Medical data abnormal access identification method and system

Abstract

The invention relates to the technical field of medical data security, in particular to a medical data abnormal access identification method and system. Firstly, a user ID and an access log are collected to provide a behavior analysis basis, then a new user is endowed with initial credibility based on historical credibility of a group to which the new user belongs and jumps to permission setting, and an old user carries out vectorization on current and historical access data and calculates a fitting degree; constructing a three-dimensional evaluation vector in combination with data importance, access duration and fitness, calculating initial credibility by using a density function, finally matching a dynamic update model according to a fitness range, mapping the credibility into an intelligent contract control interval, automatically intercepting a hyper-permission request, and realizing fine-grained real-time permission control and abnormal access accurate interception. The technical problems that a traditional medical data access control technology lacks a fine-grained trust evaluation mechanism, is difficult to dynamically adapt to the complexity of an access behavior, and is easy to cause abnormal access recognition lag are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of medical data security, and in particular to a method and system for identifying abnormal access to medical data. Background Art

[0002] Traditional medical data access control technologies mostly adopt a centralized management mode, often based on static rules or simple historical behavior to evaluate user permissions, and cannot dynamically adapt to the complexity of access behaviors. For example, although the traditional ABAC model can authorize through attributes, it does not combine real-time behavior analysis, resulting in a lag in the identification of abnormal access (such as frequent requests for highly sensitive data within a short period of time), and lacks a fine-grained trust evaluation mechanism. For example, over-reliance on doctor ratings or fixed weights (such as the FWZIC method, although it solves the problem of weight inconsistency, does not integrate dynamic behavior data), it is difficult to accurately quantify user intentions. In addition, the existing solutions initialize the credibility of new users simply and roughly, often using fixed thresholds or random assignments, without considering group behavior characteristics (such as the historical credibility of doctors in the department to which the new user belongs), which is prone to misjudgment or abuse of permissions. Summary of the Invention

[0003] Aiming at the deficiencies of the prior art, the present invention provides a method and system for identifying abnormal access to medical data, which solves the technical problems in traditional medical data access control technologies, such as the lack of a fine-grained trust evaluation mechanism, difficulty in dynamically adapting to the complexity of access behaviors, and easy lag in the identification of abnormal access.

[0004] To solve the above technical problems, the present invention provides the following technical solutions: A method for identifying abnormal access to medical data, which is used for a blockchain platform for sharing medical data, and the method includes the following steps: S1. Obtain the user ID making the data request and the access log, where the access log includes the medical data and access duration of each user access; S2. Determine whether the current user is a new user; If so, assign credibility to the current user and enter step S6; If not, enter step S2; S3. Vectorize the medical data of this access and the historical access medical data, and calculate the degree of fit between the two; S4. Set the importance of each medical data, and calculate the initial credibility of the user's this access according to the degree of fit, access duration of each access, and the mean value of the importance of the accessed data; S5. Set several degree-of-fit ranges and corresponding credibility update models, select the corresponding credibility update model according to the degree of fit of the user's this access, and substitute the initial credibility and degree of fit to update the user's credibility; S6. Set up the smart contract according to the credibility, and identify abnormal access requests based on the user's current credibility.

[0005] Preferably, in step S2, the specific method for assigning credibility to the user specifically includes the following steps: S21. Divide all users into several user groups, and mark the user group to which the current user belongs as the characteristic group; S22. Obtain the credibility of all users within the characteristic group, and set several continuous credibility intervals between 0 and 1; S23. Count the number of credibility values contained in each credibility interval, and select several credibility intervals with the largest number of credibility values and mark them as standard credibility intervals; S24. Calculate the average value of the median of each standard credibility interval as the credibility of the current user.

[0006] Preferably, in step S3, it specifically includes the following steps: S31. Number all medical data; S32. Obtain the numbers of all medical data that the user has accessed according to the user's access log, and arrange them in order to establish an access set; S33. According to the access set, mark the medical data that the user has accessed during this access as 1, and mark the medical data that has not been accessed during this access as 0, so as to generate the current access vector for this access; S34. According to the access set, mark the medical data that the user has accessed during historical access as 1, and mark the medical data that has not been accessed historically as 0, so as to generate a historical access vector; S35. Count the number of medical data numbers marked as 1 in both the current access vector and the historical access vector ; S36. Count the numbers of 0 and 1 marked for the same medical data number in the current access vector and the historical access vector respectively , and the numbers of 1 and 0 marked for the same medical data number in the current access vector and the historical access vector respectively ; S37. Calculate the degree of fit between the medical data accessed by the user this time and the medical data accessed historically; the calculation formula for the degree of fit is: ; In the above formula, represents the degree of fit between the medical data accessed by the user this time and the medical data accessed historically.

[0007] Preferably, in step S32, it specifically includes the following steps: S321. Obtain the medical data that all users within the characteristic group corresponding to the user have accessed according to the access logs of each user; S322. Count the number of users who have accessed each medical data within the characteristic group; S323. Set a threshold for the number of users, obtain the medical data with the number of users less than the threshold for the number of users, and mark it as data to be screened; S324. Exclude the medical data that the current user has accessed during this visit from the data to be screened to obtain the data to be excluded; S325. Obtain all the medical data that the user has accessed according to the user's access log, and exclude the data to be excluded from it to obtain the standard medical data; S326. Arrange the numbers of the standard medical data in sequence to establish an access set.

