 20 of the server of the network service provider (such as Yahoo) ( For example, 209.191.93.53), the processing unit 113 will be based on the storage path (such as C:\Documents and Settings\user\Local Settings\Cookies\cookie:user@yahoo.com) and the name of the data (eg cookie: user@yahoo.com) The data 2 is stored in the storage unit 111 and/or the memory 13. At the same time, the processing unit 113 will store the path "C:\Documents and Settings\user\Local Settings\Cookies\cookie:user@yahoo.com", the data name "cookie:user@yahoo.com", and the first network transmission bit. The address "209.191.93.53" is stored in the tag information table 10.

It should be noted that the present invention does not limit the number of first network transmission addresses 20 stored in the tag information table 10, that is, the user can simultaneously access the data 2 having the same identification information 22 through the browser and the hardware 1. The first network transmission address 20 is transmitted to a plurality of first network transmission addresses 20, and those skilled in the art can further store the other first network transmission address 20 according to the foregoing description, and therefore no further details are provided herein.

At the same time, private information is user-friendly information such as account and password information, computer record (cookie) information, and browser auto complete data. The present invention does not limit the type of private information. Those skilled in the art can also set the type and quantity of private information by themselves, and therefore will not be described herein.

When processing unit 113 accesses data 2 in accordance with identification information 22 in response to an access system call 12, processing unit 113 will perform a series of procedures. It should be noted that the access system call 12 is related to the identification information 22. For example, the access system call 12 can be a data open system call, a data read system call, a data copy system call, a data move system call, a data off system call, or a clear memory system call.

In this embodiment, the processing unit 113 opens the system call according to the data, and opens the data 2 according to the identification information 22. The data opening system call has a delivery parameter, and the delivery parameter corresponds to the identification information 22. In detail, the processing unit 113 will judge the opening of the data 2 according to the following code: Among them, "OpenFile" represents the above data to open the system call; "cookie: user@yahoo.com" represents the data name of the data 2; "HANDLE" is the delivery parameter corresponding to the identification information 22, in other words, if other system calls There is a transfer parameter "HANDLE", which is related to the identification information 22, indicating that these system calls are all accessing the data 2. When the processing unit 113 judges that the material 2 is turned on based on the identification information 22 of the mark information table 10, it starts monitoring and recording all related system calls.

Then, the processing unit 113 stores the private information of the data 2 to a first memory address 131 in response to a data reading system call, wherein the data reading system call has the foregoing delivery parameter, and the delivery parameter corresponds to the first memory. Body address 131. Further, the processing unit 113 will judge the reading of the data 2 according to the following code: Among them, "ReadFileEx" represents a data reading system call. Since the transfer parameter "HANDLE" is associated with the identification information 22, the processing unit 113 will thereby determine the reading of the material 2. Further, the parameter "lpBuffer" represents that the material 2 is stored to the first memory address 131 of the memory 13 (e.g., 0x04e463b9). At the same time, the processing unit 131 records the memory address (ie, the first memory address 131) of the private information storing the data 2 in the storage unit 111.

In this embodiment, the processing unit 113 further copies and/or moves the private information of the data 2 from the first memory address 131 of the memory 13 to a second in response to the data replication system call and/or the data mobile system call. Memory address 133. At the same time, after the private information of the data 2 is copied and/or moved, the processing unit 113 records the memory address of the private information storing the data 2 (ie, the first memory address 131 and/or the second memory address 133) and/or Or updated in the storage unit 111. The description of the data replication system call and the data movement system call will be described below.

Specifically, the processing unit 113 determines that the private information of the data 2 is copied from the first memory address 131 to the second memory address 133 according to the following code: The "memcpy" represents the data replication system call; the parameter "*dest" represents the second memory address 133 (eg, 0x00123456); the parameter "*src" represents the first memory address 131 (ie, 0x04e463b9). On the other hand, the processing unit 113 will determine that the private information of the data 2 is moved from the first memory address 131 to the second memory address 133 according to the following code: mov eax[ebx]; "mov" represents the data mobile system call; The parameter "eax" represents the second memory address 133 (for example: 0x00123456); the parameter "ebx" represents the first memory address 131 (ie, 0x04e463b9).

