Remote video transmission method and system for Internet medical platform

Abstract

The invention discloses a remote video transmission method and system of an internet medical platform, and relates to the technical field of remote video transmission of the internet medical platform, and the method comprises the following steps: obtaining various parameter information generated in the remote diagnosis process of the internet medical platform, including network security monitoring information and authority control information, the network security monitoring information and the authority control information are processed, and the system state is monitored in real time by obtaining the network security monitoring information and the authority control information generated in the remote diagnosis process of the Internet medical platform, especially the anomaly detection sensitivity index and the data access authority control index. By generating the comprehensive safety evaluation index and comparing the comprehensive safety evaluation index with the preset threshold value, the running state of the system is quickly judged. And when the security evaluation index exceeds a threshold value, the system generates a high-risk abnormal signal and performs early warning to prompt an administrator to intervene in time so as to prevent privacy leakage.

Description

Technical Field

[0001] The present invention relates to the technical field of remote video transmission of an Internet medical platform, and in particular to a remote video transmission method and system of an Internet medical platform. Background Art

[0002] The remote video transmission system of the Internet medical platform refers to the use of Internet technology to achieve remote real-time video communication between doctors and patients, which is used in medical consultation, diagnosis, treatment and follow-up scenarios. Through this system, patients do not need to go to the hospital in person, but only need to use smart devices such as mobile phones and computers to communicate with doctors "face to face". The system usually includes real-time audio and video transmission functions to ensure that doctors can observe the patient's condition through video. At the same time, it can also share medical records, images, laboratory test results and other information to facilitate doctors to make accurate diagnoses. In this process, the platform will use encryption technology to protect the privacy of patients, ensure that data will not be illegally stolen or leaked during transmission, and protect the safety of patients' personal information. The system relies on efficient and stable data transmission technology to ensure clear and smooth video and synchronized audio, thereby avoiding diagnostic errors. At the same time, remote video transmission systems are often integrated with electronic medical records, remote monitoring, AI-assisted diagnosis and other functions to improve diagnosis and treatment efficiency and improve patients' medical experience. The platform usually follows strict data privacy protection standards, such as GDPR or HIPAA, to ensure the privacy of patients' health information during storage and transmission. Remote video transmission is particularly suitable for chronic disease management, remote consultation, follow-up visits and medical services in remote areas, making medical resources more equitable. It reduces patients' time costs and transportation burdens, while ensuring the security of patient data. The prior art has the following deficiencies: If an abnormality occurs during the remote diagnosis process of the Internet medical platform, resulting in the leakage of patient privacy, and the system fails to detect or prevent such leakage in time, it may lead to a series of serious consequences. Patient health information, such as medical records, diagnostic reports and drug use records, usually contains sensitive content. If this information is obtained by criminals, it may be used for identity theft, fraud or blackmail. For example, medical information involving sexually transmitted diseases, mental health problems or cancer may be used to blackmail patients, and even private medical information may be maliciously sold to insurance companies or other companies, resulting in increased insurance premiums or loss of insurance eligibility for patients.

[0003] In addition, privacy leaks may also allow hackers or criminals to tamper with patients' medical data, which directly threatens patients' medical safety. Tampered medical records or health records may cause doctors to make incorrect diagnoses or prescribe inappropriate medications, posing serious risks to patients' health or even life-threatening. In general, privacy leaks may not only cause direct harm to individual patients, but may also pose a major threat to the trust and security of the entire medical system.

[0004] The above information disclosed in the background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore it may include information that does not constitute the prior art known to a person of ordinary skill in the art. Summary of the invention