[0008] Preferably, in step S4, it specifically includes the following steps: S41. Set the importance of each medical data, and calculate the average value of the importance of each medical data during each user visit to obtain the importance mean value; Preferably, the setting of the importance of each medical data specifically includes the following steps: S411. Set several importance evaluation criteria, obtain the first importance scoring values of each doctor for each evaluation criterion, and construct a first scoring matrix; the expression of the first scoring matrix is: ; In the above formula, Score represents the scoring matrix, represents the first importance scoring value of the m-th doctor for the n-th evaluation criterion; S412. Extract the upper limit value, lower limit value of the set first importance scoring value, and the average value of the upper limit value and the lower limit value; S413. Convert the first scoring matrix into a second scoring matrix; the expression of the second scoring matrix is: ; Among them, ; In the above formula, represents the second scoring matrix, represents the second importance scoring value of the m-th doctor for the n-th evaluation criterion, , and respectively represent the upper limit value, lower limit value of the first importance scoring value, and the average value of the upper limit value and the lower limit value, represents the conversion function that converts the independent variable x, that is, the first importance scoring value, into the second importance scoring value; S414. Normalize each second importance score value according to the second scoring matrix. The normalization calculation formula is: ; In the above formula, and respectively represent the second importance score value of the m-th doctor for the n-th evaluation criterion after and before normalization. represents the second importance score value of the k-th doctor for the n-th evaluation criterion before normalization, and there are n doctors in total. S415. Calculate the average importance score value of all doctors for each evaluation criterion after normalization according to the second importance score values of each doctor for each evaluation criterion before normalization. The calculation formula for the average importance score value is: ; In the above formula, represents the average importance score value of the n-th evaluation criterion. represents the second importance score value of the k-th doctor for the n-th evaluation criterion after normalization. S416. Obtain the evaluation scores of each doctor for the importance evaluation criteria of each medical data. S417. Calculate the importance of each medical data according to the evaluation scores of each doctor for the importance evaluation criteria of each medical data and the importance evaluation criteria after normalization. The calculation formula for the importance of medical data is: ; In the above formula, represents the importance of each medical data. represents the q-th importance evaluation criterion. represents the evaluation score of the F-th doctor for this medical data.

[0009] S42. Construct an evaluation vector for each visit according to the visit duration, fitting degree, and importance mean value of each visit. The expression of the evaluation vector is: ; In the above formula, represents the evaluation vector. represents the visit duration of each visit. represents the fitting degree. represents the importance mean value. S43. Calculate the similarity between the evaluation vector of the user's current visit and the evaluation vectors of each visit within a certain period of time from now. The calculation formula for the similarity is: ; In the above formula, Indicates the similarity between the evaluation vector of the user's current visit and the evaluation vector of the i-th visit. Indicates the evaluation vector of the user's current visit. Indicates the evaluation vector of the user's i-th visit; S44. Construct a statistical interval with the minimum and maximum values among all similarities; the expression of the statistical interval is: , where and respectively represent the minimum and maximum values of the statistical interval; S45. Construct a density function to calculate the density value of any similarity within the statistical interval; the expression of the density function is: ; In the above formula, M represents the density value, represents any similarity within the statistical interval, represents the similarity between the evaluation vectors of the user's current visit and the i-th visit, represents a constant, represents a function negatively correlated with the independent variable , and there are n visits in total; S46. Obtain the similarity with the maximum density value as the initial credibility of the user's current visit.

[0010] Preferably, in step S5, it specifically includes the following steps: S51. Set several consecutive fitting degree ranges within the numerical interval from 0 to 1, and determine the fitting degree range corresponding to the fitting degree of the user's current visit; S52. Set an inhibition factor negatively correlated with the distance between the maximum value in the fitting degree range and 0; S53. Count the number of failed requests of the user during this visit; S54. Construct a credibility update model for the user and update the user's credibility to be used as the credibility for the user's next visit. The expression of the credibility update model is: ; In the above formula, represents the updated credibility of the user, represents the initial credibility, represents the fitting degree of the user's current visit, represents the fitting degree of the i-th visit, and there are n visits in total, represents the request failure factor, which is positively correlated with the number of failed requests of the user during this visit, represents the inhibition factor of the k-th fitting degree range, represents the sensitivity factor, and c represents the cooperation factor.

[0011] Preferably, in step S54, the method for setting the collaboration factor is as follows: S541. Obtain the collaboration access data of each user and other users within the feature group where the user is located. The collaboration access data includes the timestamp of each collaboration access and the context type of the collaboration. The context type is divided into several categories according to the sensitivity of medical data; S542. Calculate the collaboration times weight of the user according to the collaboration access data. The calculation formula for the collaboration times weight is: ; In the above formula, represents the collaboration times weight after aging attenuation when the context of the user's collaboration with the i-th collaboration object is the k-th context type, represents the total number of collaborations within a certain time when the context of the user's collaboration with the i-th collaboration object is the k-th context type, represents the attenuation rate coefficient of the k-th context type, represents the current timestamp, represents the timestamp when the i-th collaboration behavior occurred; S543. Set the context weight according to the importance of medical data. The calculation formula for the context weight is: ; In the above formula, represents the context weight of the context type k, represents the average importance of the medical data of the k-th context type, represents the average importance of the j-th context type, and H represents the total number of context types; S544. Calculate the extended credibility of the user's collaboration object. The calculation formula for the extended credibility is: ; In the above formula, represents the extended credibility of the i-th collaboration object, represents the current credibility of the i-th collaboration object, represents the current credibility of the j-th collaboration object, represents the set of collaboration objects that have a collaboration behavior with the user, represents the number of collaboration objects that have a collaboration behavior with the user, represents the credibility weight of the collaboration object itself; S545. Calculate the collaboration factor according to the collaboration times weight of the user, the extended credibility of the collaboration object, and the context weight. The calculation formula for the collaboration factor is: ; In the above formula, represents the collaboration factor, represents the collaboration coefficient of the k-th context type, represents the smoothing constant, and there are M collaboration objects in total.

