Hospital terminal threat behavior identification method based on interpretable deep learning

Abstract

The invention discloses a hospital terminal threat behavior recognition method based on interpretable deep learning, and particularly relates to the technical field of network security, threat intelligence analysis and interpretable artificial intelligence. According to the method, a multi-modal hospital terminal operation data set fusing time sequence images, logs and other data is constructed, and different modal data are effectively integrated by adopting a multi-modal data fusion method; integrating a dynamic attention mechanism into a long short-term memory network model for adaptively extracting key features in a terminal user behavior sequence; and a double-layer interpretable framework based on gradient weighted class activation mapping and a local interpretable model irrelevant interpretation technology is introduced, so that high-precision recognition and interpretable analysis of the threat behavior of the hospital terminal user are realized. According to the method, complex threat behaviors in the hospital terminal can be efficiently and accurately identified, the limitation of a traditional method in the aspects of data diversity, interpretability and hidden threat detection is overcome, and the transparency and efficiency of threat analysis are enhanced.

Description

Technical Field

[0001] The present invention relates to the fields of network security, threat intelligence analysis, and explainable artificial intelligence technology, and in particular to a hospital terminal threat behavior identification method based on explainable deep learning. Background Art

[0002] With the deepening digitalization of the healthcare industry, the security of hospital information systems faces increasingly severe challenges, particularly for hospital terminal devices that carry large amounts of sensitive medical data. Abnormal operation or malicious behavior on these devices can not only leak patient privacy and damage medical data, but can also severely disrupt the normal operation of the hospital, causing immeasurable losses. Therefore, identifying abnormal behavior and potential threats in hospital terminal user operations, thereby improving the overall protection capabilities of the medical system, has become a key area of ​​focus for cyber threat intelligence (CTI).

[0003] Traditional threat behavior identification methods, such as rule-based policy detection, rely on pre-set security policies. While these methods are effective in simple scenarios, their limitations are becoming increasingly apparent as threats become increasingly complex and diverse. They struggle to meet the real-time, adaptable, and high-precision identification requirements of cyber threat intelligence.

[0004] In recent years, deep learning (DL) has brought new hope to threat behavior identification due to its remarkable capabilities in feature extraction and complex pattern modeling. Deep learning models can learn patterns and features from massive amounts of data, theoretically enabling more accurate identification of potential threat behaviors. However, existing deep learning methods still face significant challenges when applied to threat behavior identification on hospital endpoints. First, hospital endpoint operational data is highly complex and diverse, encompassing multiple modalities such as device operating status, user operating habits, and network traffic characteristics. Effectively integrating this multimodal data to obtain a more comprehensive and accurate representation of behavior is challenging, and standardized datasets that can support the training and evaluation of multimodal deep learning models are lacking. Second, deep learning models are often "black boxes," with opaque internal computational processes. This raises trust issues in the highly sensitive context of hospital security, hindering effective threat analysis and attribution. Furthermore, existing methods are limited in their ability to handle multiple threat types, their reliance on large amounts of annotated data, and their high computational costs. Therefore, enhancing the interpretability of deep learning models for threat behavior identification on hospital endpoints while ensuring identification accuracy remains a key challenge that needs to be addressed. Summary of the Invention

[0005] In order to solve the problems of low efficiency of multimodal data fusion, inaccurate threat feature capture, and lack of explainability of model decisions in existing hospital terminal user threat behavior identification solutions, the present invention provides a hospital terminal threat behavior identification method based on explainable deep learning.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] A hospital terminal threat behavior identification method based on explainable deep learning, characterized by comprising the following steps:

[0008] S1. Collect multimodal operational behavior data from hospital terminal users, clean, align, standardize, and annotate the original multimodal data, and use interface analysis tools to convert image data into structured data to obtain processed multimodal data;

[0009] S2. Using a feature layer method based on sparse attention mechanism and cascade strategy, the processed multimodal data is fused to obtain multimodal data fusion features;

[0010] S3. Input the multimodal data fusion features into the long short-term memory network based on the dynamic attention mechanism for dynamic feature extraction and threat identification. The final global representation is the attention-weighted context vector.

[0011] S4. A two-layer interpretability framework is used to combine global and local interpretation methods to perform interpretability analysis on threat identification results.