[0005] The purpose of the present invention is to provide a remote video transmission method and system for an Internet medical platform to solve the problems in the above-mentioned background technology. In order to achieve the above object, the present invention provides the following technical solution: comprising the following steps: Obtain various parameter information generated during the remote diagnosis process of the Internet medical platform, including network security monitoring information and authority control information, and process the network security monitoring information and authority control information; Comprehensively analyze the processed network security monitoring information and authority control information to generate a security assessment index, and use the security assessment index to evaluate the remote diagnosis process of the Internet medical platform; Compare and analyze the safety assessment index generated during the remote diagnosis process of the Internet medical platform with the pre-set reference threshold of the safety assessment index to determine the operating status of the remote diagnosis of the Internet medical platform and issue early warning information for existing safety hazards; When judging the operation status of the remote diagnosis of the Internet medical platform, collect several security assessment indexes generated in real time during the remote diagnosis process of the Internet medical platform for comprehensive analysis to judge the operation status of the Internet medical platform; Preferably, the acquired network security monitoring information and permission control information include an anomaly detection sensitivity index and a data access permission control index, respectively, and the anomaly detection sensitivity index and the data access permission control index are calibrated as ADSI and ACRI, respectively; Preferably, the abnormal detection sensitivity index ADSI and the data access permission control index ACRI after analysis and processing in the remote diagnosis process of the Internet medical platform are used to generate the security assessment index AS, according to the formula: ; In the formula, f1 and f2 are preset proportional coefficients of abnormal detection sensitivity index ADC and data access permission control index ACDA, respectively, and both f1 and f2 are greater than 0; Preferably, under the detection window, network security monitoring information is collected, features are extracted from the collected network security monitoring information, normal activity data is modeled using a statistical model, and the range of abnormal activity data is defined; The anomaly score of each behavior is calculated based on its deviation from normal activity data. The calculation expression is as follows: , where S i represents the anomaly score, that is, the anomaly score of the ith behavior, W j represents the weight of the jth feature, reflecting the importance of the feature to anomaly detection, F ij represents the value of the i-th behavior on the j-th feature, represents the normal behavior model prediction value of the jth feature, and m represents the total number of features; Based on the anomaly score, the anomaly detection sensitivity index of the entire system is calculated to evaluate the system's ability to detect abnormal activities. The calculation expression is as follows: , where ADSI represents the anomaly detection sensitivity index, n represents the total number of behaviors, and τ adjusts the system's evaluation of different anomaly scores S i The sensitivity of, max(S) represents the maximum value of all anomaly scores; Preferably, under the detection window, collect and define the permission access matrix P, where the element P rs represents the access permission level of user r to resource s. The dimension of the access matrix is ​​R×S, where R is the total number of users, S is the total number of resources, and the element P rs is one of the elements in the permission access matrix P; Calculate the imbalanced index of permissions for all users. The calculation expression is as follows: , where E represents the authority distribution imbalance index, D rs It is an element of the permission distribution matrix D, which represents the permission weight of user r to resource s; Calculate the permission control consistency index. The calculation expression is as follows: , where F represents the authority control consistency index, C st It is one of the elements of the permission control consistency index F, indicating the permission consistency between resource s and resource t; The data access permission control index is generated by combining the permission distribution imbalance index E and the permission control consistency index F. The calculation expression is as follows: ACRI= , where ACRI represents the data access permission control index, max(E) represents the theoretical maximum value of the permission distribution imbalance index, and max(F) represents the theoretical maximum value of the permission control consistency index; Preferably, the safety assessment index generated during the remote diagnosis process of the Internet medical platform is compared with a preset safety assessment index reference threshold, and the analysis results are as follows: If the safety assessment index is greater than or equal to the preset safety assessment index reference threshold, a high-risk data anomaly signal is generated, and an early warning prompt is issued for the high-risk data anomaly signal; If the safety assessment index is less than the preset safety assessment index reference threshold, a low-risk data anomaly signal is generated, and no warning is issued for the low-risk data anomaly signal; Preferably, when judging the operation status of the remote diagnosis of the Internet medical platform, a plurality of safety assessment indexes generated in real time during the remote diagnosis of the Internet medical platform are collected to establish a data set, and a comprehensive analysis is performed on the plurality of safety assessment indexes in the data set; Calculate the average and standard deviation of several safety assessment indexes in the data set, and mark the average and standard deviation of the safety assessment index as AS 平均 and AS 标准 , and the average value of the safety assessment index AS 平均 and the standard deviation of the safety assessment index and AS 标准 The average value of the pre-set safety assessment index reference threshold AS 参考平均 and the standard deviation reference threshold of the safety assessment index AS 参考标准 The comparison results are as follows: If AS 平均 ≥AS 参考平均 , then an early warning signal is generated. When an early warning signal is generated, it indicates that an abnormality has occurred during the operation of the remote diagnosis of the Internet medical platform, and the system needs to be inspected and maintained; like , indicating that the remote diagnosis of the Internet medical platform is unstable during operation, and the operation is sometimes good and sometimes bad, which generates an unstable signal, and the system also needs to be checked and maintained; like , indicating that the remote diagnosis operation of the Internet medical platform is in a stable state, generating a stable operation signal, indicating that the system is running normally and no intervention is required; A remote video transmission system for an Internet medical platform, characterized in that it includes a data acquisition module, a comprehensive analysis module, a hidden danger perception module, an early warning module and a feedback module; The data acquisition module obtains various parameter information generated during the remote diagnosis process of the Internet medical platform, including network security monitoring information and authority control information, and processes the network security monitoring information and authority control information; The comprehensive analysis module comprehensively analyzes the processed network security monitoring information and authority control information, generates a security assessment index, and uses the security assessment index to evaluate the remote diagnosis process of the Internet medical platform; The hidden danger perception module compares and analyzes the safety assessment index generated during the remote diagnosis of the Internet medical platform with the pre-set reference threshold of the safety assessment index, determines the operation status of the remote diagnosis of the Internet medical platform, and issues early warning information on existing safety hazards through the early warning module; The feedback module collects several security assessment indexes generated in real time during the remote diagnosis process of the Internet medical platform for comprehensive analysis to determine the operating status of the Internet medical platform when judging the operating status of the remote diagnosis of the Internet medical platform.

[0006] In the above technical solution, the technical effects and advantages provided by the present invention are: The present invention can monitor the system status in real time at each step of the diagnosis process by acquiring the network security monitoring information and permission control information generated during the remote diagnosis process of the Internet medical platform, especially the abnormal detection sensitivity index and the data access permission control index. By generating a comprehensive security assessment index and comparing it with a preset reference threshold, the system operation status can be quickly and accurately judged. When the security assessment index exceeds the preset threshold, the system will generate a high-risk data anomaly signal and issue an early warning, prompting the system administrator to intervene and maintain, thereby preventing the potential privacy leakage problem from further expanding. This real-time monitoring and early warning mechanism effectively improves the system's sensitivity to abnormal detection, can identify high-risk problems that may lead to patient privacy leakage in advance, and ensures the operational safety of the platform.