[0012] Preferably, in step S6, it specifically includes the following steps: S61. Obtain all operation behaviors that the user can perform; S62. Divide the credibility range of 0-1 into several continuous control intervals; S63. Corresponding different operation behaviors to at least one control interval respectively to establish a smart contract; S64. Obtain the current operation behavior request of the user; S65. Determine whether the operation behavior request is within the corresponding control interval; If so, allow the operation behavior request of the user; If not, block the operation behavior request of the user and mark it as an abnormal access request.

[0013] A medical data abnormal access recognition system includes a processor and a memory. The memory is used to store a computer program, and when the computer program is executed by the processor, the medical data abnormal access recognition method described above is implemented.

[0014] With the above technical solutions, the present invention provides a medical data abnormal access recognition method and system, which at least have the following beneficial effects: 1. The present invention first collects the user ID and access logs to provide a basis for behavior analysis, and then enables new users to be given an initial credibility based on the historical credibility of the group they belong to and jump to the permission setting, avoiding the blindness of traditional random weighting. Old users quantify the current and historical access data and calculate the fitting degree, quantify the behavior continuity to capture abnormal offsets, and then construct a three-dimensional evaluation vector by combining data importance, access duration and fitting degree, calculate the initial credibility using the density function, and finally match and dynamically update the model according to the fitting degree range. Finally, map the credibility to the smart contract control interval to automatically intercept requests exceeding the permissions, realizing fine-grained real-time permission control and accurate interception of abnormal access, effectively improving the security and credibility of the medical data sharing platform.

[0015] 2. The present invention constructs a three-dimensional evaluation vector through multi-dimensional behavior analysis of the fitting degree, access duration, and mean value of data importance, and introduces a density function to calculate the initial credibility, breaking through the limitations of traditional static thresholds or linear models. The fitting degree calculation combines the statistical weights of the coincidence degree (N11), new access (N10), and historical unaccessed (N01) of the user's historical access data, dynamically reflecting the behavior consistency.

[0016] 3. The density function of the present invention extracts the density center based on the historical similarity distribution, avoiding accidental deviations, ensuring robust credibility evaluation, and combining with the real-time update mechanism of the blockchain, the credibility is dynamically adjusted with each access, effectively identifying short-term high-frequency anomalies, such as sudden bulk requests for sensitive data. Compared with traditional methods, it significantly improves the evaluation accuracy and supports real-time parsing of complex behavior patterns.

[0017] 4. Based on the fitting degree deviation detection and failed request statistics, the system of the present invention constructs a dual anomaly recognition model. When the fitting degree is lower than the threshold, the suppression factor automatically amplifies the amplitude of credibility decay. If the number of failed requests for a single access exceeds the preset number, the failure factor further reduces the credibility. The smart contract monitors user requests in real time. When a user with low credibility attempts a high-risk operation (such as exporting encrypted medical records), the system intercepts and marks the anomaly within a certain time, such as 50 ms, and at the same time can trigger the alarm log to be stored on the chain for evidence.

[0018] 5. For new users, the system classifies them into characteristic groups through cluster analysis, and statistically analyzes the historical credibility distribution within the group, and selects the median mean of the high-frequency credibility interval as the initial value. This method avoids the permission imbalance caused by traditional random weighting or subjective scoring, enables new users to obtain reasonable data access permissions while being restricted by group behavior, reduces the initial permission misjudgment rate by 40%, and significantly reduces the problems of "over-authorization" or "insufficient permissions". BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and form a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation of the present application. In the drawings: Figure 1 is a flowchart of the method for identifying abnormal access to medical data of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] In order to make the above objects, features, and advantages of the present invention more obvious and understandable, the present invention will be further described in detail below with reference to the drawings and specific embodiments. Thereby, a full understanding of how the present application uses technical means to solve technical problems and achieve technical effects can be obtained and implemented accordingly.

[0021] In order to solve the technical problems in the traditional medical data access control technology, such as the lack of a fine-grained trust evaluation mechanism, it is difficult to dynamically adapt to the complexity of access behaviors, and it is easy to cause a lag in the identification of abnormal access, the present invention provides a method for identifying abnormal access to medical data, which is used for a blockchain platform for sharing medical data, such as Figure 1 shown, by using a smart contract in combination with dynamic credibility calculation and real-time updating of user permissions, the accuracy of abnormal access detection is improved. The method for identifying abnormal access specifically includes the following steps: S1. Obtain the user ID for data requests and the access logs of this user from the blockchain. The access logs include the medical data of each user access and the access duration of each access. The user is generally a doctor, and data sharing is realized to help doctors treating patients obtain more comprehensive medical data of patients.

[0022] S2. Determine whether the current user is a new user, that is, whether it is a user who is accessing for the first time; If so, assign credibility to the current user, so as to facilitate the subsequent establishment of smart contracts to identify the access behavior of new users, and enter step S6; If not, enter step S2; The traditional method of setting credibility simply and roughly initializes the trust value of new users. It often uses fixed thresholds or random assignments, without considering group behavior characteristics (such as the historical credibility of doctors in the department to which the new user belongs), which is prone to misjudgment or abuse of permissions. Therefore, in the present invention, the specific method of assigning credibility to users specifically includes the following steps: S21. Divide all users into several user groups, and mark the user group to which the current user belongs as the characteristic group. Each user group can be all doctors in a hospital, or all doctors in each department of the hospital, etc.; S22. Obtain the credibility of all users within the characteristic group, and set several continuous credibility intervals between 0 and 1. For example, the credibility intervals can be set as . And Three consecutive credibility intervals.

