Hospital internal network security isolation method based on all-optical network architecture

Abstract

The invention discloses a hospital internal network security isolation method based on an all-optical network architecture. The method comprises the following steps: S1, dividing a hospital internal network into a plurality of virtual optical slices by using an all-optical network slicing technology; s2, performing time domain isolation by using an optical time domain multiplexing technology, and transmitting data on different optical wavelengths by using a wavelength selective switching technology; s3, monitoring and managing bandwidth allocation through a software defined network control platform; s4, traffic prediction and resource optimization are carried out based on a decision tree integration algorithm; s5, detecting potential anomalies and security threats by using the graph neural network; s6, abnormal behaviors are detected through an isolation forest algorithm, and abnormal traffic is marked and isolated; s7, recording a network traffic log through a block chain technology; and S8, when a network fault occurs, using an intelligent self-healing mechanism to automatically switch redundant optical path resources and recover the optical path. According to the invention, all-optical network slicing and artificial intelligence technologies are fully utilized, and security isolation and resource optimization of a hospital internal network are realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a hospital internal network security isolation method based on an all-optical network architecture. Background Art

[0002] With the rapid development of information technology, especially in the healthcare industry, network security and stability have become an increasingly important issue. As a public service unit, the internal network of a hospital carries a large amount of medical data and business information. These data not only involve patients' personal privacy and medical records, but also important information such as hospital operation data and equipment monitoring data. Therefore, the security of the hospital network is directly related to the quality of medical services, the privacy protection of patients, and the daily operation of the hospital.

[0003] The existing hospital network architecture generally adopts a network structure based on traditional Ethernet and IP technology. Although this architecture meets the basic needs of hospital networks to a certain extent, with the continuous development of medical informatization, especially the digitization and intelligence of medical equipment, the traditional network architecture has gradually exposed many shortcomings. For example, the bandwidth demand of the hospital's internal network has increased dramatically, especially with the increase in the transmission demand for high-definition images and real-time monitoring data, the existing network architecture faces problems such as insufficient bandwidth and traffic congestion. In addition, the data transmission requirements between multiple departments and departments within the hospital vary greatly. The traditional network management method fails to fully consider the traffic isolation and resource allocation between different business areas and departments, resulting in the network bandwidth of some departments cannot be guaranteed in a timely manner, affecting the transmission and use of medical data.

[0004] In addition, with the continuous evolution of network attack methods, the security issues of hospital internal networks have become increasingly prominent. Traditional network security protection methods based on firewalls, intrusion detection systems, etc. mainly focus on peripheral defense and traffic detection, and it is difficult to effectively identify abnormal behaviors and potential security threats in the internal network. In the internal network of the hospital, especially when data flows between multiple departments and divisions, threats such as malware, viruses, and network attacks may spread through the internal network, and traditional security protection systems often cannot respond quickly, resulting in security vulnerabilities that cannot be discovered and isolated in time. Existing technologies have failed to effectively monitor network traffic in a virtualized environment in real time, predict traffic, optimize resources, and isolate abnormal traffic. There are defects in the lack of strong protection capabilities for the internal network of the hospital and the inability to respond to emergencies in real time.

[0005] In order to deal with the above problems, some emerging technologies have been applied to hospital networks in recent years. For example, software-defined network (SDN) technology can dynamically adjust network resources and monitor and manage network traffic in real time. However, the existing SDN control platform still has certain limitations in traffic management and bandwidth allocation, especially when facing a large number of dynamic traffic demands, it is impossible to achieve accurate resource allocation and dynamic optimization. In addition, traditional network slicing technology is mainly used in the network architecture of telecom operators, and its application in hospital internal networks has not yet been popularized. As an emerging network architecture, all-optical network slicing technology can provide flexible and efficient resource management methods for hospital internal networks through virtualization and dynamic bandwidth allocation. However, this advanced optical network technology has not yet been widely adopted in hospital networks, resulting in significant deficiencies in resource utilization efficiency and bandwidth management in existing technologies.

[0006] In terms of hospital network security isolation, although some progress has been made based on intrusion detection, traffic analysis and other technologies, the detection technology for traffic anomalies and security threats in virtual optical slices is still relatively weak. Existing technologies mostly rely on traditional traffic monitoring and manual intervention, and lack automated and intelligent anomaly detection and isolation mechanisms. Traffic anomaly detection mostly relies on the setting of specific rules, and cannot flexibly adjust the detection strategy according to different network environments and traffic patterns, resulting in poor recognition of abnormal behaviors, especially in high-traffic and complex network environments, making it difficult to identify potential security threats in a timely and accurate manner.

[0007] On the other hand, although artificial intelligence technologies such as decision tree ensemble algorithms, graph neural networks, and isolation forest algorithms have achieved certain applications in traffic prediction and anomaly detection, they are mostly applied to a single algorithm or model, lacking multi-level and multi-angle comprehensive analysis and optimization. For example, graph neural networks can effectively model spatiotemporal relationships when processing complex network traffic, but their computational complexity is high, and in actual applications, they need to be carefully tuned according to the specific network environment, resulting in their application in hospital networks still facing challenges.

[0008] The existing technology still lacks an efficient and comprehensive hospital internal network security isolation method that can take advantage of the all-optical network architecture to dynamically allocate bandwidth and isolate traffic, and combine advanced artificial intelligence algorithms, blockchain technology, and intelligent self-healing mechanisms to achieve real-time monitoring of network traffic, traffic prediction, anomaly detection and isolation. Most of the network isolation in the existing technology relies on traditional security protection equipment and manual configuration, lacking intelligent and adaptive processing mechanisms. When faced with complex network requirements and high concurrent traffic within the hospital, the existing methods cannot provide sufficient flexibility and scalability, resulting in uneven distribution of network resources and security vulnerabilities, affecting the stability and security of the hospital network.