[0012] The technical solution further defined in the present invention is:

[0013] Furthermore, in the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S1, the method for constructing a multimodal dataset includes the following steps:

[0014] S1.1. Construct a multimodal behavior dataset based on a virtual hospital simulation environment, including data collection and role and behavior annotation;

[0015] S1.2. Clean, align, standardize, and annotate the raw data to ensure the spatiotemporal consistency of multimodal data;

[0016] S1.3. Feature extraction is performed on multimodal raw data from four aspects: system logs, access behavior, desktop dynamics, and abnormal behavior, for use in identifying hospital terminal operation behaviors. Relevant features can reduce data dimensionality, reduce noise, and highlight key information to improve model training efficiency and behavior recognition accuracy.

[0017] S1.4. Use expert-defined rules to flag abnormal behaviors. These rules are based on medical industry safety standards and expert experience to identify potentially high-risk behaviors.

[0018] In the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S1.1, multimodal operation behavior data of hospital terminal users (doctors, nurses, administrators, etc.) are collected.

[0019] Among them, multimodal operation behavior data covers system logs, access behaviors, desktop dynamics (such as screenshots) and abnormal operation records, including daily operations and potential high-risk behaviors.

[0020] In the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S1.1, the behaviors of different roles are labeled.

[0021] Among them, for the three roles of doctors, nurses, and administrators, routine operations (such as medical record review and nursing records) and high-risk behaviors (such as logging in during non-working hours and frequent access to sensitive files) are annotated to form a multimodal dataset containing time series images and structured logs.

[0022] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S1.2, the method for extracting features from multimodal raw data includes the following steps:

[0023] S1.2.1. Extract visual features from user interface screenshots to reflect the compositional characteristics of the interface's interactive elements. This includes using the OmniParser framework developed by Microsoft to identify interactive elements such as buttons, icons, and menus in the interface and converting them into structured data.

[0024] S1.2.2. Perform time-aligned feature extraction on multimodal data to reflect the temporal correlation of operational behaviors, including using system timestamps to time-align images and logs to achieve one-to-one matching to construct a temporally consistent dataset.

[0025] S1.2.3. Extract validity features from the original data to reflect the continuity characteristics of the operation behavior, including eliminating invalid data such as task interruptions through data filtering operations and retaining valid data.

[0026] S1.2.4. Perform format standardization feature extraction on multimodal data to reflect the normative characteristics of the data structure, including performing format unification work, renaming all image frames to a unified format, and renaming and numbering log fields.

[0027] S1.2.5. Extract semantic features from sample data to reflect the business characteristics of the operational behavior, including performing data labeling tasks and annotating each sample with labels such as role type, task status, and task scenario.

[0028] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S1.3, the method for extracting features from multimodal raw data includes the following steps:

[0029] S1.3.1. Extract time series features from log data to reflect the temporal characteristics of user operation behaviors, including the user's login frequency, mean operation duration, and variance of operation duration within a specific time period.

[0030] S1.3.2. Extract features from access behaviors, record user behavior features, and reflect user preferences for different resources, including statistics on the frequency of access to different types of files and the frequency of different types of operations.

[0031] S1.3.3. Extract abnormal behavior features from abnormal patterns of user operation behaviors, including non-working hours login annotation, user baseline deviation, and high-risk behavior annotation based on expert recommendations.

[0032] S1.3.4. Label high-risk behaviors based on expert recommendations.

[0033] In the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S1.3.1, the user's login frequency F in a specific time period is login is defined as follows:

[0034] F login =count(operation timestamps)

[0035] Where operation timestamps is the operation timestamp, and count(·) is the counting function.

[0036] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S1.3.1, the mean value of the operation duration μ duration is defined as follows:

[0037]

[0038] Among them, x i It represents the duration of the i-th operation, and n is the total number of operations.

[0039] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S1.3.1, the variance of the operation duration is defined as follows:

[0040]

[0041] Among them, x i represents the duration of the i-th operation, n is the total number of operations, μ duration is the mean operation time.

[0042] In the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S1.3.2, the frequency of accessing electronic medical records F EMR The algorithm for obtaining is as follows:

[0043] F EMR =count(accesscontent=EMR)

[0044] Wherein, count(·) is a counting function, and access cuntent=EMR limits the access type to electronic medical records.

[0045] In the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S1.3.2, access the diagnostic record system F DRS The frequency calculation algorithm is as follows:

[0046] F DRS =count(access content=DRS)

[0047] Wherein, count(·) is a counting function, and access content=DRS limits the access type to the diagnostic recording system.