[0023] S23. Count the number of credibility values contained in each credibility interval, and select several credibility intervals with the largest number of credibility values and mark them as standard credibility intervals. S24. Calculate the average of the medians of each standard credibility interval and use it as the credibility of the current user. For example, for the . And Three consecutive credibility intervals given above, whose medians are 0.2, 0.6, and 0.9 respectively. If the selected standard credibility intervals are And , then the average of the medians of the standard credibility intervals is .

[0024] This method of assigning credibility to the current user is for the situation after the user identity verification is passed. If an abnormality is found during the identity verification process, the initial credibility can also be set manually through the background. For example, for suspicious personnel who temporarily need to apply for an account, a lower credibility can be set.

[0025] S3. Vectorize the medical data of this visit and the medical data of historical visits, and calculate the degree of fit between the two. To further describe the methods of vectorizing medical data and calculating the degree of fit, in step S3, it specifically includes the following steps: S31. Number all the medical data. For example, number each medical data with Arabic numerals to unify the unique identifier of the medical data, eliminate data ambiguity, provide a standardized basis for vectorization, and avoid dimension conflicts caused by chaotic data naming; S32. Obtain the numbers of all the medical data that the user has visited according to the user's access log, and arrange them in order to establish an access set, establishing a standardized access set. However, there may be a large amount of noise data in the access set. For example, a certain user makes a specific operation behavior request due to a misoperation, and it needs to be eliminated. The following provides a method for eliminating noise data based on group medical data, which specifically includes the following steps: S321. According to the access logs of each user, obtain all the medical data that have been visited by all the users within the characteristic group corresponding to the user. Based on the characteristic group to which the user belongs (such as department or role), extract the historical visited medical data of all the users within the group, avoid one-sidedness caused by relying only on individual behaviors, and enhance the group representativeness of the access set.

[0026] S322. Count the number of users who have visited each medical data within the characteristic group, count the total number of users who have visited each medical data within the group, identify high-frequency common data and low-frequency marginal data, and provide a quantitative basis for subsequent screening.

[0027] S323. Set a user number threshold, obtain the medical data with the number of users less than the user number threshold, and mark them as data to be screened, eliminating low-frequency noise (such as rare medical records or abnormal test records), and reducing the interference of irrelevant data on the calculation of the degree of fit.

[0028] S324. Eliminate the medical data that the current user has visited during this visit from the data to be screened to obtain the data to be eliminated, prevent the access set from losing the actual behavior characteristics of the user due to excessive elimination, and ensure the accuracy and integrity of data screening.

[0029] S325. Obtain all the medical data that the user has visited according to the user's access log, and eliminate the data to be eliminated from it to obtain the standard medical data, generating standard medical data that only contains the high-frequency data of the user group and the actual access records of the user, balancing group commonality and individual specificity, and improving the reliability of subsequent analysis.

[0030] S326. Arrange the numbers of the standard medical data in order to establish an access set.

[0031] S33. According to the access set, mark the medical data that has been accessed during the user's current visit as 1, and mark the medical data that has not been accessed during the current visit as 0, so as to generate the current access vector for this visit; S34. According to the access set, mark the medical data that has been accessed during the user's historical visits as 1, and mark the medical data that has not been accessed historically as 0, so as to generate a historical access vector. Through steps S33 and S34, unique current and historical access vectors are generated, realizing a clear expression of the access status and providing a structured input for statistical calculations.

[0032] S35. Count the number of medical data numbers that are marked as 1 in both the current access vector and the historical access vector ; S36. Count the number of times the same medical data number is marked as 0 and 1 respectively in the current access vector and the historical access vector , and count the number of times the same medical data number is marked as 1 and 0 respectively in the current access vector and the historical access vector ; S37. Calculate the degree of fit between the medical data of the user's current visit and the medical data of historical visits; the calculation formula for the degree of fit is: ; In the above formula, represents the degree of fit between the medical data of the user's current visit and the medical data of historical visits. Through the data obtained by statistics , and , to comprehensively capture the continuity and deviation characteristics of the user's behavior pattern. Through the data both emphasizes positive consistency, and through the data accommodates the continuity of historical behaviors, and through the data identifies abnormal user behaviors, making the degree of fit have both stability and sensitivity to abnormal identification, and more accurately reflecting the correlation strength between the user's behavior and historical behaviors.