[0009] Therefore, how to provide a hospital internal network security isolation method based on an all-optical network architecture is an urgent problem that technical personnel in this field need to solve. Summary of the invention

[0010] One purpose of the present invention is to propose a hospital internal network security isolation method based on an all-optical network architecture. The present invention makes full use of all-optical network slicing, optical time domain multiplexing technology, wavelength selective switch technology and intelligent self-healing mechanism, combined with decision tree integration algorithm, graph neural network and isolation forest algorithm, to achieve the security isolation, traffic prediction and anomaly detection of the hospital internal network. The method can dynamically adjust bandwidth and resources according to different departments and business needs, ensure network security, reliability and flexibility, and has efficient traffic management, real-time anomaly isolation and network self-healing capabilities, significantly improving the operational efficiency and security of the hospital network.

[0011] According to an embodiment of the present invention, a hospital internal network security isolation method based on an all-optical network architecture includes the following steps:

[0012] S1. Based on the all-optical network slicing technology, the internal network of the hospital is divided into multiple virtual optical slices, and the virtual optical slices dynamically allocate bandwidth and resources according to different departments and business needs;

[0013] S2, using optical time domain multiplexing technology to isolate the data streams in different virtual optical slices in the time domain, and using wavelength selective switching technology to transmit different data streams on different optical wavelengths;

[0014] S3, monitor and manage the bandwidth allocation of virtual optical slices in real time through the software-defined network control platform, and dynamically adjust the optical path resources according to the traffic requirements of each business area within the hospital;

[0015] S4, based on the decision tree integration algorithm, traffic forecasting and resource optimization are carried out. The traffic change trend in the future period is predicted through historical data modeling, and the allocation of network resources is optimized according to the prediction results.

[0016] S5. Use graph neural networks to analyze the spatiotemporal relationship of network traffic, identify potential traffic anomalies and security threats, and detect and isolate abnormal traffic in real time;

[0017] S6. Detect abnormal behaviors of virtual optical slices in hospital networks through isolation forest algorithm, identify the boundary between normal and abnormal traffic, and mark and isolate abnormal traffic using dynamic threshold technology;

[0018] S7. Record the transmission logs of all network traffic through blockchain technology and conduct tamper-proof audits;

[0019] S8. When a network failure occurs, redundant optical path resources are automatically selected for switching through an intelligent self-healing mechanism, and optical path recovery is achieved using a software-defined network controller.

[0020] Optionally, the S2 specifically includes:

[0021] S21. Using the optical time domain multiplexing technology, the data stream is divided into different time periods in each virtual optical slice according to time. The transmission data of each virtual optical slice is carried out within the specified time period:

[0022] T i =[t1,t2,...,t n ];

[0023] Among them, T i represents the transmission time period of the i-th virtual optical slice, and n represents the number of virtual optical slice data transmission time periods;

[0024] S22, according to the needs of each virtual optical slice, use wavelength selective switching technology to allocate different data streams to different optical wavelengths for transmission;

[0025] S23. Allocate a suitable time slot to each virtual optical slice according to the network traffic demand, to ensure that each virtual optical slice performs data transmission within a specified time period and to avoid time slot overlap;

[0026] S24. Dynamically adjust the time slot length of each virtual optical slice according to the traffic prediction model:

[0027] L i =f(Load forecast ),in

[0028] Among them, L i Indicates the dynamic time slot resources of the ith virtual optical slice, Load forecast Indicates the predicted traffic load, Load k represents the traffic load of the kth virtual optical slice, f(Load forecast ) represents the time slot adjustment function output by the traffic prediction model, and m represents the number of virtual optical slices;

[0029] S25, dynamically adjusting wavelength allocation in the wavelength selective switch technology according to bandwidth requirements of each virtual optical slice;

[0030] S26. Using wavelength selective switching technology, wavelength allocation is dynamically adjusted during high traffic periods, and high-priority virtual optical slices obtain more optical wavelength resources.

[0031] Optionally, the S3 specifically includes:

[0032] S31. Monitor each virtual optical slice in the hospital's internal network in real time through the software-defined network control platform, and collect the bandwidth usage, traffic load, and data traffic change trends of each virtual optical slice; the software-defined network control platform regularly evaluates the data traffic of each virtual optical slice to determine whether bandwidth allocation needs to be adjusted;

[0033] S32. Determine the traffic demand of the virtual optical slices in each service area according to the real-time monitoring data through the software-defined network control platform, and dynamically adjust the bandwidth quota of each virtual optical slice;

[0034] S33. Based on the hospital's network traffic requirements and priorities, the software-defined network control platform allocates resources to virtual optical slices according to the priority strategy; for emergency medical data and monitoring data with high priority traffic, bandwidth and optical path resources are automatically allocated first;

[0035] S34. According to the traffic demand of each business area within the hospital, the software-defined network control platform calculates the bandwidth and resources required by each business area in real time, and dynamically adjusts the allocation of optical path resources according to the actual operation of the hospital;

[0036] S35. During periods of low network load, the software-defined network control platform automatically releases unnecessary bandwidth resources and reallocates bandwidth resources to virtual optical slices with higher loads.

[0037] Optionally, the S4 specifically includes:

[0038] S41. Collect historical data of each department in the hospital, including bandwidth usage, traffic load, latency, and data transmission volume in different time periods. By monitoring the traffic characteristics of the hospital network over a long period of time, the collected historical data is used as training samples for the decision tree integration algorithm.

[0039] S42, using a decision tree integration algorithm to model the collected historical data, by analyzing the traffic patterns of different business areas, dividing the input historical data into multiple nodes for decision making, and forming multiple leaf nodes;

[0040] S43. Based on historical data modeling, the flow demand in the future period is predicted. The output value generated by the decision tree integration algorithm provides a basis for the flow distribution of various departments and business areas within the hospital:

[0041]

[0042] Where R(t) represents the predicted traffic demand at time t, w i represents the weight of the i-th feature, x i (t) represents the i-th eigenvalue at time t, and N represents the number of features;

[0043] S44. Dynamically adjust the bandwidth resources of the virtual optical slices in the hospital network according to the prediction results, allocate more bandwidth to the high-traffic service area and allocate less bandwidth to the low-traffic department according to the traffic prediction results:

[0044]

[0045] Among them, B i (t) represents the bandwidth allocated to the kth service area at time t, R k (t) represents the traffic demand of the kth service area, B total represents the total bandwidth, M represents the number of service areas, R j (t) represents the traffic demand of the jth service area;

[0046] S45, monitoring the deviation between the actual network traffic and the predicted result, comparing the error between the actual traffic and the predicted traffic, and adjusting and optimizing the parameters of the decision tree;

[0047] S46. Adjust the bandwidth resources of the virtual optical slice according to the optimized traffic prediction result.