It should be specially noted that if the processing unit 113 closes or clears the data 2 according to the data off system call or the clear memory system call, the processing unit 113 will continue to monitor whether there are other private information according to the mark information table 10 continuously. The data is accessed. In another embodiment, the processing unit 113 determines that the data 2 is turned off or cleared according to the following code:

Among them, "FileClose" and "free" represent data off system calls and clear memory system calls, respectively. Passing the parameter "HANDLE" and identifying information 22 is related, so the processing unit 113 will thereby determine the closure of the material 2. In addition, the parameter "*ptr" represents the memory address of the data to be closed; the parameter "eax" represents the memory address of the data to be cleared. The processing unit 113 compares whether the value of the parameter "*ptr" or the parameter "eax" is equal to the memory address currently stored in the private information of the data 2 (ie, the second memory address 133); if so, the data 2 is turned off or Clear.

It can be seen from the above description that, unlike the conventional method for simply comparing the database to detect malicious behavior, the monitoring device 11 of the present invention will determine whether there is an access system call to the private data 2 according to the transmission parameters of each system call. The information is accessed, and the memory address of the private information storing the data 2 is recorded and/or updated according to the memory address corresponding to the parameter, thereby completing the subsequent monitoring.

Processing unit 113 will then schedule transmission of one of the data 2 in response to a transmission system call 14. Specifically, the transmission system call 14 has a transmission data memory address and a second network transmission address (not shown). In this embodiment, the second network transmission address is a network transmission address set by the malicious program (such as 129.342.33.22). Specifically, the processing unit 113 will schedule the transmission of the data 2 to the second network transmission address according to the following code: "connect" represents a system call that establishes a remote connection; "send" represents a system call that transmits data 2 through an established connection; the parameter "*name" represents a second network transmission address (ie, 129.342.33.22); The parameter "*buf" represents the transfer data memory address. The processing unit 113 will retrieve the transmission data memory address of the transmission system call 14 (ie, the value of the parameter "*buf"), and determine the memory address of the private data of the data memory address and the stored data 2 (ie, the first memory) Whether the body address 131 and/or the second memory address 133) are the same.

When the processing unit 113 determines that the transmission data memory address (ie, the value of the parameter "*buf") is the same as the first memory address 131 (ie, 0x04e463b9) and/or the second memory address 133 (ie, 0x00123456), the data is indicated. 2 will be transmitted to the second network transmission address. Next, the processing unit 113 determines whether the second network transmission address and the first network transmission address 20 are the same according to the identification information 22 of the data 2 recorded by the mark information table 10 and the first network transmission address 20. In this embodiment, since the second network transmission address (ie, 129.342.33.22) is different from the first network transmission address 20 (ie, 209.191.93.53), this means that the data 2 will be transmitted to the malicious program. Network transmission address. At this time, the processing unit 113 outputs a signal 100 to the display unit 15.

The display unit 15 will display a warning message according to the signal 100, and at the same time, the processing unit 113 will stop the transmission of the data 2 according to the signal 100. Conversely, if the second network transmits The address is the same as the first network transmission address 20, and the processing unit 113 transmits the data 2 to the second network transmission address.

In other implementations, if the processing unit 113 determines that the transmission data memory address (ie, the value of the parameter "*buf") is different from the first memory address 131 and/or the second memory address 133, it indicates that the current desire is The transmitted data is not private information, and the processing unit 113 will transmit the data while the processing unit 113 of the monitoring device 11 will not perform the step of comparing the network transmission addresses.

Next, the processing unit 113 will continue to monitor whether the system call continues to transmit data 2, while continuously monitoring whether other materials with private information are accessed based on the tag information table 10.

A second embodiment of the present invention, as shown in FIG. 2, is a monitoring method for monitoring data of a piece of hardware. The monitoring method of the present invention can be applied to a monitoring device such as the monitoring device 11 described in the first embodiment. The monitoring device comprises a storage unit and a processing unit. The data has a private information, an identification information, and at least a first network transmission address, and the data is stored in the storage unit according to the identification information. Private information can be one of an account/password information, a computer record information, and a browser auto-complete information.