[0048] In the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S1.3.2, the frequency of operation type viewing F is counted. view The algorithm for obtaining is as follows:

[0049] F view =count(operation type=view)

[0050] Wherein, count(·) is a counting function, and access content=view limits the type of operation to viewing.

[0051] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S1.3.2, the frequency F of the operation type editing is counted. edit The algorithm for obtaining is as follows:

[0052] F edit=count(operation type=edit)

[0053] Wherein, count(·) is a counting function, and access content=edit limits the type of operation to edit.

[0054] In the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S1.3.3, the algorithm for obtaining the non-working hour login label is as follows:

[0055]

[0056] The algorithm marks login behaviors after 22:00. If the user logs in during this period, it is considered abnormal behavior 1, otherwise it is 0.

[0057] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S1.3.3, cosine similarity difference is used to quantify the degree of deviation between the user's current behavior and the historical behavior baseline. The algorithm for calculating the cosine similarity difference is as follows:

[0058] Cosine Similarity Difference=1-cos_sim

[0059] Among them, cos_sim represents cosine similarity.

[0060] The algorithm for obtaining the cosine similarity difference mentioned above, the algorithm for obtaining the cosine similarity cos_sim is as follows:

[0061]

[0062] Among them, x current is the feature vector of the current session, x baseline is the historical average vector.

[0063] In the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S1.3.4, examples of features extracted based on high-risk behavior annotations recommended by experts are shown in the table.

[0064] In the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S1.4, abnormal behaviors are marked based on expert-defined rules, including the following rules:

[0065] Rule 1: If a user accesses more than 10 sensitive files within 15 minutes, it is marked as abnormal behavior. This rule is designed to identify behavior that may involve data leakage or improper access.

[0066] Rule 2: If a user's single operation on a specific file lasts less than or equal to 5 seconds and is performed 10 or more times within 1 minute, the behavior is marked as abnormal. This rule is used to identify potential automated attacks or malicious operations.

[0067] Rule 3: If a user logs into the system during non-working hours, it is marked as abnormal behavior. This rule is used to identify potential unauthorized access or inappropriate behavior.

[0068] Rule 4: If a user modifies critical system settings three or more times within 15 minutes, the behavior is marked as abnormal. This rule is intended to identify potential malicious system tampering, such as attempts to escalate privileges or compromise system security configurations.

[0069] Rule 5: If a user logs into the system from multiple locations simultaneously, flag this as abnormal behavior. This rule is intended to detect potential account theft or unauthorized access from multiple locations, especially in scenarios where strict authentication is required to access medical data.

[0070] Rule 6: If a user's data access volume within a specific time period exceeds 1.2 times the average value set by industry standards, it will be marked as abnormal behavior. This rule is intended to identify possible data misuse, such as unauthorized large-scale data collection or leakage risks.

[0071] Furthermore, in the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S2, the method for obtaining multimodal data fusion features includes the following steps:

[0072] S2.1. Use an independent encoder to extract features for each modality data X (time series images, log data, etc.) to obtain an intermediate representation H(m) of uniform length.

[0073] S2.2. Calculate the attention score matrix A(m) between modalities to measure feature correlation;

[0074] S2.3. Retain the top k key features through the Top-K strategy of sparse gating.

[0075] S2.4, introduce the sparse Softmax function to further enhance feature sparsity and highlight key operation modes;

[0076] S2.5. Fuse multimodal features in a cascade manner and output the fused feature sequence after normalization. Realize cross-modal information complementarity.

[0077] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S2.1, the multimodal data X is defined as follows:

[0078] x={x (1) ,X (2) ,…,X (m) ,…,X (M)}

[0079] Where M is the number of input modes, is the data of the mth mode, represents a fixed output dimension, represents the real space, T is the time step, d m is the characteristic dimension of the mode.

[0080] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S2.1, the algorithm for obtaining the intermediate representation H(m) of uniform length is as follows:

[0081]

[0082] in, is the mth input sample, The parameter is θ m The feature encoding function, represents a fixed output dimension, represents the real space, T is the time step, d h Indicates the preset hidden layer dimension.

[0083] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S2.2, the inter-modal attention score matrix A (m) The algorithm for obtaining is as follows:

[0084]

[0085] Among them, Q (m) Indicated by Q (m) The query vector generated by linear transformation, K (m) Indicated by K (m) Generate key vectors through linear transformation, K (m)T is the transpose of the key matrix, is the scaling factor, d h represents the preset hidden layer dimension, and Softmax(·) is the normalization function.