[0007] The present invention collects several safety assessment indexes generated in real time during the remote diagnosis process, establishes a data set, and calculates the average value and standard deviation to more carefully evaluate the stability of the system. If the average value and standard deviation of the safety assessment index are significantly deviated from the set reference threshold, the system will generate an early warning signal or an instability signal, indicating that there is instability or abnormality in the operation of the system. Through this method, the platform can more accurately identify situations where the system is in an unstable state or operating abnormally, and issue maintenance recommendations in a timely manner. This system status analysis method helps optimize maintenance strategies, which not only reduces the risk of patient privacy leakage, but also improves the overall operating efficiency and stability of the system, and ensures the reliability and security of telemedicine services. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0009] Figure 1 The present invention is a method flow chart of a remote video transmission method and system for an Internet medical platform.

[0010] Figure 2 The present invention is a module schematic diagram of a remote video transmission method and system for an Internet medical platform. DETAILED DESCRIPTION

[0011] Example embodiments will now be described more fully with reference to the accompanying drawings; however, the example embodiments may be implemented in various forms and should not be construed as limited to the examples set forth herein; rather, these example embodiments are provided so that the description of the present disclosure will be more comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art.

[0012] The present invention provides Figure 1 A remote video transmission method of an Internet medical platform is shown, comprising the following steps: Obtain various parameter information generated during the remote diagnosis process of the Internet medical platform, including network security monitoring information and authority control information, and process the network security monitoring information and authority control information; The obtained network security monitoring information and permission control information include anomaly detection sensitivity index and data access permission control index, and the anomaly detection sensitivity index and data access permission control index are calibrated as ADC and ACRI respectively; The anomaly detection sensitivity index indicates the system's monitoring capability and sensitivity to abnormal activities; During the remote diagnosis process of the Internet medical platform, changes in anomaly detection sensitivity will have a significant impact on the security and risk management of the system. The lower the anomaly detection sensitivity, the more likely the system will lose vigilance against minor abnormal activities, especially those attacks that occur gradually and are more concealed. Hackers can exploit this vulnerability to steal or tamper with patients' health data without being detected, resulting in data leakage or misleading diagnosis, which in turn endangers patients' medical safety. In addition, unauthorized personnel may obtain sensitive data without being detected, further amplifying the risk of privacy leakage and increasing the security risks of the platform. On the contrary, the higher the anomaly detection sensitivity, the higher the alert level of the system, which can effectively monitor more subtle abnormal activities. Even small-scale or gradually developing attacks can be discovered and prevented in time, thus better protecting the security of patient data and the overall operation of the platform. The logic for obtaining the anomaly detection sensitivity index is as follows: Under the detection window, network security monitoring information is collected, features are extracted from the collected network security monitoring information, normal activity data is modeled using a statistical model, and the range of abnormal activity data is defined; It should be noted that normal activity data and abnormal activity data are two types of key data used by network security monitoring systems to identify and distinguish system behaviors; 1. Normal activity data Definition: Normal activity data refers to the standard behavior of various types of user and system operations when there are no security threats or abnormal situations in the system; it represents the data generated when legitimate users operate in accordance with system regulations and permissions; Common types: User login records: records of legitimate users logging into the system using correct credentials; Legal file access: users access, read or modify files according to their permissions; System update and maintenance logs: logs generated during normal system operation and updates, such as regular system backups and software updates; Regular network traffic: traffic data generated by normal user network requests, such as uploading or downloading legal files, sending emails, video conferencing, etc. Daily query and operation records: doctors, nurses and other medical personnel normally query patient information, prescribe medicines, update medical records and other operations on the medical platform; 2. Abnormal activity data Definition: Abnormal activity data refers to data generated when abnormal behavior occurs in the system or involves potential security threats, unauthorized access or other malicious behavior; such data may indicate a cyber attack, data leakage or unauthorized activity; Common types: Unauthorized access attempts: Login failure records generated when a user or malicious person attempts to access the system using incorrect credentials or unauthorized means; Unusual file modifications: Unauthorized users attempt to access or tamper with sensitive files, such as medical or medication records; Malware activity: Signs of malware or virus propagation detected in the system, such as the creation of unknown files and the execution of automated programs; Abnormal network traffic: sudden large amounts of data transmission (such as DDoS attacks), or requests from abnormal sources (such as high frequency requests from unknown IP addresses); Database tampering or leakage: hackers modify database information, steal sensitive data, or attempt to export data in batches after intrusion; Unusual system privilege changes: Unauthorized users or programs attempt to change privileges to grant themselves or others greater system access rights; Normal activity data reflects the records of legitimate users operating the system in a secure environment in a regular manner, including logins, file accesses, network requests, etc. Abnormal activity data refers to abnormal operations captured when potential security issues occur in the system, such as unauthorized access, malicious attacks, abnormal traffic, etc. By collecting these two types of data, the system can learn how to identify normal and abnormal behaviors and further improve the accuracy of security monitoring and threat detection; Network security monitoring information refers to data related to network security that is collected, recorded, and analyzed through various technical means to identify, evaluate, and respond to potential security threats and vulnerabilities. The following is a detailed description of network security monitoring information, including its main types and contents: 1. Network Traffic Data (NetworkTrafficData) Content: Records detailed information of data packets transmitted in the network, including source IP address, destination IP address, transmission protocol, port number, data volume, etc. Function: Helps analyze network traffic patterns, identify abnormal traffic behaviors, such as traffic surges, abnormal connection requests, etc., and monitor possible network attacks (such as DDoS attacks) or data leaks; 2. User Login Records Content: Record detailed information about the user logging into the system, including login time, IP address, user ID, login status (successful or failed), authentication method, etc. Purpose: Used to detect abnormal login activities, such as failed login attempts, remote logins, unauthorized login attempts, etc. This information helps identify security incidents such as account