[0048] Optionally, the S5 specifically includes:

[0049] S51, collecting real-time data of internal network traffic of the hospital to form a basic data set of network traffic;

[0050] S52. Build a graph neural network model based on the basic data set of network traffic, use the departments and business areas in the hospital network as nodes, and establish traffic association relationships; each node represents a department or business area, and the edges between nodes represent traffic transmission paths between different departments or business areas;

[0051] S53. The basic data set of network traffic is input into the graph neural network as the features of nodes and edges to model the spatiotemporal relationship. The high-order relationship between nodes is calculated by combining the multi-layer perceptron and the graph convolutional network.

[0052] S54. Traffic prediction is performed through the graph neural network model to obtain the traffic trends between departments and business areas of the hospital network, and the multi-scale graph convolution layer is used to enhance the learning ability of the graph neural network model:

[0053]

[0054] in, represents the hidden state of node v in the k+1th layer, σ represents the activation function, represents the hidden state of node u in layer k, represents the hidden state of node v in the kth layer, N(v) represents the neighbor nodes of node v, and Auv represents the weight of the edge between node u and node v, D v represents the degree matrix of node v, D u represents the degree matrix of node u, α represents the adjustment factor, Represents additional learning of node features;

[0055] S55. The predicted value of traffic volume is obtained through graph neural network calculation, and traffic anomaly detection is performed in combination with historical traffic data:

[0056]

[0057] Among them, ΔR i (t) represents the flow deviation of the i-th department or business area at time t, represents the actual flow of the i-th department or business area at time t, It represents the predicted flow value of the i-th department or business area at time t;

[0058] S56: After the flow deviation value ΔR is identified i (t) When the traffic exceeds the preset threshold, it is determined that the traffic is abnormal. The boundary of abnormal traffic is determined by an adaptive threshold method, which automatically adjusts the threshold according to the current network status;

[0059] S57. When traffic anomalies are detected, the abnormal traffic is isolated through the software-defined network control platform. The isolation process includes dynamically adjusting the network routing and directing the abnormal traffic to the monitoring slice for processing.

[0060] Optionally, the S6 specifically includes:

[0061] S61, collecting the flow data of each virtual optical slice in the internal network of the hospital, wherein the flow data is collected and stored in real time by the network monitoring system to form a complete flow feature data set;

[0062] S62. Anomaly detection is performed on traffic feature data based on the isolation forest algorithm. Abnormal data points are identified by constructing multiple decision trees and recursively segmenting the data in the trees. The anomaly score of each data point reflects the degree of abnormality of the data point relative to other data points.

[0063] S63. Through the tree segmentation mechanism in the isolation forest algorithm, the data point of each virtual light slice is measured for abnormality, and the traffic data is randomly segmented through multiple decision trees. The more times the segmentation is performed, the higher the score of the abnormal point is, indicating that the data point is more likely to be abnormal traffic:

[0064]

[0065] Among them, S anomaly(t) represents the traffic anomaly score at time t, D represents the total number of trees, 1(T i (t)>θ i ) represents the indicator function. When the abnormal score T of the i-th tree i (t) is greater than the threshold θ i 1 when it is, otherwise 0;

[0066] S64, based on the calculated traffic anomaly score S anomaly (t), using dynamic threshold technology to determine whether there is abnormal traffic, and based on the statistical characteristics of historical traffic data, calculate the optimal anomaly detection threshold at the current moment in real time;

[0067] S65: When the traffic score of a virtual optical slice exceeds the set abnormal score threshold, the traffic of the virtual optical slice is considered abnormal traffic and enters the isolation process:

[0068]

[0069] in, Indicates the flow value after isolation, represents the actual flow of the i-th department or business area at time t, θ threshold Indicates the set abnormal score threshold;

[0070] S66. After the traffic is marked as abnormal, the abnormal traffic is separated from the normal traffic through the software-defined network control platform, and isolated and blocked. The isolated abnormal traffic no longer participates in network transmission until the abnormal state is resolved.

[0071] Optionally, the intelligent self-healing mechanism includes: real-time monitoring of the status of optical path resources in the hospital network to detect network failures or performance degradation; when a failure occurs, automatically scheduling redundant optical path resources and performing automatic switching; after the failure is recovered, recording events and performing log audits.

[0072] The beneficial effects of the present invention are:

[0073] First, the present invention uses all-optical network slicing technology to divide the hospital network into multiple virtual optical slices, so that the network traffic of different departments and business areas can be reasonably and dynamically allocated bandwidth, thereby effectively avoiding the bandwidth bottleneck problem caused by uneven resource allocation in the traditional network architecture. Each virtual optical slice can dynamically adjust the bandwidth and resources according to actual needs, so that different business needs within the hospital can be fully met, thereby ensuring the real-time transmission of medical data and the smooth development of medical services.

[0074] Secondly, the present invention uses optical time domain multiplexing technology and wavelength selective switching technology to effectively isolate the data streams in different virtual optical slices in terms of time domain and wavelength, so that data transmission between different business areas will not interfere with each other, reducing the risk of network congestion and resource conflicts. This refined resource management method not only improves the stability of the hospital network, but also improves the scalability of the network, allowing the hospital network to maintain efficient operation in the face of growing traffic demand.