[0086] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S2.3, the sparse gated Top-K selection strategy The algorithm for obtaining is as follows:

[0087]

[0088] Among them, TopK(·,k) is the Top-K selection function, which only retains the top k features with the highest attention scores and sets the rest to zero to filter out noise.

[0089] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S2.4, the sparse Softmax function SparseSoftmax(Z) i The algorithm for obtaining is as follows:

[0090]

[0091] Among them, z i is the i-th element in Top-K, τ is the temperature parameter, is the indicator function, and only the first k features are kept with non-zero values.

[0092] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S2.5, the cascade strategy fuses the multimodal features H fused The algorithm for obtaining is as follows:

[0093] H fused =σ(W f Concat(H (1) ,H (2) ,…,H (M) )+b f )

[0094] Where M is the number of input modes, W f is the learnable weight matrix, is the bias vector, d f is the fusion feature dimension, σ(·) is the activation function, and Concat(·) is the feature concatenation operation.

[0095] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S2.5, the fused features are processed by feature normalization to obtain a fused feature sequence. The algorithm for obtaining is as follows:

[0096]

[0097] Among them, LayerNorm(·) is the layer normalization operation, H fused Fusing multimodal features for cascade strategy.

[0098] Furthermore, in step S3, the long short-term memory network captures the long-term dependencies of the behavior sequence through a gating mechanism, and the dynamic attention mechanism calculates the attention weight at each time step based on the context relevance score and dynamically adjusts the feature importance, so that the model focuses on the key time steps.

[0099] Furthermore, in the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S3, the method for determining whether the user behavior is threatening includes the following steps:

[0100] S3.1. Processing the fused feature sequence layer by layer through the long short-term memory network The gating mechanism (input gate, forget gate, output gate) is used to capture the long-term temporal dependencies of user behavior sequences.

[0101] S3.2. At each time step, the dynamic attention mechanism calculates the attention weight based on the context relevance score, adaptively adjusts the importance of features at different time steps, and focuses on key behavior segments.

[0102] S3.3. Input the weighted features output by the dynamic attention mechanism into the fully connected layer, perform threat classification through the fully connected layer, and determine whether the user behavior is threatening.

[0103] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S3.1, the fused sequence input H is defined as follows:

[0104] H={h1,h2,…,h t ,…,h T}

[0105] Among them, h t is the feature vector of a single time step t, and T is the sequence length.

[0106] In the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S3.1, the traditional long short-term memory network unit update formula is defined as follows:

[0107] i t =σ(W i h t +U i h t-1 +b i )f t =σ(W f h t +U f h t-1 +b f )

[0108] o t =σ(W o h t +U o h t-1 +b o )

[0109]

[0110] h t =o t ⊙tanh(c t )

[0111] Among them, i t is the activation value of the input gate, f t is the activation value of the forget gate, o t is the activation value of the output gate; is the candidate activation state, c t is activated, h t represents the hidden state; ⊙ represents element-by-element multiplication; σ is the Sigmoid activation function, tanh(·) is the hyperbolic tangent activation function; W is the weight matrix of the input state, U is the weight matrix of the hidden state; b is the bias term.

[0112] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S3.2, different attention weights are assigned in the time dimension to construct a long short-term memory network based on dynamic attention. The algorithm is as follows:

[0113]

[0114] Among them, a t is the attention weight at time t, W a and b a is a trainable parameter and tanh(·) is the hyperbolic tangent activation function.

[0115] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S3.2, the algorithm for obtaining the attention-weighted context vector h is as follows:

[0116]

[0117] Among them, a t is the attention weight at time t, h t In hidden state.

[0118] Furthermore, in the aforementioned hospital terminal threat behavior identification method based on explainable deep learning, in step S4, constructing a two-layer explanation framework includes the following steps:

[0119] S4.1. Global Interpretation: We use gradient-weighted class activation mapping to generate heatmaps by analyzing the gradient of the model's last convolution layer relative to the class score, visualizing the key areas the model focuses on when making decisions in a multidimensional feature space.

[0120] S4.2. Local explanation uses local interpretable model-independent explanation technology to generate perturbation samples near specific samples and fit an interpretable linear model to explain the basis for individual threat decisions and analyze the contribution weight of each feature to the specific prediction results.