Specifically, the monitoring method described in the second embodiment can be executed by a computer program product. When the monitoring device loads the computer program product from a computer and executes a plurality of instructions included in the computer program product, the The monitoring method described in the second embodiment. The aforementioned computer program product can be stored in a computer readable recording medium, such as read only memory (ROM), flash memory, floppy disk, hard disk, optical disk, flash drive, tape, network available Access to the database or familiar with this item Any other storage medium known to the skilled artisan and having the same function.

The monitoring method of the second embodiment includes the following steps. First, in step 201, the processing unit records the identification information of the data and the at least one first network transmission address in a tag information table, where the tag information table is stored in the storage unit. The identification information includes a storage path and a data name, and the data is stored in the storage unit according to the storage path and the data name.

In step 202, in response to an access system call, the processing unit accesses the data based on the identification information, wherein the access system call is related to the identification information.

For example, in step 202, the processing unit will open a system call according to a data, and open the data according to the identification information, wherein the data opening system call has a delivery parameter, and the delivery parameter corresponds to the identification information; then the processing unit will respond accordingly A data reading system call stores the private information of the data to a first memory address, wherein the data reading system call also has the foregoing delivery parameter, and the delivery parameter corresponds to the first memory address.

In an implementation aspect, the processing unit copies the private information of the data from the first memory address to a second memory address in response to a data replication system call; or in another embodiment, the processing unit responds to The data mobile system calls to move the private information of the data from the first memory address to the second memory address. Finally, in step 202, the processing unit records the memory address (ie, the first memory address and/or the second memory address) of the private information of the stored data in the storage unit, and the implementation details of step 202 are The description is made in the first embodiment, and therefore will not be described herein.

In step 203, the processing unit transmits a response to one of the transmission system call schedules, wherein the transmission system call has a transport data memory address and a second network transport address. Next, in step 204, the processing unit retrieves the transmission data memory address of the transmission system call, and determines a memory address (ie, the first memory address and/or the second memory) that transfers the memory address and the private information of the stored data. Whether the body address) is the same. If yes, proceed to step 205, the processing unit determines, according to the identification information of the data recorded in the tag information table, and the at least one first network transmission address, whether the at least one first network transmission address and the second network transmission address are the same.

If the processing unit determines in step 205 that the at least one first network transmission address and the second network transmission address are the same, step 206 is executed to transmit the information of the data to the second network transmission address, and return to step 202. Waiting for other access system calls to access other data. If the processing unit determines in step 205 that the at least one first network transmission address and the second network transmission address are different, step 207 is executed to enable the processing unit to output a signal. Next, in step 208, a display unit displays a warning message according to the foregoing signal. Finally, in step 209, the processing unit stops the transmission of the private information of the data according to the signal, and returns to step 202 to wait for other access system calls to access other materials.

If the processing unit determines in step 204 that the transmission memory address is different from the first memory address and/or the second memory address, the information indicating that the data to be transmitted is not private information, and then step 206 is performed to transmit the information of the data to The second network transmits the address and returns to step 202 to wait for other access system calls to access other data.

In addition to the above steps, the monitoring method of the present invention can also perform all the operations and functions described in the first embodiment, and those skilled in the art can directly understand how the monitoring method of the present invention is based on the above-described first embodiment to perform such operations. Operation and function, so I won't go into details here.

In summary, the monitoring method, monitoring device and computer program product of the present invention will first be in the tag information table, and record the identification information of the data with private information and the network transmission address to be transmitted. Subsequently, the monitoring of the data with the private information is performed according to the system call, and if the transmission system call is ready to transmit the data with the private information to the network transmission address not recorded by the marked information table, the transmission of the data with the private information is stopped. Accordingly, the present invention will prevent improper transmission of private information by malicious programs.

The embodiments described above are only intended to illustrate the embodiments of the present invention, and to explain the technical features of the present invention, and are not intended to limit the scope of protection of the present invention. Any changes or equivalents that can be easily made by those skilled in the art are within the scope of the invention. The scope of the invention should be determined by the scope of the claims.