hijacking and brute force attacks; 3. System Logs Content: Records detailed information about system internal events and operations, including system startup and shutdown, error messages, alerts, service status changes, system configuration modifications, etc. Function: System logs are used to track the operating status and events within the system, which helps diagnose system failures, identify potential security issues (such as configuration errors or abnormal system behavior), and conduct incident response and investigation; 4. Application Logs Content: Records application running events and operations, including application startup and shutdown, error messages, user operation logs, data access records, etc. Purpose: Helps identify abnormal behavior at the application layer, such as application crashes, malicious user behavior, data leaks, etc., providing an in-depth perspective on application security; 5. Security Event Logs Content: Record security-related events and alerts, including intrusion detection system (IDS) and intrusion prevention system (IPS) alerts, malware detection reports, abnormal behavior alerts, etc. Purpose: Provides real-time alerts and detailed information about network security threats, helping security teams respond to and handle security incidents quickly; 6. Device Status Information (DeviceStatusInformation) Content: Record the operating status, configuration changes, performance indicators, etc. of network devices (such as routers, firewalls, switches); Purpose: Helps monitor the health and performance of devices, identifies potential device failures or configuration issues, and prevents security vulnerabilities caused by device failures; 7. Vulnerability Scan Results Content: Record the results of regular vulnerability scans, including the vulnerabilities found, their severity, and repair suggestions; Function: Provides information about potential security vulnerabilities in systems and networks, helps prioritize the repair of high-risk vulnerabilities, and enhances the overall security of the system; 8. Network Behavior Analysis (NBA) Content: Record and analyze the behavior patterns of network traffic, such as normal traffic patterns, data transmission frequency, communication protocol usage, etc. Function: By analyzing network behavior patterns, identifying behaviors that are significantly different from normal patterns, and helping to detect potential attacks or abnormal activities; Summarize Network security monitoring information covers a variety of data types, from network traffic to user activities, system status, application logs, etc.; this information plays a key role in network security management. Through comprehensive analysis of various data, it can effectively identify and respond to potential security threats and protect the security of systems and data. The anomaly score of each behavior is calculated based on its deviation from normal activity data. The calculation expression is as follows: , where Si represents the anomaly score, that is, the anomaly score of the ith behavior, W j represents the weight of the jth feature, reflecting the importance of the feature to anomaly detection, F ij represents the value of the i-th behavior on the j-th feature, represents the normal behavior model prediction value of the jth feature, and m represents the total number of features; Based on the anomaly score, the anomaly detection sensitivity index of the entire system is calculated to evaluate the system's ability to detect abnormal activities. The calculation expression is as follows: , where ADSI represents the anomaly detection sensitivity index, n represents the total number of behaviors, and τ adjusts the system's evaluation of different anomaly scores S i The sensitivity of, max(S) represents the maximum value of all anomaly scores; Under the detection window, the calculation expression of the anomaly detection sensitivity index shows that the smaller the value of the anomaly detection sensitivity index, the lower the system's sensitivity to abnormal activities, making it easier to ignore potential security threats. Therefore, when the value of the anomaly detection sensitivity index is smaller, it means that the network security monitoring system lacks vigilance against minor or hidden abnormal behaviors, resulting in an increased probability of abnormal hidden dangers in the remote diagnosis process of the networked medical platform, and the system may not be able to detect security incidents such as attacks or data tampering in time. On the contrary, the larger the value of the anomaly detection sensitivity index, the more sensitive the system is to abnormal behavior detection, and the lower the possibility of security risks, which means that the system can more effectively respond to and prevent potential security risks. The data access rights control index ACRI reflects the strictness of the system's management of user access rights; During the remote diagnosis process of the Internet medical platform, changes in data access control may indeed cause a series of abnormal risks, especially when dealing with sensitive health data. These risks mainly arise from uncontrolled permission management, improper data access and potential malicious behavior; First, changes in data access control may result in unauthorized users accessing sensitive patient information, such as medical records, diagnostic records, and laboratory test results. If the permission control mechanism is no longer strictly allocated, nurses, technicians, or other unrelated users may obtain private data that was originally only available to doctors. Such unauthorized access not only violates the privacy rights of patients, but also may bring potential leakage risks, exposing data to third parties that should not have access. Such improper access will increase the possibility of medical privacy leakage, thereby damaging patients' trust and the reputation of the platform; Secondly, changes in permissions may lead to incorrect medical decisions. If a doctor's access permissions are improperly modified or restricted, the doctor may not be able to obtain the patient's complete medical history, examination results and other key data in a timely manner, which directly affects the accuracy of diagnosis and the formulation of treatment plans. Such incomplete data or delayed access will pose risks to the patient's health, especially in emergency or critical cases. Wrong decisions may lead to irreversible consequences. In addition, loose permission control may also lead to malicious tampering or sabotage. If hackers or insiders obtain higher permissions, they may tamper with patient data, forge medical records, or modify diagnostic records, thereby posing serious health risks to patients. After obtaining tampered medical data, doctors may make wrong diagnoses or prescribe wrong drugs, threatening the lives of patients. In general, changes in data access rights control will bring significant security risks, which may not only lead to the leakage of sensitive data, but also affect the accuracy of diagnostic decisions, and even cause data tampering and malicious attacks. Therefore, accurate management of permission control is crucial for remote diagnosis of Internet medical platforms and is one of the core elements to ensure platform security and accuracy of diagnosis and treatment. The logic for obtaining the data access permission control index is as follows: Under the detection window, collect and define the permission access matrix P, where the element P rs represents the access permission level of user r to resource s. The dimension of the access matrix is ​​R×S, where R is the total number of users, S is the total number of resources, and the element P rs is one of the elements in the permission access matrix P; Permission levels can be represented by discrete values, such as 0 (no access), 1 (read access), 2 (write access), and 3 (administrative access); Permission level is a method used to describe the scope and degree of access rights a user has to system resources. It is usually expressed as discrete values, each value corresponding to a specific access right. The following are common permission levels and their meanings: 0 (No access): The user does not have any permissions to access or operate the resource. This means that the user cannot view, modify, or perform any operations related to the resource.