[0121] The aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S4.1, generates the final heat map The algorithm for obtaining is as follows:

[0122]

[0123] Among them, ReLU(·) is the linear rectification function, Category c corresponds to the global average gradient weight of the k-th feature map, A k is the corresponding k-th feature map.

[0124] The algorithm for generating the final heat map mentioned above calculates the feature map A corresponding to channel k k The channel importance weight The algorithm for obtaining is as follows:

[0125]

[0126] Among them, c is the given category, y c is the corresponding category score, is the pixel value of the kth feature map at position (i, j), and Z is the normalization constant.

[0127] The algorithm for generating the final heat map mentioned above calculates the feature map A corresponding to channel k k Gradient The algorithm for obtaining is as follows:

[0128]

[0129] Among them, c is the given category, y c is the corresponding category score.

[0130] In the aforementioned hospital terminal threat behavior identification method based on interpretable deep learning, in step S4.2, the interpretable linear model g(x ′ ) is obtained as follows:

[0131] g(x ′ )=w T x ′ +b

[0132] Among them, x ′ is the interpretable representation of the sample, w is the weight vector obtained by minimizing the weighted loss function, w Tis the transpose of the weight vector, and b is the bias term.

[0133] The algorithm for obtaining the interpretable linear model mentioned above calculates the minimum weighted loss function L(f,g,π x ) is obtained as follows:

[0134]

[0135] Among them, π x (z) is the proximity metric that measures the similarity between the perturbed sample z and the original sample x, Ω(g) is the complexity regularization term, f(z) is the original deep learning model, and g(z) is the interpretable linear model.

[0136] According to another aspect of the present invention, a user threat behavior identification system based on multimodal data fusion is provided. The system adopts the above-mentioned hospital terminal threat behavior identification method based on explainable deep learning, and the system includes:

[0137] Data acquisition module, used to collect multimodal operation data of hospital terminals in real time;

[0138] Data preprocessing module, used to clean, normalize data and label threats;

[0139] The multimodal fusion module is used to perform spatiotemporal alignment and feature interaction on heterogeneous data, and adopts the above-mentioned fusion method based on sparse attention mechanism and cascade strategy.

[0140] The dynamic feature extraction module has a built-in long short-term memory network model with the above-mentioned dynamic attention mechanism, which is used to extract dynamic time-critical features from the fused features.

[0141] The threat identification module is used to implement end-to-end classification decisions and explanation generation, including the above-mentioned gradient-weighted class activation mapping and local interpretable model-independent explanation technology interpretability analysis methods.

[0142] An interpretative module for generating global heatmaps and local feature importance analysis.

[0143] The present invention has the following advantages:

[0144] The present invention adopts sparse attention and cascade strategies to achieve effective integration of complementary information of multimodal data, thereby improving the recognition accuracy of multi-dimensional feature fusion; with the help of the combination of long short-term memory network and dynamic attention mechanism, it significantly enhances the ability to capture long-term dependencies and key operation sequences, and enhances the threat capture capability of dynamic time series modeling; through the two-layer interpretation framework, it realizes the visualization and traceability of model decisions, meeting the explainability requirements of medical compliance; at the same time, it performs stably under different data quality and threat scenarios, can effectively deal with the diverse operating behaviors and potential attack modes of hospital terminals, and enhances robustness to adapt to complex medical environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0145] Figure 1 This is the system architecture diagram of the present invention, showing the complete process from data collection to threat identification and interpretation;

[0146] Figure 2 This is a diagram of the multimodal data fusion algorithm, which details the feature fusion calculation logic based on the sparse attention mechanism and cascade strategy;

[0147] Figure 3 This is a diagram of the dynamic attention mechanism model training, which details the operating logic of the dynamic attention mechanism during the model training process;

[0148] Figure 4 This is a diagram of threat classification and explainability analysis, showing how cyber threat intelligence is processed through different networks to achieve threat classification, and how explainability analysis is performed using multiple methods.

[0149] Figure 5 This is a comparison chart of the test results of the multimodal data ablation component, which visually verifies the gain effect of multimodal data on model performance;

[0150] Figure 6 A feature importance analysis diagram for local interpretable model-independent interpretation techniques, showing the driving or inhibitory effects of positive and negative features in model decisions; DETAILED DESCRIPTION

[0151] The following describes the implementation of the present invention using specific embodiments. Those skilled in the art will readily understand the other advantages and benefits of the present invention from the disclosure herein. Obviously, the embodiments described are only a portion of the present invention, not all of it. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0152] The present invention provides a hospital terminal user threat behavior identification method and system based on adaptive multimodal fusion and dynamic attention mechanism.