1. . . Hardware

2. . . data

10. . . Marking information sheet

11. . . Monitoring device

12. . . Access system call

13. . . Memory

14. . . Transmission system call

15. . . Display unit

100. . . Signal

111. . . Storage unit

113. . . Processing unit

131. . . First memory address

133. . . Second memory address

20. . . First network transmission address

twenty two. . . Identification information

1A is a schematic view of a monitoring device according to a first embodiment of the present invention;

1B is a schematic diagram of a tag information table according to a first embodiment of the present invention;

Figure 2 is a flow chart of the monitoring method of the second embodiment of the present invention.

1. . . Hardware

2. . . data

10. . . Marking information sheet

11. . . Monitoring device

12. . . Access system call

13. . . Memory

14. . . Transmission system call

15. . . Display unit

100. . . Signal

111. . . Storage unit

113. . . Processing unit

131. . . First memory address

133. . . Second memory address

20. . . First network transmission address

twenty two. . . Identification information

Claims (30)

A monitoring method for monitoring data of a piece of hardware, the data having a private information, an identification information, and at least a first network transmission address, and the data is stored in a storage according to the identification information The monitoring method includes the following steps: causing a processing unit to record the identification information of the data and the at least one first network transmission address in a tag information table, wherein the tag information table is stored in the storage unit; Receiving a system call, causing the processing unit to access the data according to the identification information, wherein the access system call is related to the identification information; and the processing unit arranges the data according to a transmission system call One of the private information transmissions, wherein the transmission system call has a second network transmission address; the identification information of the data recorded according to the mark information table and the at least one first network transmission address, so that the processing unit determines Whether the at least one first network transmission address and the second network transmission address are the same; and when the at least one first network transmission address and The second address is not the same transmission network, enabling the processing unit outputs a signal. The monitoring method of claim 1, wherein the identification information includes a storage path and a data name, and the data is stored in the storage unit according to the storage path and the name of the data. The monitoring method of claim 1, wherein the step of accessing the data comprises the steps of: initiating a system call according to one of the parameters of the delivery parameter, causing the processing unit to enable the data according to the identification information; wherein the parameter is Corresponds to the identification information. The monitoring method of claim 3, wherein the step of accessing the data further comprises the step of: storing the system information by one of the delivery parameters, and causing the processing unit to store the private information of the data to a first a memory address; wherein the transfer parameter corresponds to the first memory address. The monitoring method of claim 4, wherein the transmission system call has a transmission data memory address, and the step of transmitting one of the private information of the data further comprises the step of: causing the processing unit to retrieve the transmission system call Transmitting a data memory address; and causing the processing unit to determine whether the transmission data memory address is the same as the first memory address; wherein, when the transmission data memory address is the same as the first memory address, the processing unit The transmission of private information of the information is arranged. The monitoring method of claim 4, wherein the step of accessing the data further comprises the step of: copying the system call by the data processing unit, causing the processing unit to copy the private information of the data from the first memory address to the first Two memory addresses. The monitoring method of claim 4, wherein the step of accessing the data further comprises the step of: causing the processing unit to move the private information of the data from the first memory address to the first Two memory addresses. The monitoring method of claim 1, wherein the hardware has a display unit, and the monitoring method further comprises the step of: causing the display unit to display a warning message according to the signal. The monitoring method of claim 1, further comprising the step of: causing the processing unit to stop transmission of the private information of the data according to the signal. The monitoring method of claim 1, wherein the private information is one of an account/password information, a computer record (cookie) information, and a browser auto complete data information. . A monitoring device for monitoring data of a piece of hardware, the data having a private information, an identification information, and at least a first network transmission address, the monitoring device comprising: a storage unit for storing a tag information And storing, according to the identification information, the data: and a processing unit, configured to record the identification information of the data and the at least one first network transmission address in the tag information table, according to the access to the system call, according to the identification Information accessing the data, and transmitting one of the private information of the data in response to a transmission system call, wherein the access system call is related to the identification information, and the transmission system call has a second network transmission address; The processing unit further determines, according to the identification information of the data recorded by the tag information table and the at least one first network transmission address, whether the at least one first network transmission address and the second network transmission address are Similarly, when the at least one first network transmission address and the second network transmission address are different, the processing unit outputs a signal. The monitoring device of claim 11, wherein the identification information comprises a storage path and a data name, and