[0075] In addition, the present invention monitors and manages virtual optical slices in real time through a software-defined network (SDN) control platform, and can dynamically adjust network resources according to traffic changes and demand changes. The SDN platform can monitor the traffic and bandwidth usage of each virtual optical slice in real time, and flexibly adjust network routing and resource allocation according to real-time data. This dynamic resource scheduling method based on real-time data analysis and traffic prediction can efficiently respond to fluctuations in network traffic, ensure priority protection of key tasks, and avoid service interruptions or performance degradation caused by network congestion or resource shortages.

[0076] In terms of security, the present invention introduces advanced artificial intelligence technologies such as decision tree integration algorithm, graph neural network and isolation forest algorithm for traffic prediction and abnormal traffic detection. These algorithms can accurately predict the trend of traffic changes in future time periods and promptly detect potential network security threats. Through the modeling and analysis of traffic feature data, abnormal traffic can be effectively identified, and abnormal traffic can be marked and isolated in real time through dynamic threshold technology to prevent malicious traffic from invading the hospital network. Compared with traditional static firewalls or intrusion detection systems, AI-based traffic prediction and anomaly detection have higher flexibility and accuracy, and can take isolation measures in time when network anomalies occur, reducing potential security risks.

[0077] The present invention also uses blockchain technology to record the transmission logs of all network traffic, providing an audit mechanism that cannot be tampered with. The entire process of network traffic is recorded and tracked through blockchain technology, ensuring the transparency and traceability of data transmission, and providing a strong guarantee for the security management of hospital networks.

[0078] Finally, when a network failure occurs, the intelligent self-healing mechanism of the present invention can automatically detect the network failure and select redundant optical path resources for rapid switching, ensuring the continuous availability of the network. After the failure is recovered, the system can record the event and perform log auditing, providing detailed failure information for hospital network managers to facilitate subsequent analysis and optimization. This self-healing mechanism improves the reliability of the hospital network, reduces the service interruption time caused by network failures, and ensures the continuity and stability of medical services. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0080] Figure 1 This is an overall flow chart of a hospital internal network security isolation method based on an all-optical network architecture proposed by the present invention;

[0081] Figure 2 This is a schematic diagram of the application of optical time domain multiplexing technology and wavelength selective switching technology in a hospital internal network security isolation method based on an all-optical network architecture proposed by the present invention. DETAILED DESCRIPTION

[0082] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, and therefore only show the components related to the present invention.

[0083] refer to Figure 1 and Figure 2 , a hospital internal network security isolation method based on an all-optical network architecture, comprising the following steps:

[0084] S1. Based on the all-optical network slicing technology, the internal network of the hospital is divided into multiple virtual optical slices, and the virtual optical slices dynamically allocate bandwidth and resources according to different departments and business needs;

[0085] S2, using optical time domain multiplexing technology to isolate the data streams in different virtual optical slices in the time domain, and using wavelength selective switching technology to transmit different data streams on different optical wavelengths;

[0086] S3, monitor and manage the bandwidth allocation of virtual optical slices in real time through the software-defined network control platform, and dynamically adjust the optical path resources according to the traffic requirements of each business area within the hospital;

[0087] S4, based on the decision tree integration algorithm, traffic forecasting and resource optimization are carried out. The traffic change trend in the future period is predicted through historical data modeling, and the allocation of network resources is optimized according to the prediction results.

[0088] S5. Use graph neural networks to analyze the spatiotemporal relationship of network traffic, identify potential traffic anomalies and security threats, and detect and isolate abnormal traffic in real time;

[0089] S6. Detect abnormal behaviors of virtual optical slices in hospital networks through isolation forest algorithm, identify the boundary between normal and abnormal traffic, and mark and isolate abnormal traffic using dynamic threshold technology;

[0090] S7. Record the transmission logs of all network traffic through blockchain technology and conduct tamper-proof audits;

[0091] S8. When a network failure occurs, redundant optical path resources are automatically selected for switching through an intelligent self-healing mechanism, and optical path recovery is achieved using a software-defined network controller.

[0092] In this implementation, S2 specifically includes:

[0093] S21. Using the optical time domain multiplexing technology, the data stream is divided into different time periods in each virtual optical slice according to time. The transmission data of each virtual optical slice is carried out within the specified time period:

[0094] T i =[t1,t2,...,t n ];

[0095] Among them, T i represents the transmission time period of the i-th virtual optical slice, and n represents the number of virtual optical slice data transmission time periods;

[0096] S22, according to the needs of each virtual optical slice, use wavelength selective switching technology to allocate different data streams to different optical wavelengths for transmission;

[0097] S23. Allocate a suitable time slot to each virtual optical slice according to the network traffic demand, to ensure that each virtual optical slice performs data transmission within a specified time period and to avoid time slot overlap;

[0098] S24. Dynamically adjust the time slot length of each virtual optical slice according to the traffic prediction model:

[0099] L i =f(Load forecast ),in

[0100] Among them, L i Indicates the dynamic time slot resources of the ith virtual optical slice, Load forecast Indicates the predicted traffic load, Load k represents the traffic load of the kth virtual optical slice, f(Load forecast ) represents the time slot adjustment function output by the traffic prediction model, and m represents the number of virtual optical slices;

[0101] S25, dynamically adjusting wavelength allocation in the wavelength selective switch technology according to bandwidth requirements of each virtual optical slice;

[0102] S26. Using wavelength selective switching technology, wavelength allocation is dynamically adjusted during high traffic periods, and high-priority virtual optical slices obtain more optical wavelength resources.

[0103] In this implementation, S3 specifically includes:

[0104] S31. Monitor each virtual optical slice in the hospital's internal network in real time through the software-defined network control platform, and collect the bandwidth usage, traffic load, and data traffic change trends of each virtual optical slice; the software-defined network control platform regularly evaluates the data traffic of each virtual optical slice to determine whether bandwidth allocation needs to be adjusted;

[0105] S32. Determine the traffic demand of the virtual optical slices in each service area according to the real-time monitoring data through the software-defined network control platform, and dynamically adjust the bandwidth quota of each virtual optical slice;

[0106] S33. Based on the hospital's network traffic requirements and priorities, the software-defined network control platform allocates resources to virtual optical slices according to the priority strategy; for emergency medical data and monitoring data with high priority traffic, bandwidth and optical path resources are automatically allocated first;

[0107] S34. According to the traffic demand of each business area within the hospital, the software-defined network control platform calculates the bandwidth and resources required by each business area in real time, and dynamically adjusts the allocation of optical path resources according to the actual operation of the hospital;

[0108] S35. During periods of low network load, the software-defined network control platform automatically releases unnecessary bandwidth resources and reallocates bandwidth resources to virtual optical slices with higher loads.