[0153] Example 1: Multimodal dataset construction

[0154] To address the current lack of publicly available data on medical terminal operation behavior, this example combines privacy risk assessment techniques with data collection technology to construct a multimodal dataset. Its effectiveness in identifying behavioral patterns is verified through feature analysis. Customized data labeling standards and cleansing processes are employed to ensure data availability. Four modalities—system logs, access behavior, desktop activity, and abnormal operations—are used as analysis dimensions to reveal operational characteristics of users with different roles.

[0155] This dataset contains 200 sample images of desktop operations performed by hospital end users, covering three typical roles: doctors, nurses, and administrators.

[0156] The role operation collection content in the dataset is shown in the following table:

[0157]

[0158] This data collection covers both routine system operations and potentially high-risk behavior scenarios. Using image feature extraction algorithms and window activity detection technology, we identified 10 typical operating modes, including six routine operations (such as system login, file access, and data entry) and four high-risk behaviors (such as abnormal file access, frequent data export, unauthorized system configuration modifications, and prolonged idle screen unlocking).

[0159] The dataset has multimodal data characteristics, and the specific dimensions and contents are shown in the following table:

[0160]

[0161] All data undergo a triple cleaning process (deduplication, missing value filling, and outlier filtering) and normalization to ensure that the data format is unified and the noise is controllable, meeting the input requirements of subsequent behavioral modeling and machine learning algorithms, such as Figure 2 shown.

[0162] Example 2: Construction and training of an interpretable deep learning model based on dynamic attention mechanism

[0163] In order to verify the effectiveness of the proposed interpretable deep learning model based on the dynamic attention mechanism, this embodiment describes the model construction process and training configuration in detail. Figure 3 As shown in the figure, the model uses a fusion architecture of an adaptive temporal attention module and a long short-term memory network to dynamically adjust the weights and accurately extract key temporal features in the end-user operation sequence.

[0164] During model implementation and training, the implementation example established a high-performance computing environment, utilizing an Intel Xeon Silver 4210R @ 2.40GHz 10-core 20-thread processor and an NVIDIA GeForce RTX 3060 GPU for collaborative computing. Model development was completed based on the Keras version of TensorFlow 2.0. The dataset was partitioned according to a standard ratio of 70% training set, 15% validation set, and 15% test set to ensure the scientific nature of the model training, tuning, and evaluation process. During model initialization, a random initialization strategy was implemented for the model weights, and the He initialization method was used for the convolutional and fully connected layers. The model bias was also reset to zero to accelerate model convergence and improve training efficiency. During training, the Adam optimizer was selected as the parameter update algorithm, with a learning rate of 0.001 and β1 and β2 parameters configured to 0.9 and 0.999, respectively, to achieve efficient optimization of model parameters.

[0165] Example 3: Experimental evaluation indicators

[0166] This study focuses on the model's ability to identify abnormal user behavior and conducts experimental evaluations from two aspects: performance and interpretability. The purpose is to verify the effectiveness of the multimodal data fusion scheme and the accuracy of the interpretable model in extracting tactics, techniques, and procedures from network threat intelligence.

[0167] In terms of performance evaluation, the study selected standard classification indicators such as accuracy, precision, recall, F1 value, and area under the curve to conduct a comprehensive quantitative analysis of the model performance. The specific data are as follows: Figure 5 The performance of various indicators in different model scenarios is as follows: in the log-only scenario, the precision is 78.2%, the recall is 70.3%, and the F1 value is 74%; in the access-only scenario, the precision is 82.4%, the recall is 76.6%, and the F1 value is 79%; in the screen-only scenario, the precision is 71.5%, the recall is 65%, and the F1 value is 68%; in the splicing scenario, the precision is 85.1%, the recall is 77.6%, and the F1 value is 81%; in the complete model scenario, the precision is 91.3%, the recall is 87.1%, and the F1 value is 89%.