[0033] S4. Set the importance of each medical data, that is, the confidentiality level or privacy level of the medical data, etc., and calculate the initial credibility of the user's current visit according to the degree of fit, visit duration, and average importance of the accessed data for each visit, so as to facilitate subsequent credibility updates through a dynamic initial credibility calculation method. Specifically, it includes the following steps: S41. Set the importance of each medical data, and calculate the average value of the importance of each medical data when the user visits each time to obtain the average importance value. Setting the importance of each medical data specifically includes the following steps: S411. Set several importance evaluation criteria, obtain the first importance scoring values of each doctor for each evaluation criterion, construct the first scoring matrix, collect the original scores of different doctors for each importance evaluation criterion, and form an initial data matrix. Provide basic data for subsequent quantification of the importance of medical data through multi-dimensional expert opinions. The expression of the first scoring matrix is: ; In the above formula, Score represents the scoring matrix, represents the first importance scoring value of the m-th doctor for the n-th evaluation criterion; S412. Extract and set the upper limit value, lower limit value, and the average value of the upper limit value and the lower limit value of the first importance scoring value to facilitate subsequent elimination of differences in opinions among doctors and unify opinions through the second scoring matrix; S413. Convert the scoring matrix into a second scoring matrix; the expression of the second scoring matrix is: ; Among them, ; In the above formula, represents the second scoring matrix, represents the second importance scoring value of the m-th doctor for the n-th evaluation criterion, , and respectively represent the upper limit value, lower limit value, and the average value of the upper limit value and the lower limit value of the first importance scoring value, represents the conversion function that converts the independent variable x, i.e., the first importance scoring value, into the second importance scoring value; S414. Normalize each second importance scoring value according to the second scoring matrix, eliminate the dimension difference, make the weight distribution of each evaluation criterion more balanced, and avoid some criteria dominating the result due to a large scoring range; the normalization calculation formula is: ; In the above formula, and respectively represent the second importance scoring value of the m-th doctor for the n-th evaluation criterion after and before normalization, represents the second importance scoring value of the k-th doctor for the n-th evaluation criterion before normalization, and there are n doctors in total; S415. According to the second importance scoring values of each doctor for each evaluation criterion before normalization, calculate the average importance scoring values of all doctors for each evaluation criterion after normalization, obtain the consensus of the group on the importance of each evaluation criterion, and reflect the priority of overall medical data management; the calculation formula of the average importance scoring value is: ; In the above formula, represents the average importance score value of the nth evaluation criterion, represents the second importance score value of the kth doctor for the nth evaluation criterion after normalization; S416. Obtain the evaluation scores of each doctor for the importance evaluation criteria of each medical data; S417. Calculate the importance of each medical data according to the evaluation scores of each doctor for the importance evaluation criteria of each medical data and the normalized importance evaluation criteria; The calculation formula for the importance of medical data is: ; In the above formula, represents the importance of each medical data, represents the qth importance evaluation criterion, represents the evaluation score of the Fth doctor for this medical data.

[0034] By means of expert scoring, standardization, normalization and weighted calculation, the importance of medical data is dynamically quantified to ensure that the system gives priority to protecting highly sensitive data in permission control, while avoiding subjective scoring deviation and improving the accuracy of abnormal access recognition.

[0035] S42. Construct an evaluation vector for each access according to the access duration, fit degree and importance mean value of each access; The expression of the evaluation vector is: ; In the above formula, represents the evaluation vector, represents the access duration of each access, represents the fit degree, represents the importance mean value, so as to establish an evaluation vector from three perspectives as a reference data source for subsequent calculation of the initial credibility to achieve refined and dynamic calculation of the credibility; S43. Calculate the similarity between the evaluation vector of the user's current access and the evaluation vectors of each access within a period of time from now; The calculation formula for the similarity is: ; In the above formula, represents the similarity between the evaluation vector of the user's current access and the evaluation vector of the ith access, represents the evaluation vector of the user's current access, represents the evaluation vector of the user's ith access; S44. Calculate the density centers of all similarities to obtain the initial credibility of the user's current visit. There are multiple calculation methods for the density center of a set of data. Here, a new calculation method for the density center is provided to obtain a more refined updated initial credibility. The specific steps are as follows: S441. Construct a statistical interval with the minimum and maximum values among all similarities. The expression for the statistical interval is: , where and represent the minimum and maximum values of the statistical interval respectively; S442. Construct a density function to calculate the density value of any similarity within the statistical interval. The expression for the density function is: ; In the above formula, M represents the density value, represents any similarity within the statistical interval, represents the similarity between the user's current visit and the evaluation vector of the i-th visit, represents a constant, represents a function negatively correlated with the independent variable , and there are n visits in total; S443. Obtain the similarity with the maximum density value as the initial credibility of the user's current visit, that is, the level of behavioral consistency most frequently exhibited by the user. This measure avoids accidental deviations of single high or low similarities, ensures that the credibility initialization is based on the user's historical behavior patterns, and more scientifically extracts the initial credibility through density values, enhancing the robustness and interpretability of the evaluation.

[0036] S5. Set several fitness ranges and corresponding credibility update models, select the corresponding credibility update model according to the fitness of the user's current visit, and substitute the initial credibility and fitness to update the user's credibility. To achieve dynamic update of credibility and ensure sensitivity to user behavior during the update process to more scientifically reflect the user's credibility, an adaptive credibility update mechanism is constructed. The specific steps are as follows: S51. Set several continuous fitness ranges within the numerical interval from 0 to 1, and determine the fitness range corresponding to the fitness of the user's current visit; S52. Set an inhibition factor negatively correlated with the distance between the maximum value in the fitness range and 0, so that according to the user's fitness, the inhibition factor in the high fitness range approaches 0, and the inhibition factor in the low fitness range approaches 1, thereby dynamically controlling the amplitude of credibility update and avoiding excessive punishment for highly consistent behaviors or lenient tolerance for low - consistency behaviors.

[0037] S53. Count the number of failed requests during this user visit to facilitate quantifying the penalty caused by the user's abnormal operations in subsequent calculations.

[0038] S54. Construct a user credibility update model and update the user's credibility as the credibility for the user's next visit. The expression of the credibility update model is: ; In the above formula, represents the updated user credibility, represents the initial credibility, represents the fitness of this user visit. The setting of R in the denominator can greatly improve the sensitivity of the model to fitness, efficiently identify visits with low fitness, and improve the sensitivity to identifying abnormal behaviors. There are a total of n visits, represents the request failure factor, which is positively correlated with the number of failed requests during this user visit, represents the suppression factor for the k-th fitness range, represents the sensitivity factor, c represents the collaboration factor, thus realizing the elastic update of credibility - high-fitness visits enhance trust accumulation, low-fitness or high-failure visits trigger trust decay, thereby accurately capturing abnormal behavior characteristics, overcoming the problem of poor adaptability of traditional static threshold or linear update models to complex behavior patterns, and ultimately supporting the real-time interception and dynamic permission adjustment of abnormal visits by smart contracts. The collaboration factor c is located in the denominator and forms a dynamic balance with the failure factor and the suppression factor.