[0109] In this implementation, S4 specifically includes:

[0110] S41. Collect historical data of each department in the hospital, including bandwidth usage, traffic load, latency, and data transmission volume in different time periods. By monitoring the traffic characteristics of the hospital network over a long period of time, the collected historical data is used as training samples for the decision tree integration algorithm.

[0111] S42, using a decision tree integration algorithm to model the collected historical data, by analyzing the traffic patterns of different business areas, dividing the input historical data into multiple nodes for decision making, and forming multiple leaf nodes;

[0112] S43. Based on historical data modeling, the flow demand in the future period is predicted. The output value generated by the decision tree integration algorithm provides a basis for the flow distribution of various departments and business areas within the hospital:

[0113]

[0114] Where R(t) represents the predicted traffic demand at time t, w irepresents the weight of the i-th feature, x i (t) represents the i-th eigenvalue at time t, and N represents the number of features;

[0115] S44. Dynamically adjust the bandwidth resources of the virtual optical slices in the hospital network according to the prediction results, allocate more bandwidth to the high-traffic service area and allocate less bandwidth to the low-traffic department according to the traffic prediction results:

[0116]

[0117] Among them, B i (t) represents the bandwidth allocated to the kth service area at time t, R k (t) represents the traffic demand of the kth service area, B total represents the total bandwidth, M represents the number of service areas, R j (t) represents the traffic demand of the jth service area;

[0118] S45, monitoring the deviation between the actual network traffic and the predicted result, comparing the error between the actual traffic and the predicted traffic, and adjusting and optimizing the parameters of the decision tree;

[0119] S46. Adjust the bandwidth resources of the virtual optical slice according to the optimized traffic prediction result.

[0120] In this implementation manner, S5 specifically includes:

[0121] S51, collecting real-time data of internal network traffic of the hospital to form a basic data set of network traffic;

[0122] S52. Build a graph neural network model based on the basic data set of network traffic, use the departments and business areas in the hospital network as nodes, and establish traffic association relationships; each node represents a department or business area, and the edges between nodes represent traffic transmission paths between different departments or business areas;

[0123] S53. The basic data set of network traffic is input into the graph neural network as the features of nodes and edges to model the spatiotemporal relationship. The high-order relationship between nodes is calculated by combining the multi-layer perceptron and the graph convolutional network.

[0124] S54. Traffic prediction is performed through the graph neural network model to obtain the traffic trends between departments and business areas of the hospital network, and the multi-scale graph convolution layer is used to enhance the learning ability of the graph neural network model:

[0125]

[0126] in, represents the hidden state of node v in the k+1th layer, σ represents the activation function, represents the hidden state of node u in layer k, represents the hidden state of node v in the kth layer, N(v) represents the neighbor nodes of node v, and A uv represents the weight of the edge between node u and node v, D v represents the degree matrix of node v, D u represents the degree matrix of node u, α represents the adjustment factor, Represents additional learning of node features;

[0127] S55. The predicted value of traffic volume is obtained through graph neural network calculation, and traffic anomaly detection is performed in combination with historical traffic data:

[0128]

[0129] Among them, ΔR i (t) represents the flow deviation of the i-th department or business area at time t, represents the actual flow of the i-th department or business area at time t, It represents the predicted flow value of the i-th department or business area at time t;

[0130] S56: After the flow deviation value ΔR is identified i (t) When the traffic exceeds the preset threshold, it is determined that the traffic is abnormal. The boundary of abnormal traffic is determined by an adaptive threshold method, which automatically adjusts the threshold according to the current network status;

[0131] S57. When traffic anomalies are detected, the abnormal traffic is isolated through the software-defined network control platform. The isolation process includes dynamically adjusting the network routing and directing the abnormal traffic to the monitoring slice for processing.

[0132] In this implementation manner, S6 specifically includes:

[0133] S61, collecting the flow data of each virtual optical slice in the internal network of the hospital, wherein the flow data is collected and stored in real time by the network monitoring system to form a complete flow feature data set;

[0134] S62. Anomaly detection is performed on traffic feature data based on the isolation forest algorithm. Abnormal data points are identified by constructing multiple decision trees and recursively segmenting the data in the trees. The anomaly score of each data point reflects the degree of abnormality of the data point relative to other data points.

[0135] S63. Through the tree segmentation mechanism in the isolation forest algorithm, the data point of each virtual light slice is measured for abnormality, and the traffic data is randomly segmented through multiple decision trees. The more times the segmentation is performed, the higher the score of the abnormal point is, indicating that the data point is more likely to be abnormal traffic:

[0136]

[0137] Among them, S anomaly (t) represents the traffic anomaly score at time t, D represents the total number of trees, 1(T i (t)>θ i ) represents the indicator function. When the abnormal score T of the i-th tree i (t) is greater than the threshold θ i 1 when it is, otherwise 0;

[0138] S64, based on the calculated traffic anomaly score S anomaly (t), using dynamic threshold technology to determine whether there is abnormal traffic, and based on the statistical characteristics of historical traffic data, calculate the optimal anomaly detection threshold at the current moment in real time;

[0139] S65: When the traffic score of a virtual optical slice exceeds the set abnormal score threshold, the traffic of the virtual optical slice is considered abnormal traffic and enters the isolation process:

[0140]

[0141] in, Indicates the flow value after isolation, represents the actual flow of the i-th department or business area at time t, θ threshold Indicates the set abnormal score threshold;

[0142] S66. After the traffic is marked as abnormal, the abnormal traffic is separated from the normal traffic through the software-defined network control platform, and isolated and blocked. The isolated abnormal traffic no longer participates in network transmission until the abnormal state is resolved.