[0013] 1 (read access): Users can view and read the contents of a resource, but cannot modify or delete it. For example, users can view the contents of a file, but cannot edit or delete it.

[0014] 2 (write permission): Users can modify the contents of a resource, including adding, editing, and deleting. In addition to viewing a resource, users can also make changes to it. Typically, this permission allows users to update or modify data.

[0015] 3 (Administrative permissions): The user has full control over the resource, including read, write, and delete, as well as other permissions to manage resources (such as configuration permissions, setting permissions, etc.). This permission is usually given to system administrators or users with high-level management responsibilities; The role of permission levels: Control access: By setting permission levels, you can accurately control the access and operation permissions of different users to resources to ensure system security and data integrity; Protect sensitive data: By setting higher permission requirements for sensitive data, the risk of data leakage and abuse can be reduced; Implement hierarchical management: Different permission levels allow the system to implement hierarchical management, and users with different roles can obtain corresponding access rights according to their responsibilities; A statistical model is a mathematical framework used to describe the process of data generation and the regularity behind it. It assumes that data follows a certain probability distribution or law, establishes mathematical equations or functions to explain data changes and predict possible future results. The core of a statistical model is to use known observational data to infer unknown parameters, identify trends, detect anomalies, etc. Statistical models typically consist of three main parts: 1. Random variables: describe the randomness or uncertainty of data; 2. Parameters: control the distribution of data, such as mean, variance, etc.; 3. Error term: represents randomness or noise in the data that cannot be fully explained; For example, in network security, statistical models can be used to analyze network traffic, assuming that normal network behavior conforms to a certain statistical distribution, such as a normal distribution; if new observations deviate significantly from this distribution, it may be abnormal behavior; There are many statistical and machine learning models for modeling normal activity data. The following are some common ones: (1) Gaussian Mixture Model (GMM) Description: Assume that the data is a mixture of multiple Gaussian distributions, each distribution represents a different type of normal behavior; Usage: Used to model normal activity data and detect anomalies by evaluating whether new data points belong to a known Gaussian distribution; (2) Autoregressive Integrated Moving Average (ARIMA) Description: It is a time series model that predicts future values ​​from historical data; Usage: If the actual observed time series data deviates significantly from the normal pattern predicted by the model, it can be judged as abnormal behavior; (3) Support Vector Machine (SVM) Description: Train a classification model on normal activity data to construct a boundary to distinguish normal behavior from potential abnormal behavior; Usage: For a new observation data point, if the point exceeds the classification boundary, it is considered an anomaly; (4) Density Estimation Models Description: Estimate the probability density function of normal activity data; common methods include kernel density estimation (KDE); Usage: If a new data point falls in a low-density area, it is considered an anomaly; (5) Hidden Markov Model (HMM) Description: Used to model data with hidden states and random transition processes, such as user click streams, network connection sequences, etc. Usage: If the observed behavior sequence deviates from the hidden state inferred in the model, it is considered an anomaly; (6) Autoencoder Description: A neural network that learns a low-dimensional representation of data by compressing normal data and reconstructing it back; Usage: Abnormal data will have large errors during reconstruction and thus be identified as abnormal; (7) k-Nearest Neighbors (k-NN) Description: Calculate the distance between a new data point and its nearest \(k\) points, and judge anomalies based on the distance; Usage: If the distance between a new data point and the adjacent normal data points is large, it is considered abnormal; (8) Bayesian Networks Description: Use probabilistic graphical models to represent the dependencies between different variables, and combine prior and posterior probabilities for inference; Usage: Use the Bayesian update rule to determine whether new data deviates from normal activity patterns; 3. Define the scope of abnormal activity data Abnormal activity data refers to data that deviates from normal behavior patterns, usually reflecting atypical, irregular, or even potentially malicious behavior; this type of data can be defined by modeling and comparing normal data, as follows: (1) Behavior that is significantly different from normal data Definition: Abnormal activity data deviates significantly from the statistical characteristics of normal activity data; for example, a user's network traffic pattern suddenly changes significantly, or the server response time suddenly increases significantly; (2) Low probability events Definition: Anomalous activity data has a very low probability of occurrence according to a probability model and usually occurs in the tail region of a statistical distribution; for example, in the case of a Gaussian distribution, data points that are outside of two standard deviations of the mean; (3) Violation of normal sequence or time pattern Definition: In time series, abnormal activity manifests as sudden events or behaviors that cannot be explained by historical data patterns; for example, a server's resource consumption surges in a short period of time, or traffic load suddenly fluctuates abnormally; (4) Unknown or unseen behavior Definition: Anomalous activity data may not belong to any known normal behavior category, for example, in a classification model, a new data point does not belong to any existing normal category; (5) Violation of specific security rules or policies Definition: Abnormal activity may also refer to violations of specific security policies or access control rules; for example, a user logging into a system during an unallowed time period or accessing restricted resources; (6) Relationships or patterns that do not conform to expectations Definition: In relational data or graph structures, unusual activity data may refer to behaviors that are inconsistent with normal association patterns; for example, in a social network, a node suddenly establishes connections with multiple unseen nodes; By using statistical models to model normal activity data, the scope of abnormal activity data can be defined; abnormal data is generally considered to be behavior that deviates from normal statistical patterns, which may appear as values ​​significantly different from normal activity, low-probability events, sudden changes in time series, or violations of security rules; Calculate the imbalanced index of permissions for all users. The calculation expression is as follows: , where E represents the authority distribution imbalance index, D rs It is an element of the permission distribution matrix D, which represents the permission weight of user r to resource s; Calculate the permission control consistency index. The calculation expression is as follows: , where F represents the authority control consistency index, C st It is one of the elements of the permission control consistency index F, indicating the permission consistency between resource s and resource t; The data