the processing unit stores the data in the storage unit according to the storage path and the data name. The monitoring device of claim 11, wherein the access system call comprises a data opening system call having a delivery parameter corresponding to the identification information, the processing unit initiating a system call according to the data, according to the Identification information opens the material. The monitoring device of claim 13, wherein the access system call further comprises a data reading system call having one of the delivery parameters, the delivery parameter corresponding to a first memory address, the processing unit reading the data The system call is taken to store the private information of the data to the first memory address. The monitoring device of claim 14, wherein the transmission system call has a transmission data memory address, the processing unit retrieves a transmission data memory address of the transmission system call, and determines the transmission data memory address and the first Whether the memory address is the same, when the transmission data memory address is the same as the first memory address, the processing unit arranges the transmission of the private information of the data. The monitoring device of claim 14, wherein the access system call further comprises a data replication system call, and the processing unit copies the private information of the data from the first memory address to the first The second memory address. The monitoring device of claim 14, wherein the access system call further comprises a data mobile system call, and the processing unit moves the private information of the data from the first memory address to the first The second memory address. The monitoring device of claim 11, wherein the hardware has a display unit, wherein the display unit is configured to display a warning message according to the signal. The monitoring device of claim 11, wherein the processing unit further stops transmission of the private information of the data according to the signal. The monitoring device of claim 11, wherein the private information is one of an account/password information, a computer record information, and a browser auto-complete data information. A computer program product storing a program for monitoring a data of a hardware, the data having a private information, an identification information, and at least a first network transmission address, and the data is identified according to the identification The information is stored in a storage unit, and the program is loaded into a monitoring device via a computer: the program command A causes a processing unit to record the identification information of the data and the at least one first network transmission address in a mark a information table, wherein the tag information table is stored in the storage unit; the program command B, in response to an access system call, causes the processing unit to access the data according to the identification information, wherein the access system call system is related to The program instruction C, in response to a transmission system call, causes the processing unit to arrange one of the private information of the data transmission, wherein the transmission system call has a second network transmission address; the program instruction D, according to the Identifying the identification information of the data recorded by the information table and the at least one first network transmission address, so that the processing unit determines the at least one first network Whether the transmission address and the second network transmission address are the same; and the program instruction E, when the at least one first network transmission address and the second network transmission address are different, causing the processing unit to output a signal . The computer program product of claim 21, wherein the identification information includes a storage path and a data name, and the data is stored in the storage unit according to the storage path and the data name. The computer program product of claim 21, wherein the program instruction B further comprises: a program instruction B1, wherein the processing unit activates the system call according to one of the parameters of the delivery parameter, so that the processing unit starts the data according to the identification information; wherein the transmission The parameter corresponds to the identification information. The computer program product of claim 23, wherein the program instruction B further comprises: a program instruction B2, wherein the processing unit stores the private information of the data to a first one according to the data reading system call having one of the delivery parameters. a memory address; wherein the transfer parameter corresponds to the first memory address. The computer program product of claim 24, wherein the transmission system call has a transmission data memory address, and the program instruction C further comprises: a program instruction C1, wherein the processing unit retrieves the transmission data memory address of the transmission system call. And the program instruction C2, the processing unit determines whether the transmission data memory address is the same as the first memory address; wherein, when the transmission data memory address is the same as the first memory address, the processing unit arranges The transmission of private information of this material. The computer program product of claim 24, wherein the program instruction B further comprises: a program instruction B3, in response to a data replication system call, causing the processing unit to copy the private information of the data from the first memory address to the first Two memory addresses. The computer program product of claim 24, wherein the program instruction B further comprises: a program instruction B4, wherein the processing unit moves the private information of the data from the first memory address to the first Two memory addresses. The computer program product of claim 21, wherein the hardware has a display unit, and the program further executes: a program command F, according to the signal, causing the display unit to display a warning message. The computer program product of claim 21, wherein the program further executes: a program command G, according to which the processing unit stops the transmission of the private information of the data. The computer program product of claim 21, wherein the private information is one of an account/password information, a computer record information, and a browser auto-complete information.