[0143] In this embodiment, the intelligent self-healing mechanism includes: real-time monitoring of the status of optical path resources in the hospital network to detect network failures or performance degradation; when a failure occurs, automatically scheduling redundant optical path resources and performing automatic switching; after the failure is recovered, recording events and performing log audits.

[0144] Embodiment 1:

[0145] In order to verify the feasibility of the present invention in implementation, the present invention is applied to a large hospital. The hospital is large in scale and covers multiple departments, including the emergency department, intensive care unit, internal medicine, surgery, imaging department, and laboratory department. The internal network of the hospital needs to efficiently and flexibly support the network traffic of different departments and business areas, and ensure the security and timely transmission of medical data. Network traffic includes the communication needs of various applications such as the transmission of daily medical data, hospital management system, and remote consultation. The traditional network architecture has insufficient bandwidth, cannot be adjusted in real time when traffic bursts, and network attacks pose a greater threat to critical medical data.

[0146] In order to better solve these problems, the hospital introduced network security isolation technology based on the all-optical network architecture. This technology can not only dynamically adjust network resources according to the needs of different departments and businesses, but also monitor network traffic in real time, predict traffic changes, and quickly respond to the isolation and protection of abnormal traffic.

[0147] In the hospital's application, the hospital's internal network is first divided into multiple virtual optical slices through the all-optical network slicing technology. Each virtual optical slice dynamically allocates bandwidth according to the network requirements of different departments. For example, the emergency department has high requirements for network bandwidth and real-time performance, so more network resources will be allocated preferentially during certain periods (such as emergency peak hours), while the traffic demand of the imaging department and the laboratory department is relatively stable, so less bandwidth is allocated.

[0148] In terms of network traffic isolation, the hospital uses optical time domain multiplexing (OTDM) and wavelength selective switching (WSS) technology to isolate the data streams in different virtual optical slices in the time domain, and uses wavelength selective switching technology to allocate different data streams to different optical wavelengths for transmission. In this way, even if the traffic in some departments fluctuates greatly, it will not affect other departments, thus ensuring the security and stable transmission of data within the hospital.

[0149] When using the software-defined network control platform to monitor each virtual optical slice in real time, the hospital can keep track of the usage of network resources at any time and adjust the bandwidth according to business needs. During certain periods of time, the bandwidth demand of the emergency department surges, and the hospital's control platform will dynamically adjust the optical path resources to prioritize the network needs of the emergency department. At the same time, the decision tree integration algorithm and graph neural network technology can predict future changes in traffic demand of various departments within the hospital through modeling and real-time analysis of historical traffic data, make bandwidth adjustments in advance, and ensure that the hospital network can still operate stably during high-load periods.

[0150] In addition, when abnormal traffic or potential security threats appear in the hospital network, the anomaly detection mechanism based on the isolation forest algorithm can identify abnormal data points, mark and isolate abnormal traffic through dynamic threshold technology, and prevent potential network attacks or malicious data from interfering with the hospital's medical business. After the traffic is isolated, the software-defined network control platform can quickly adjust the network routing to isolate normal traffic from abnormal traffic and ensure that medical data is not interfered with.

[0151] Finally, the hospital's network traffic transmission logs are recorded and encrypted and stored using blockchain technology to ensure that the logs cannot be tampered with. When a network failure occurs, the intelligent self-healing mechanism automatically selects redundant optical path resources for switching to ensure the continuous operation of the hospital network.

[0152] Table 1 Comparison of hospital internal network security isolation methods based on all-optical network architecture

[0153] Data indicators Before deployment Post-deployment Improvement Frequency of network security incidents (times / month) 35 5 85.7% reduction Network attack detection rate (%) 60％ 95％ 58.3% increase Security incident isolation response time (seconds) 30 5 83.3% reduction Underreporting rate of network security incidents (%) 40％ 5％ 87.5% reduction Network Defense Tiers (Layers) 3 5 Raise 2 floors Network security log recording accuracy (%) 70％ 100％ 42.9% increase Impact of security incidents on medical data (times / month) 10 0 100% reduction Abnormal flow detection accuracy (%) 75％ 98％ 30.7% increase

[0154] By analyzing the above Table 1, it can be clearly seen that the effect of the hospital internal network security isolation method based on the all-optical network architecture after implementation is significantly better than before implementation, especially in terms of security incident monitoring, isolation response, and attack detection accuracy.

[0155] First, from the perspective of the frequency of network security incidents, the frequency of hospital network security incidents has dropped significantly after implementation, from 35 times per month to 5 times, a decrease of 85.7%. This shows that by adopting the all-optical network architecture and multiple security protection technologies, the frequency of network attacks in the hospital has been effectively controlled. Network isolation technology and dynamic bandwidth allocation methods have greatly enhanced the overall security of the network, reducing external attacks and potential internal security risks.

[0156] Secondly, the cyber attack detection rate has significantly increased from 60% to 95%. This change is mainly due to the introduction of traffic analysis technology based on graph neural networks and the anomaly detection function of the isolation forest algorithm, which enables the hospital's network to more comprehensively monitor and identify cyber attacks. With the application of these advanced algorithms, the hospital can promptly detect and defend against potential cyber attacks, thereby reducing the probability of cyber security incidents.

[0157] In terms of security incident isolation response time, the response time was significantly reduced from 30 seconds to 5 seconds after implementation, a decrease of 83.3%. This is particularly important because when a security incident occurs, the speed of network isolation directly affects data protection and system recovery speed. After adopting the all-optical network architecture and software-defined network (SDN) control platform, the network can respond in real time and automatically switch redundant paths, greatly shortening the isolation response time and ensuring the continuity and security of the hospital network.

[0158] At the same time, the underreporting rate of network security incidents has also been significantly reduced, from 40% to 5%, a decrease of 87.5%. This means that after implementation, the hospital can more accurately detect security threats in the network and avoid underreporting or false alarms. Through improved security protection measures, the hospital can fully monitor and record every network security incident to ensure that all abnormal activities are handled in a timely manner.