access permission control index is generated by combining the permission distribution imbalance index E and the permission control consistency index F. The calculation expression is as follows: ACRI= , where ACRI represents the data access permission control index, max(E) represents the theoretical maximum value of the permission distribution imbalance index, and max(F) represents the theoretical maximum value of the permission control consistency index; Under the detection window, the data access permission control index calculation expression shows that the smaller the data access permission control index performance value is, it means that after the abnormal analysis of the permission control information under the detection window, it is found that there are obvious inconsistencies or abnormalities in the permission allocation or control, which usually indicates that there are potential security risks in the system. For example, there may be problems such as over-authorization, inappropriate permission configuration or permission abuse. These problems increase the risk of data leakage, unauthorized access or other abnormalities during the remote diagnosis process. On the contrary, when the performance value of the data access permission control index is larger, it usually indicates that the permission control system is operating normally, the permission allocation and control are relatively consistent, and the probability of abnormal hidden dangers is small; Comprehensively analyze the processed network security monitoring information and authority control information to generate a security assessment index, and use the security assessment index to evaluate the remote diagnosis process of the Internet medical platform; The abnormal detection sensitivity index ADSI and the data access permission control index ACRI after analysis and processing in the remote diagnosis process of the Internet medical platform are used to generate the security assessment index AS, based on the formula: ; In the formula, f1 and f2 are the preset proportional coefficients of the anomaly detection sensitivity index ADSI and the data access permission control index ACDA, respectively, and both f1 and f2 are greater than 0; From the calculation expression of the security assessment index, it can be seen that the smaller the performance value of the anomaly detection sensitivity index generated within the detection window, the smaller the performance value of the data access permission control index, that is, the smaller the security assessment index generated during the remote diagnosis process of the Internet medical platform, the greater the probability of anomalies occurring during the remote diagnosis process of the Internet medical platform; conversely, the larger the performance value of the anomaly detection sensitivity index generated within the detection window, the larger the performance value of the data access permission control index, that is, the larger the security assessment index generated during the remote diagnosis process of the Internet medical platform, the smaller the probability of anomalies occurring during the remote diagnosis process of the Internet medical platform; Compare and analyze the safety assessment index generated during the remote diagnosis process of the Internet medical platform with the pre-set reference threshold of the safety assessment index to determine the operating status of the remote diagnosis of the Internet medical platform and issue early warning information for existing safety hazards; The safety assessment index generated during the remote diagnosis process of the Internet medical platform is compared with the pre-set safety assessment index reference threshold. The analysis results are as follows: If the safety assessment index is greater than or equal to the preset safety assessment index reference threshold, a high-risk data anomaly signal is generated, and an early warning prompt is issued for the high-risk data anomaly signal; If the safety assessment index is less than the preset safety assessment index reference threshold, a low-risk data anomaly signal is generated, and no warning is issued for the low-risk data anomaly signal; If the security assessment index is greater than or equal to the preset security assessment index reference threshold, a high-risk data anomaly signal is generated. When a high-risk data anomaly signal is generated during the remote diagnosis process of the Internet medical platform, it indicates that the probability of anomalies in the remote diagnosis process of the Internet medical platform is greater. An early warning prompt is issued for the high-risk data anomaly signal, notifying relevant staff to maintain the Internet medical platform in a timely manner to prevent the risk of patient privacy leakage; When judging the operation status of the remote diagnosis of the Internet medical platform, collect several security assessment indexes generated in real time during the remote diagnosis process of the Internet medical platform for comprehensive analysis to judge the operation status of the Internet medical platform; When judging the operation status of the remote diagnosis of the Internet medical platform, a number of security assessment indexes generated in real time during the remote diagnosis of the Internet medical platform are collected to establish a data set, and a comprehensive analysis is performed on the several security assessment indexes in the data set; Calculate the average and standard deviation of several safety assessment indexes in the data set, and mark the average and standard deviation of the safety assessment index as AS 平均 and AS 标准 , and the average value of the safety assessment index AS 平均 and the standard deviation of the safety assessment index and AS 标准 The average value of the pre-set safety assessment index reference threshold AS 参考平均 And the standard deviation reference threshold of the safety assessment index AS 参考标准 The comparison results are as follows: If AS 平均 ≥AS 参考平均 , then an early warning signal is generated. When an early warning signal is generated, it indicates that an abnormality has occurred during the operation of the remote diagnosis of the Internet medical platform, and the system needs to be inspected and maintained; like , indicating that the remote diagnosis of the Internet medical platform is unstable during operation, and the operation is sometimes good and sometimes bad, which generates an unstable signal, and the system also needs to be checked and maintained; like , indicating that the remote diagnosis operation of the Internet medical platform is in a stable state, generating a stable operation signal, indicating that the system is running normally and no intervention is required; The present invention can monitor the system status in real time at each step of the diagnosis process by acquiring the network security monitoring information and permission control information generated during the remote diagnosis process of the Internet medical platform, especially the abnormal detection sensitivity index and the data access permission control index. By generating a comprehensive security assessment index and comparing it with a preset reference threshold, the system operation status can be quickly and accurately judged. When the security assessment index exceeds the preset threshold, the system will generate a high-risk data anomaly signal and issue an early warning, prompting the system administrator to intervene and maintain, thereby preventing the potential privacy leakage problem from further expanding. This real-time monitoring and early warning mechanism effectively improves the system's sensitivity to abnormal detection, can identify high-risk problems that may lead to patient privacy leakage in advance, and ensures the operational safety of the platform.