[0039] To further achieve the balance between medical data security sharing and efficient collaboration, dynamically quantify the impact of the user's collaboration behavior in medical data access on their credibility, and enhance the system's adaptability to complex medical operation models, such as the requirements of multi-role collaboration in modern medicine (such as the collaboration of attending physicians, nurses, and radiologists), to avoid the system misjudging individual behavior abnormalities due to team operations. Also, for example, when an intern doctor accesses sensitive data under the guidance of a tutor, the collaboration factor can be associated with the tutor's credibility to avoid hindering the normal learning process due to insufficient permissions. At the same time, if the credibility of the collaboration object is too low, the system can automatically ignore such collaboration records to prevent malicious users from enhancing their own credibility through false collaborations. The specific setting method of the collaboration factor is as follows: S541. Obtain the collaboration access data of each user and other users within the user's characteristic group. The collaboration access data includes the timestamp of each collaboration access and the context type of the collaboration. The context type is divided into several categories according to the sensitivity of medical data, for example, divided into two categories, one is routine medical data, and the other is sensitive medical data; S542. Calculate the collaboration times weight of the user according to the collaboration access data. The calculation formula of the collaboration times weight is: ; In the above formula, represents the weight of the collaboration times after time decay when the context is the k-th context type during the collaboration between the user and the i-th collaboration object. represents the total number of collaborations within a certain period when the context is the k-th context type during the collaboration between the user and the i-th collaboration object. represents the decay rate coefficient of the k-th context type. represents the current timestamp. represents the timestamp when the i-th collaboration behavior occurs. Through the exponential function dynamically reduces the weight of historical collaborations, differentiates the contribution differences between emergency collaborations and regular collaborations, reduces the weight of historical collaborations through the exponential decay function, and strengthens the positive contribution of recent collaborations to credibility. For example, the timeliness of emergency collaborations such as real-time data sharing during surgery is stronger, and the decay rate should be relatively low to retain the long-term impact.

[0040] S543. Set the context weight according to the importance of medical data; the calculation formula for the context weight is: ; In the above formula, represents the context weight of the context type k. represents the average importance of the medical data of the k-th context type. represents the average importance of the j-th context type. H represents the total number of context types. According to the importance of medical data , dynamically allocate the weights of different context types to ensure that high-risk collaborations dominate the credibility assessment. For example, in the epidemic scenario, the average importance of infectious disease data can be increased from 0.7 to 0.9, and its weight should also be increased accordingly to strengthen the trust contribution of relevant collaborations.

[0041] S544. Calculate the extended credibility of the user's collaboration objects; the calculation formula for the extended credibility is: ; In the above formula, represents the extended credibility of the i-th collaboration object. represents the current credibility of the i-th collaboration object. represents the current credibility of the j-th collaboration object. represents the set of collaboration objects that have collaboration behaviors with the user. represents the number of collaboration objects that have collaboration behaviors with the user. Represents the credibility weight of the collaborative object itself. By comprehensively considering the credibility of the collaborative object itself and the credibility of associated users within its collaborative network, potential risk propagation chains are identified to block the loophole of "low-credibility users mutually boosting collaboration".

[0042] S545. Calculate the collaboration factor based on the collaboration times weight of the user, the extended credibility of the collaborative object, and the context weight; the calculation formula for the collaboration factor is: ; In the above formula, represents the collaboration factor, represents the collaboration coefficient of the k-th context type, represents the smoothing constant. There are M collaborative objects to prevent the denominator from being zero.

[0043] S6. Set up a smart contract according to the credibility, and identify abnormal access requests based on the current credibility of the user. For different operation behavior requests of different users, permissions need to be set according to their credibility to form a smart contract. The specific construction criteria of the smart contract include the following steps: S61. Obtain all operation behaviors that the user can perform; S62. Divide the credibility range from 0 to 1 into several continuous control intervals; S63. Correlate different operation behaviors with at least one control interval respectively to establish a smart contract; S64. Obtain the current operation behavior request of the user; S65. Determine whether the operation behavior request is within the corresponding control interval; If so, allow the user's operation behavior request; If not, block the user's operation behavior request and mark it as an abnormal access request.

[0044] Of course, this smart contract is for normal situations. Under emergency conditions, back-end personnel can modify the permissions manually. For example, emergency department doctors can apply to increase their permissions in emergency situations, which will not be elaborated here.

[0045] The medical data abnormal access recognition method proposed by the present invention constructs a dynamic credibility evaluation mechanism through steps S1 to S6. First, user IDs and access logs are collected to provide a basis for behavior analysis. Subsequently, by differentiating new and old users, new users are given an initial credibility based on the historical credibility of their groups and then jump to permission settings, avoiding the blindness of traditional random weighting. Old users vectorize current and historical access data and calculate the fitting degree to quantify behavior continuity to capture abnormal offsets. Then, a three-dimensional evaluation vector is constructed by combining data importance, access duration, and fitting degree, and the initial credibility is calculated using the density function to improve the evaluation accuracy. Finally, the dynamic update model is matched according to the fitting degree range, and the credibility is adjusted in combination with the number of failed requests to achieve elastic credibility management. Finally, the credibility is mapped to the intelligent contract control interval to automatically intercept requests exceeding permissions. This method combines dynamic behavior modeling with intelligent contracts, breaks through the lag of traditional static rules, realizes fine-grained real-time permission control and accurate interception of abnormal access, and effectively improves the security and credibility of the medical data sharing platform.