[0159] The improvement of network defense levels is also a highlight. By introducing more layers of security protection technologies, such as decision tree integration algorithms and graph neural networks, the defense level has been increased from 3 layers to 5 layers, enhancing the overall network defense depth and refinement. This multi-level security defense mechanism can hierarchically manage and accurately intercept different types of network attacks, improving the security and protection capabilities of the network.

[0160] In terms of network security log recording accuracy, the accuracy has increased from 70% to 100% after deployment. This improvement is due to the application of blockchain technology, which ensures the immutability and accurate recording of security event logs. This not only enhances the hospital's ability to track network security events, but also provides reliable evidence and audit records for any problems in the future.

[0161] It is worth noting that the impact of security incidents on medical data has been improved by 100% after implementation, and the impact of security incidents on medical data transmission has been reduced to zero. This is crucial because the integrity and timeliness of medical data are directly related to the health and safety of patients. By adopting the network security isolation method, the hospital not only ensures the security of data transmission, but also avoids the loss or tampering of medical data due to cyber attacks.

[0162] Finally, the accuracy of abnormal traffic detection has also been greatly improved, from 75% to 98%, an increase of 30.7%. This improvement shows that by applying efficient traffic prediction models and abnormal traffic detection technology, hospitals can more accurately identify and isolate abnormal traffic, preventing potential network attacks and intrusions from internal and external threats.

[0163] In short, it can be seen from these data that the hospital internal network security isolation method based on the all-optical network architecture has achieved significant improvements in multiple key indicators. From reducing the occurrence of security incidents, improving attack detection rates to reducing response time and false negatives, this method fully demonstrates its great advantages in hospital network security management. Especially for the protection of medical data, the implemented method ensures the stable operation of the hospital network and the integrity of medical data, effectively avoiding problems such as medical data leakage and tampering caused by network attacks, and ensuring the normal operation of the hospital and the safety of patients.

[0164] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A hospital internal network security isolation method based on an all-optical network architecture, characterized in that: The steps include: S1. Based on the all-optical network slicing technology, the internal network of the hospital is divided into multiple virtual optical slices, and the virtual optical slices dynamically allocate bandwidth and resources according to different departments and business needs; S2, using optical time domain multiplexing technology to isolate the data streams in different virtual optical slices in the time domain, and using wavelength selective switching technology to transmit different data streams on different optical wavelengths; S3, monitor and manage the bandwidth allocation of virtual optical slices in real time through the software-defined network control platform, and dynamically adjust the optical path resources according to the traffic requirements of each business area within the hospital; S4, based on the decision tree integration algorithm, traffic forecasting and resource optimization are carried out. The traffic change trend in the future period is predicted through historical data modeling, and the allocation of network resources is optimized according to the prediction results. S5. Use graph neural networks to analyze the spatiotemporal relationship of network traffic, identify potential traffic anomalies and security threats, and detect and isolate abnormal traffic in real time; S6. Detect abnormal behaviors of virtual optical slices in hospital networks through isolation forest algorithm, identify the boundary between normal and abnormal traffic, and use dynamic threshold technology to mark and isolate abnormal traffic; S7. Record the transmission logs of all network traffic through blockchain technology and conduct tamper-proof audits; S8. When a network failure occurs, redundant optical path resources are automatically selected for switching through an intelligent self-healing mechanism, and optical path recovery is achieved using a software-defined network controller.

2. According to claim 1, a hospital internal network security isolation method based on an all-optical network architecture is characterized in that: The S2 specifically includes: S21. Using the optical time domain multiplexing technology, the data stream is divided into different time periods in each virtual optical slice according to time. The transmission data of each virtual optical slice is carried out within the specified time period: T i =[t1,t2,...,t n ]; Among them, T i represents the transmission time period of the i-th virtual optical slice, and n represents the number of virtual optical slice data transmission time periods; S22, according to the needs of each virtual optical slice, use wavelength selective switching technology to allocate different data streams to different optical wavelengths for transmission; S23. Allocate a suitable time slot to each virtual optical slice according to the network traffic demand, to ensure that each virtual optical slice performs data transmission within a specified time period and to avoid time slot overlap; S24. Dynamically adjust the time slot length of each virtual optical slice according to the traffic prediction model: L i =f(Load forecast ),in Among them, L i Indicates the dynamic time slot resources of the ith virtual optical slice, Load forecast Indicates the predicted traffic load, Load k represents the traffic load of the kth virtual optical slice, f(Load forecast ) represents the time slot adjustment function output by the traffic prediction model, and m represents the number of virtual optical slices; S25, dynamically adjusting wavelength allocation in the wavelength selective switch technology according to bandwidth requirements of each virtual optical slice; S26. Using wavelength selective switching technology, wavelength allocation is dynamically adjusted during high traffic periods, and high-priority virtual optical slices obtain more optical wavelength resources.

3. According to claim 1, a hospital internal network security isolation method based on an all-optical network architecture is characterized in that: The S3 specifically includes: S31. Monitor each virtual optical slice in the hospital's internal network in real time through the software-defined network control platform, and collect the bandwidth usage, traffic load, and data traffic change trends of each virtual optical slice; the software-defined network control platform regularly evaluates the data traffic of each virtual optical slice to determine whether bandwidth allocation needs to be adjusted; S32. Determine the traffic demand of the virtual optical slices in each service area according to the real-time monitoring data through the software-defined network control platform, and dynamically adjust the bandwidth quota of each virtual optical slice; S33. Based on the hospital's network traffic requirements and priorities, the software-defined network control platform allocates resources to virtual optical slices according to the priority strategy; for emergency medical data and monitoring data with high priority traffic, bandwidth and optical path resources are automatically allocated first; S34. According to the traffic demand of each business area within the hospital, the software-defined network control platform calculates the bandwidth and resources required by each business area in real time, and dynamically adjusts the allocation of optical path resources according to the actual operation of the hospital; S35. During periods of low network load, the software-defined network control platform automatically releases unnecessary bandwidth resources and reallocates bandwidth resources to virtual optical slices with higher loads.