[0016] The present invention collects several safety assessment indexes generated in real time during the remote diagnosis process, establishes a data set, and calculates the average value and standard deviation to more carefully evaluate the stability of the system. If the average value and standard deviation of the safety assessment index are significantly deviated from the set reference threshold, the system will generate an early warning signal or an instability signal, indicating that there is instability or abnormality in the operation of the system. Through this method, the platform can more accurately identify situations where the system is in an unstable state or operating abnormally, and issue maintenance recommendations in a timely manner. This system status analysis method helps optimize maintenance strategies, which not only reduces the risk of patient privacy leakage, but also improves the overall operating efficiency and stability of the system, and ensures the reliability and security of telemedicine services.

[0017] The present invention provides Figure 2 A remote video transmission system of an Internet medical platform is shown, comprising a data acquisition module, a comprehensive analysis module, a hidden danger perception module, an early warning module and a feedback module; The data acquisition module obtains various parameter information generated during the remote diagnosis process of the Internet medical platform, including network security monitoring information and authority control information, and processes the network security monitoring information and authority control information; The comprehensive analysis module comprehensively analyzes the processed network security monitoring information and authority control information, generates a security assessment index, and uses the security assessment index to evaluate the remote diagnosis process of the Internet medical platform; The hidden danger perception module compares and analyzes the safety assessment index generated during the remote diagnosis of the Internet medical platform with the pre-set reference threshold of the safety assessment index, determines the operation status of the remote diagnosis of the Internet medical platform, and issues early warning information on existing safety hazards through the early warning module; The feedback module collects several security assessment indexes generated in real time during the remote diagnosis process of the Internet medical platform for comprehensive analysis to determine the operating status of the Internet medical platform. The remote video transmission method of an Internet medical platform provided in an embodiment of the present invention is implemented by the remote video transmission system of the Internet medical platform described above. The specific method and process of the remote video transmission system of an Internet medical platform are detailed in the embodiment of the remote video transmission method of the Internet medical platform described above, which will not be repeated here. The above only describes certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, a person skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the above drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

Claims

1. A remote video transmission method for an Internet medical platform, comprising the following steps: Obtain various parameter information generated during the remote diagnosis process of the Internet medical platform, including network security monitoring information and authority control information, and process the network security monitoring information and authority control information; Comprehensively analyze the processed network security monitoring information and authority control information to generate a security assessment index, and use the security assessment index to evaluate the remote diagnosis process of the Internet medical platform; Compare and analyze the safety assessment index generated during the remote diagnosis process of the Internet medical platform with the pre-set reference threshold of the safety assessment index to determine the operating status of the remote diagnosis of the Internet medical platform and issue early warning information for existing safety hazards; When judging the operating status of the remote diagnosis of the Internet medical platform, several security assessment indexes generated in real time during the remote diagnosis process of the Internet medical platform are collected for comprehensive analysis to judge the operating status of the Internet medical platform.

2. The remote video transmission method of an Internet medical platform according to claim 1, characterized in that: The acquired network security monitoring information and permission control information include an anomaly detection sensitivity index and a data access permission control index, respectively, and the anomaly detection sensitivity index and the data access permission control index are calibrated as ADSI and ACRI, respectively.