[0168] At the interpretable model level, this study uses visualization technology to deeply analyze the model decision logic. On the one hand, by using gradient weighted class activation mapping to generate heat maps, we can accurately locate the key areas in the input data and identify the parts that play a key role in the model decision. On the other hand, we draw feature importance maps through local interpretable model-independent explanations. Figure 6As shown in the figure, different features have different feature weights. For example, the weight of "editing operation frequency" is 1.32, and the weight of "non-working hours login" is 0.87. These features rank high in terms of influencing the model prediction results. In this way, the features that affect each prediction result are ranked, which provides transparent insights into model reasoning, helps to understand how the model makes decisions based on various features, and further verifies the effectiveness of the multimodal data fusion solution and the accuracy of the tactics, techniques and procedures in extracting network threat intelligence from the interpretable model.

[0169] Although the present invention has been described in detail above using general descriptions and specific embodiments, it will be apparent to those skilled in the art that modifications and improvements may be made thereto. Therefore, such modifications and improvements, without departing from the spirit of the present invention, are intended to be within the scope of protection claimed herein.

Claims

1. A hospital terminal threat behavior identification method based on explainable deep learning, characterized by: The following steps are involved: S1. Build a multimodal dataset consisting of hospital terminal system logs, screen operation images, and network traffic, annotating routine operations and high-risk behaviors; S2. Using sparse attention mechanism and cascade fusion strategy, we fuse features of time series images and log data to generate multimodal fusion features. S3. Input the fused features into a long short-term memory network based on a dynamic attention mechanism to extract temporal features and perform threat behavior classification; S4. Use gradient-weighted class activation mapping and local interpretable model-independent explanation techniques to generate global heat maps and local feature importance analysis to achieve visual explanation of model decisions.

2. The method according to claim 1, characterized in that The multimodal dataset construction step S1 includes: S1.1 collects operational data for three roles: doctors, nurses, and administrators, including login frequency, file access records, operation duration, and screen interface images; S1.2 identifies high-risk behaviors based on expert-defined security rules, such as frequent access to sensitive files, logging in during non-working hours, and abnormal system setting modifications.

3. The method according to claim 1, characterized in that The multimodal data fusion step S2 includes: S2.1 encodes each modality data independently to generate an intermediate representation of unified dimension; S2.2 calculates the inter-modal attention score matrix, retains high-scoring features through the Top-K strategy, and generates a sparse attention matrix; S2.3 cascades multimodal features and processes them through the fully connected layer, outputs fused features, and inputs them into the subsequent network after layer normalization.

4. The method according to claim 1, wherein The long short-term memory network S3 of the dynamic attention mechanism includes: S3.1 Long short-term memory network captures long-range temporal dependencies and generates hidden state sequences; S3.2 dynamic attention layer calculates attention weights and generates context vectors; S3.3 The fully connected layer outputs the threat behavior classification probability based on the context vector.

5. The method according to claim 1, wherein The interpretability enhancement step S4 includes: S4.1 Global Interpretation: Calculate feature map gradients through gradient-weighted class activation mapping, and generate heat maps to highlight key areas of interest to the model, such as sensitive file access counts and off-hours logins. S4.2 Local Interpretation: Generate single-sample perturbation data through local interpretable model-independent interpretation technology, fit a linear model to calculate feature importance, and output positive / negative contribution features and their weights.

6. A hospital terminal threat behavior identification system based on multimodal data fusion and explainable deep learning, characterized by: include: M1. Data acquisition module, used to collect multimodal operation data of hospital terminals in real time; M2. Data preprocessing module, used to clean and normalize data and label threats; M3. Multimodal fusion module, used to implement sparse attention and cascade fusion of time series images and log data; M4. Dynamic feature extraction module, which extracts temporal behavior features based on the long short-term memory network of the dynamic attention mechanism; M5. Threat identification module, used to output threat behavior classification results; M6. Interpretative module for generating global heatmaps and local feature importance analysis.

7. The system according to claim 6, characterized in that The multimodal fusion module M3 includes: M3.1 modal encoding unit, which performs convolutional neural network and embedding layer encoding on image and log data respectively; M3.2 sparse attention unit, calculates inter-modal attention scores and filters key features; M3.3 cascade fusion unit, splicing multimodal features and generating fusion features through the fully connected layer.

8. The system according to claim 6, wherein: The explanatory module M6 includes: M6.1 gradient-weighted class activation mapping unit, which generates feature space heat maps based on gradient calculation; M6.2 Local Interpretable Model-Independent Explanation Technology Unit generates single-sample feature importance rankings through local linear fitting.

Images