4. According to claim 1, a hospital internal network security isolation method based on an all-optical network architecture is characterized in that: The S4 specifically includes: S41. Collect historical data of each department in the hospital, including bandwidth usage, traffic load, latency, and data transmission volume in different time periods. Through long-term monitoring of traffic characteristics of the hospital network, the collected historical data is used as training samples for the decision tree integration algorithm. S42, using a decision tree integration algorithm to model the collected historical data, by analyzing the traffic patterns of different business areas, dividing the input historical data into multiple nodes for decision making, and forming multiple leaf nodes; S43. Based on historical data modeling, the flow demand in the future period is predicted. The output value generated by the decision tree integration algorithm provides a basis for the flow distribution of various departments and business areas within the hospital: Where R(t) represents the predicted traffic demand at time t, w i represents the weight of the i-th feature, x i (t) represents the i-th eigenvalue at time t, and N represents the number of features; S44. Dynamically adjust the bandwidth resources of the virtual optical slices in the hospital network according to the prediction results, allocate more bandwidth to the high-traffic service area and allocate less bandwidth to the low-traffic department according to the traffic prediction results: Among them, B i (t) represents the bandwidth allocated to the kth service area at time t, R k (t) represents the traffic demand of the kth service area, B total represents the total bandwidth, M represents the number of service areas, R j (t) represents the traffic demand of the jth service area; S45, monitoring the deviation between the actual network traffic and the predicted result, comparing the error between the actual traffic and the predicted traffic, and adjusting and optimizing the parameters of the decision tree; S46. Adjust the bandwidth resources of the virtual optical slice according to the optimized traffic prediction result.

5. According to claim 1, a hospital internal network security isolation method based on an all-optical network architecture is characterized in that: The S5 specifically includes: S51, collecting real-time data of internal network traffic of the hospital to form a basic data set of network traffic; S52. Build a graph neural network model based on the basic data set of network traffic, use the departments and business areas in the hospital network as nodes, and establish traffic association relationships; each node represents a department or business area, and the edges between nodes represent traffic transmission paths between different departments or business areas; S53. The basic data set of network traffic is input into the graph neural network as the features of nodes and edges to model the spatiotemporal relationship. The high-order relationship between nodes is calculated by combining the multi-layer perceptron and the graph convolutional network. S54. Traffic prediction is performed through the graph neural network model to obtain the traffic trends between departments and business areas of the hospital network, and the multi-scale graph convolution layer is used to enhance the learning ability of the graph neural network model: in, represents the hidden state of node v in the k+1th layer, σ represents the activation function, represents the hidden state of node u in layer k, represents the hidden state of node v in the kth layer, N(v represents the neighbor node of node v, A uv represents the weight of the edge between node u and node v, D v represents the degree matrix of node v, D u represents the degree matrix of node u, α represents the adjustment factor, Represents additional learning of node features; S55. The predicted value of traffic volume is obtained through graph neural network calculation, and traffic anomaly detection is performed in combination with historical traffic data: Among them, ΔR i (t) represents the flow deviation of the i-th department or business area at time t, represents the actual flow of the i-th department or business area at time t, It represents the predicted flow value of the i-th department or business area at time t; S56: After the flow deviation value ΔR is identified i (t) When the traffic exceeds the preset threshold, it is determined that the traffic is abnormal. The boundary of abnormal traffic is determined by an adaptive threshold method, which automatically adjusts the threshold according to the current network status; S57. When traffic anomalies are detected, the abnormal traffic is isolated through the software-defined network control platform. The isolation process includes dynamically adjusting the network routing and directing the abnormal traffic to the monitoring slice for processing.

6. According to claim 1, a hospital internal network security isolation method based on an all-optical network architecture is characterized in that: The S6 specifically includes: S61, collecting the flow data of each virtual optical slice in the internal network of the hospital, wherein the flow data is collected and stored in real time by the network monitoring system to form a complete flow feature data set; S62. Anomaly detection is performed on traffic feature data based on the isolation forest algorithm. Abnormal data points are identified by constructing multiple decision trees and recursively segmenting the data in the trees. The anomaly score of each data point reflects the degree of abnormality of the data point relative to other data points. S63. Through the tree segmentation mechanism in the isolation forest algorithm, the data point of each virtual light slice is measured for abnormality, and the traffic data is randomly segmented through multiple decision trees. The more times the segmentation is performed, the higher the score of the abnormal point is, indicating that the data point is more likely to be abnormal traffic: Among them, S anomaly (t) represents the traffic anomaly score at time t, D represents the total number of trees, 1(T i (t)>θ i ) represents the indicator function. When the abnormal score T of the i-th tree i (t) is greater than the threshold θ i 1 when it is, otherwise 0; S64, based on the calculated traffic anomaly score S anomaly (t), using dynamic threshold technology to determine whether there is abnormal traffic, and based on the statistical characteristics of historical traffic data, calculate the optimal anomaly detection threshold at the current moment in real time; S65: When the traffic score of a virtual optical slice exceeds the set abnormal score threshold, the traffic of the virtual optical slice is considered abnormal traffic and enters the isolation process: in, Indicates the flow value after isolation, represents the actual flow of the i-th department or business area at time t, θ threshold Indicates the set abnormal score threshold; S66. After the traffic is marked as abnormal, the abnormal traffic is separated from the normal traffic through the software-defined network control platform, and isolated and blocked. The isolated abnormal traffic no longer participates in network transmission until the abnormal state is resolved.

7. According to claim 1, a hospital internal network security isolation method based on an all-optical network architecture is characterized in that: The intelligent self-healing mechanism includes: real-time monitoring of the status of optical path resources in the hospital network to detect network failures or performance degradation; when a failure occurs, automatically dispatching redundant optical path resources and performing automatic switching; after the failure is recovered, recording events and performing log auditing.

Images