3. The remote video transmission method of an Internet medical platform according to claim 2, characterized in that: The abnormal detection sensitivity index ADSI and the data access permission control index ACRI after analysis and processing in the remote diagnosis process of the Internet medical platform are used to generate the security assessment index AS, based on the formula: ; In the formula, f1 and f2 are the preset proportional coefficients of the anomaly detection sensitivity index ADC and the data access permission control index ACDA, respectively, and both f1 and f2 are greater than 0.

4. The remote video transmission method of an Internet medical platform according to claim 2, characterized in that: Under the detection window, network security monitoring information is collected, features are extracted from the collected network security monitoring information, normal activity data is modeled using a statistical model, and the range of abnormal activity data is defined; The anomaly score of each behavior is calculated based on its deviation from normal activity data. The calculation expression is as follows: , where S i represents the anomaly score, that is, the anomaly score of the ith behavior, W j represents the weight of the jth feature, reflecting the importance of the feature to anomaly detection, F ij represents the value of the i-th behavior on the j-th feature, represents the normal behavior model prediction value of the jth feature, and m represents the total number of features; Based on the anomaly score, the anomaly detection sensitivity index of the entire system is calculated to evaluate the system's ability to detect abnormal activities. The calculation expression is as follows: , where ADSI represents the anomaly detection sensitivity index, n represents the total number of behaviors, and τ adjusts the system's evaluation of different anomaly scores S i The sensitivity of the anomaly score is , and max(S) represents the maximum value of all anomaly scores.

5. The remote video transmission method of an Internet medical platform according to claim 2, characterized in that: Under the detection window, collect and define the permission access matrix P, where the element P rs represents the access permission level of user r to resource s. The dimension of the access matrix is ​​R×S, where R is the total number of users, S is the total number of resources, and the element P rs is one of the elements in the permission access matrix P; Calculate the imbalanced index of permissions for all users. The calculation expression is as follows: , where E represents the authority distribution imbalance index, D rs It is an element of the permission distribution matrix D, which represents the permission weight of user r to resource s; Calculate the permission control consistency index. The calculation expression is as follows: , where F represents the authority control consistency index, C st It is one of the elements of the permission control consistency index F, indicating the permission consistency between resource s and resource t; The data access permission control index is generated by combining the permission distribution imbalance index E and the permission control consistency index F. The calculation expression is as follows: ACRI= , where ACRI represents the data access permission control index, max(E) represents the theoretical maximum value of the permission distribution imbalance index, and max(F) represents the theoretical maximum value of the permission control consistency index.

6. The remote video transmission method of an Internet medical platform according to claim 3, characterized in that: The safety assessment index generated during the remote diagnosis process of the Internet medical platform is compared with the pre-set safety assessment index reference threshold. The analysis results are as follows: If the safety assessment index is greater than or equal to the preset safety assessment index reference threshold, a high-risk data anomaly signal is generated, and an early warning prompt is issued for the high-risk data anomaly signal; If the safety assessment index is less than the preset safety assessment index reference threshold, a low-risk data anomaly signal is generated, and no warning prompt is issued for the low-risk data anomaly signal.

7. The remote video transmission method of an Internet medical platform according to claim 1, characterized in that: When judging the operation status of the remote diagnosis of the Internet medical platform, a number of security assessment indexes generated in real time during the remote diagnosis of the Internet medical platform are collected to establish a data set, and a comprehensive analysis is performed on the several security assessment indexes in the data set; Calculate the average and standard deviation of several safety assessment indexes in the data set, and mark the average and standard deviation of the safety assessment index as AS 平均 and AS 标准 , and the average value of the safety assessment index AS 平均 and the standard deviation of the safety assessment index and AS 标准 The average value of the pre-set safety assessment index reference threshold AS 参考平均 and the standard deviation reference threshold of the safety assessment index AS 参考标准 The comparison results are as follows: If AS 平均 ≥AS 参考平均 , then an early warning signal is generated. When an early warning signal is generated, it indicates that an abnormality has occurred during the operation of the remote diagnosis of the Internet medical platform, and the system needs to be inspected and maintained; like , indicating that the remote diagnosis of the Internet medical platform is unstable during operation, and the operation is sometimes good and sometimes bad, which generates an unstable signal, and the system also needs to be checked and maintained; like , indicating that the remote diagnosis operation of the Internet medical platform is in a stable state and generates a stable operation signal, indicating that the system is running normally and no intervention is required.

8. A remote video transmission system for an Internet medical platform, used to implement a remote video transmission method for an Internet medical platform as described in any one of claims 1 to 7, characterized in that: It includes data collection module, comprehensive analysis module, hidden danger perception module, early warning module and feedback module; The data acquisition module obtains various parameter information generated during the remote diagnosis process of the Internet medical platform, including network security monitoring information and authority control information, and processes the network security monitoring information and authority control information; The comprehensive analysis module comprehensively analyzes the processed network security monitoring information and permission control information, generates a security assessment index, and uses the security assessment index to evaluate the remote diagnosis process of the Internet medical platform; The hidden danger perception module compares and analyzes the safety assessment index generated during the remote diagnosis of the Internet medical platform with the pre-set reference threshold of the safety assessment index, determines the operation status of the remote diagnosis of the Internet medical platform, and issues early warning information on existing safety hazards through the early warning module; The feedback module collects several security assessment indexes generated in real time during the remote diagnosis process of the Internet medical platform for comprehensive analysis to determine the operating status of the Internet medical platform when judging the operating status of the remote diagnosis of the Internet medical platform.

Images