[0046] The present invention also provides a medical data abnormal access recognition system, including a processor and a memory. The memory is used to store a computer program, and when the computer program is executed by the processor, the medical data abnormal access recognition method is realized.

[0047] Those of ordinary skill in the art can understand that all or part of the steps in the above method embodiments can be completed by instructing relevant hardware through a program. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memories, CD-ROMs, optical memories, etc.) containing computer-usable program codes.

[0048] Each embodiment in this specification is described in a progressive manner. The key point of each embodiment is to illustrate the differences from other embodiments. The same or similar parts among the embodiments can be referred to each other. For the above embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0049] The above embodiments have introduced the present invention in detail. Specific examples are used in this article to elaborate on the principle and implementation manner of the present invention. The description of the above embodiments is only used to help understand the method and its core idea of the present invention; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation to the present invention.

Claims

1. A method for identifying abnormal access to medical data, used in a blockchain platform for sharing medical data, characterized in that: The method comprises the following steps: S1. Obtain the user ID and access log of the data requester, wherein the access log contains the medical data accessed by the user each time and the access duration; S2, determine whether the current user is a new user; If yes, the current user is given credibility and the process goes to step S6; If not, proceed to step S2; S3, vectorize the medical data of this visit and the medical data of historical visits, and calculate the fit between the two; S4. Set the importance of each medical data, and calculate the initial credibility of the user's visit based on the fit of each visit, the visit duration and the average importance of the visit data; S5. Setting several fit ranges and corresponding credibility update models, and selecting a corresponding credibility update model according to the fit of the user's current visit, and substituting the initial credibility and fit to update the user's credibility; S6. Set up smart contracts based on credibility and identify abnormal access requests based on the user's current credibility.

2. The method for identifying abnormal access to medical data according to claim 1, characterized in that: In step S2, the specific method of assigning user credibility includes the following steps: S21, dividing all users into several user groups, and marking the user group to which the current user belongs as a characteristic group; S22, obtaining the credibility of all users in the feature group, and setting a number of continuous credibility intervals between 0 and 1; S23, counting the number of credibility values ​​contained in each credibility interval, and selecting several credibility intervals with the largest number of credibility values ​​and marking them as standard credibility intervals; S24, calculating the average of the medians of each standard credibility interval as the credibility of the current user.

3. The method for identifying abnormal access to medical data according to claim 1, characterized in that: In step S3, the following steps are specifically included: S31. Number all medical data; S32, obtaining all medical data numbers that the user has accessed according to the user's access log, and arranging them in sequence to establish an access set; S33, according to the access set, marking the medical data that the user has accessed in this visit as 1, and marking the medical data that the user has not accessed in this visit as 0, so as to generate a current access vector for this visit; S34, according to the access set, marking the medical data that has been accessed in the user's historical access as 1, and marking the medical data that has not been accessed in the history as 0, so as to generate a historical access vector; S35. Count the number of medical data numbers whose marks are both 1 in the current access vector and the historical access vector. ; S36. Count the number of times the same medical data number is marked as 0 and 1 in the current access vector and the historical access vector respectively. , and the number of unified medical data numbers marked as 1 and 0 in the current access vector and the historical access vector, respectively ; S37. Calculate the fit between the medical data accessed this time and the medical data accessed in the past. The calculation formula of the fit is: ； In the above formula, Indicates the degree of fit between the medical data accessed by the user this time and the medical data accessed in the past.

4. The method for identifying abnormal access to medical data according to claim 3, characterized in that: In step S32, the following steps are specifically included: S321, according to the access log of each user, obtaining the medical data that has been accessed by all users in the characteristic group corresponding to the user; S322, counting the number of users who have accessed each medical data by users in the characteristic group; S323, setting a user number threshold, obtaining medical data whose number of users is less than the user number threshold, and marking it as data to be screened; S324, removing the medical data that the current user has accessed during this visit from the data to be screened, to obtain data to be removed; S325, obtaining all medical data that the user has accessed according to the user's access log, and removing the data to be removed therefrom to obtain standard medical data; S326. Arrange the serial numbers of the standard medical data in sequence to establish an access set.

5. The method for identifying abnormal access to medical data according to claim 1, characterized in that: In step S4, the following steps are specifically included: S41, setting the importance of each medical data, and calculating the average importance of each medical data when the user visits each time to obtain the importance mean; S42. Construct an evaluation vector for each visit according to the visit duration, fit and importance average of each visit; the expression of the evaluation vector is: ； In the above formula, represents the evaluation vector, Indicates the duration of each visit. Indicates the degree of fit, represents the mean importance; S43, calculating the similarity between the evaluation vector of the user's current visit and the evaluation vectors of each visit within a period of time; the similarity calculation formula is: ； In the above formula, Indicates the similarity between the evaluation vector of the user's current visit and the evaluation vector of the i-th visit, represents the evaluation vector of the user's visit. Indicates user Evaluation vector of visits; S44, constructing a statistical interval using the minimum and maximum values ​​of all similarities; The expression of the statistical interval is: ,in, and Respectively represent the minimum and maximum values ​​of the statistical interval; S45, constructing a density function to calculate the density value of any similarity within the statistical interval; the expression of the density function is: ； In the above formula, M represents the density value, Represents any similarity within the statistical interval, Indicates the similarity between the evaluation vector of the user’s current visit and the i-th visit, represents a constant, Representation and independent variables Negatively correlated functions, with a total of n visits; S46. Obtain the similarity with the largest density value as the initial credibility of the user's visit.

6. The method for identifying abnormal access to medical data according to claim 5, characterized in that: In step S41, the step of setting the importance of each medical data specifically includes the following steps: S411, set a number of importance evaluation criteria, obtain the first importance score of each doctor for each evaluation criterion, and construct a first scoring matrix; the expression of the first scoring matrix is: ； In the above formula, Score represents the scoring matrix. It represents the first importance score of the mth doctor for the nth evaluation criterion; S412, extracting the upper limit value, the lower limit value, and the average value of the upper limit value and the lower limit value for setting the first importance score value; S413, converting the scoring matrix into a second scoring matrix; the expression of the second scoring matrix is: ； in, ； In the above formula, represents the second scoring matrix, represents the second importance score of the mth doctor for the nth evaluation criterion, , and Respectively represent the upper limit value, lower limit value and the average value of the upper limit value and the lower limit value of the first importance score. represents a conversion function that converts the independent variable x, i.e., the first importance score value, into the second importance score value; S414, normalizing each second importance score value according to the second scoring matrix; the normalization calculation formula is: ； In the above formula, and represent the second importance score of the mth doctor on the nth evaluation criterion after and before normalization, respectively. represents the second importance score of the kth doctor on the nth evaluation criterion before normalization, and there are n doctors in total; S415. Calculate the average importance score of all doctors for each evaluation criterion after normalization based on the second importance score of each doctor for each evaluation criterion before normalization. The calculation formula of the average importance score is: ； In the above formula, Represents the average importance score of the nth evaluation criterion, represents the normalized second importance score of the kth doctor for the nth evaluation criterion; S416, obtaining evaluation scores of each doctor on the importance evaluation criteria of each medical data; S417, calculating the importance of each medical data according to the evaluation score of each doctor on the importance evaluation standard of each medical data and the normalized importance evaluation standard; the calculation formula of the importance of medical data is: ； In the above formula, Indicates the importance of each medical data, represents the qth importance evaluation criterion, Represents the evaluation score of the Fth doctor on the medical data.

7. The method for identifying abnormal access to medical data according to claim 1, characterized in that: In step S5, the following steps are specifically included: S51, setting a number of continuous fit degree ranges in the numerical range of 0 to 1, and determining the fit degree range corresponding to the fit degree of the user's current visit; S52, setting a negatively correlated suppression factor according to the distance between the maximum value in the fit degree range and 0; S53, counting the number of failed requests of the user in this access; S54, construct a user's credibility update model, and update the user's credibility to serve as the user's credibility for the next visit; the expression of the credibility update model is: ； In the above formula, Indicates the updated user's credibility, represents the initial credibility, Indicates the fit of the user's visit. represents the fit degree at the i-th visit, with a total of n visits, Indicates the request failure factor, which is positively correlated with the number of failed requests made by the user during this visit. represents the suppression factor of the kth fit range, represents the sensitivity factor, and c represents the collaboration factor.

8. The method for identifying abnormal access to medical data according to claim 1, characterized in that: In step S6, the following steps are specifically included: S61, obtaining all operations that the user can perform; S62, dividing the credibility ranging from 0 to 1 into a number of continuous control intervals; S63, corresponding different operation behaviors to at least one control interval respectively, so as to establish a smart contract; S64, obtaining the user's current operation behavior request; S65, determining whether the operation behavior request is within the corresponding control range; If so, allow the user's operation request; If not, the user's operation request is blocked and marked as an abnormal access request.

9. The method for identifying abnormal access to medical data according to claim 7, characterized in that: The method for setting the collaboration factor is: S541, obtaining collaborative access data of each user and other users in the characteristic group to which the user belongs, wherein the collaborative access data includes a timestamp of each collaborative access and a context type of the collaboration, and the context type is divided into several categories according to the sensitivity of the medical data; S542. Calculate the user's collaboration times weight according to the collaboration access data. The calculation formula for the collaboration times weight is: ； In the above formula, It represents the weight of the number of collaborations after time decay when the context of collaboration between the user and the i-th collaboration object is the k-th context type. It indicates the total number of collaborations within a certain period of time when the context of collaboration between the user and the i-th collaboration object is the k-th context type. represents the decay rate coefficient of the k-th context type, Indicates the current timestamp, Indicates the timestamp when the i-th collaborative behavior occurs; S543, setting context weight according to the importance of medical data; The calculation formula of context weight is: ； In the above formula, represents the context weight of context type k, represents the mean importance of medical data of the kth context type, represents the mean importance of the j-th context type, and H represents the total number of context types; S544. Calculate the extended credibility of the user's collaborative object. The calculation formula of the extended credibility is: ； In the above formula, represents the extended credibility of the ith collaboration object, represents the current credibility of the i-th collaborative object, represents the current credibility of the jth collaborative object, A collection of collaborative objects that represent collaboration with the user. Indicates the number of collaboration objects that have collaboration behaviors with the user. Indicates the credibility weight of the collaboration object itself; S545. Calculate the collaboration factor according to the collaboration times weight of the user, the extended credibility of the collaboration object and the context weight. The calculation formula of the collaboration factor is: ； In the above formula, represents the collaboration factor, represents the cooperation coefficient of the k-th context type, Represents the smoothing constant, and there are M collaborative objects in total.

10. A system for implementing the method for identifying abnormal access to medical data according to any one of claims 1 to 9, characterized in that: It comprises a processor and a memory, wherein the memory is used to store a computer program, and when the computer program is executed by the processor, the method for identifying abnormal access to medical data as described in any one of claims 1 to 9 is implemented.

Images