Hospital network security event emergency response management method
By constructing a network of associated devices and performing multi-verification analysis, the problems of misjudgment and missed judgment in traditional hospital network security monitoring have been solved, enabling more efficient identification and early warning of abnormal access behavior.
Patent Information
- Application Number
- CN202511485029.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-17
- Publication Date
- 2025-12-19
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Traditional hospital cybersecurity incident monitoring suffers from misjudgments or omissions, primarily due to overly subjective assessments of visitors and a lack of correlation analysis among multiple samples, resulting in low monitoring efficiency.
By acquiring the sensitivity of target access information, we construct a map of associated devices, statistically analyze access time and sensitivity characteristics, set anomaly thresholds, conduct multiple verifications and analysis with the assistance of job colleagues, classify the severity level of abnormal access behavior, and issue multiple early warnings.
It has improved the rigor and efficiency of hospital network security incident early warning management, reduced the probability of misjudgment or omission, and achieved more accurate identification of abnormal access behavior.
Smart Images
Figure CN121173567A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of security event response management, in particular to a hospital network security event emergency response management method. BACKGROUND
[0002] With the rapid development of information technology, hospital informatization construction has become an important means to improve the quality and efficiency of medical services. At present, network attacks on medical systems are becoming more and more serious, there are data leakage, malicious attacks, etc., which seriously threaten the privacy security of patients and the stable operation of hospitals.
[0003] In the traditional technology, the malicious access risk monitoring of internal personnel for the hospital network system is often directly judged according to the position, access time and access frequency of the access personnel, which is a subjective judgment. The problem of whether there is a false negative or a false negative is not further verified, and the information sample analysis is single, without correlation analysis between multiple samples, which is easy to cause false negative or false negative, and reduces the efficiency of security event monitoring work. SUMMARY
[0004] In order to overcome the above-mentioned deficiencies of the prior art, the present application provides a hospital network security event emergency response management method.
[0005] The hospital network security event emergency response management method provided by the present application comprises: Step S1, obtaining target access information of a current target access personnel, if the sensitivity of the target access information is not less than the information sensitive interval value, outputting a first-level warning result, if the sensitivity of the target access information is in the information sensitive interval value, then the correlation equipment graph between the target access personnel and the associated equipment of the target access information in the recent historical period is counted; Step S2, counting the abnormal access time proportion and continuity of the target access personnel to the equipment in the correlation equipment graph, the target access information associated information access, obtaining visit time feature data, and comprehensively counting the accessed information sensitivity, equipment access concentration or dispersion uniformity of the target access personnel and the target access information associated information access in the correlation equipment graph, obtaining a preprocessing visit abnormal weight value; Step S3, presetting the visit time abnormal threshold and the visit number abnormal weight threshold, when the visit time characteristic data is greater than or equal to the visit time abnormal threshold, or the pretreated visit number abnormal weight value is greater than or equal to the visit number abnormal weight threshold, outputting the secondary verification information, obtaining the to-be-tested access personnel in the same position as the target access personnel, and statistically obtaining the abnormal weight peak threshold and the abnormal weight low peak threshold of the to-be-tested access personnel in the high peak period and the low peak period of the device visited in the associated device graph; judging that the access data of the target access personnel in the high peak period and the low peak period of the device visited in the associated device graph is in an abnormal state, and outputting a secondary early warning result.
[0006] Preferably, the sensitivity of the target access information is detected, an information sensitivity interval value is preset, if the sensitivity of the target access information is not less than the information sensitivity interval value, a primary abnormal access behavior early warning is performed, and a primary early warning result is outputted; If the sensitivity of the target access information is less than the information sensitivity interval value, it is determined that the behavior of the target access personnel in accessing the target access information is safe access; If the sensitivity of the target access information is in the information sensitivity interval value, the access device to which the target access information belongs is marked, and a main access device is obtained; The auxiliary access device accessed by the target access personnel in the recent historical period is obtained, the to-be-tested access device associated with the target access information of the target access personnel is extracted from the auxiliary access device according to the target access information, the to-be-tested access device is associated with the main access device to construct a device association graph, and an associated device graph is obtained.
[0007] Preferably, the historical access time of the target access personnel in the recent period for accessing the information associated with the target access information in the device in the associated device graph is statistically obtained, and to-be-tested access time data is obtained; The normal visited time period of the device in the associated device graph for accessing the information associated with the target access information is statistically obtained, the abnormal access time in the to-be-tested access time data is judged according to the normal visited time period, and a time access judgment result is outputted; The abnormal access time proportion in the time access judgment result is statistically obtained, an abnormal visit time proportion value is obtained, the time continuity of the abnormal access time in the time access judgment result is statistically obtained, an abnormal visit time continuity is obtained, the abnormal visit time proportion value and the abnormal visit time continuity are summed up, and a visit time characteristic data is obtained.
[0008] Preferably, the sensitivity of the target access information, the accessed information of the information associated with the target access information, and the target access information accessed by the target access personnel in the associated device graph are statistically obtained, an information access sensitivity set is obtained, the values of the sensitivities in the information access sensitivity set are superposed, and a comprehensive sensitivity is obtained. If the device with sensitive access information in the associated device map is accessed in a concentrated manner, the access concentration is counted to obtain the access concentration; If the device with sensitive access information in the associated device map is accessed in a scattered manner, the scattering uniformity is counted to obtain the access scattering uniformity; The access concentration and the access scattering uniformity are combined into an access feature value, and the integrated sensitivity and the access feature value are summed to obtain a preprocessed access abnormal weight value.
[0009] Preferably, when the abnormal access time proportion value is greater than or equal to the access time abnormal threshold value, and the preprocessed access abnormal weight value is greater than or equal to the access abnormal weight threshold value, it is determined that the behavior of the target access person accessing the target access information is an abnormal access, and a secondary abnormal access behavior warning is performed, and a secondary warning result is output; When the abnormal access time proportion value is less than the access time abnormal threshold value, and the preprocessed access abnormal weight value is less than the access abnormal weight threshold value, it is determined that the behavior of the target access person accessing the target access information is a safe access; When the abnormal access time proportion value is greater than or equal to the access time abnormal threshold value, the preprocessed access abnormal weight value is less than the access abnormal weight threshold value, or when the abnormal access time proportion value is less than the access time abnormal threshold value, the preprocessed access abnormal weight value is greater than or equal to the access abnormal weight threshold value, the verification information is output.
[0010] Preferably, according to the verification information, a to-be-tested access person with the same position as the target access person is obtained, a to-be-tested access abnormal weight value one of the to-be-tested access person in the associated device map is counted according to the associated device map and the preprocessed access abnormal weight value, the maximum value and the minimum value in the to-be-tested access abnormal weight value one are removed to obtain a screened access abnormal weight value one, and the screened access abnormal weight value one is averaged to obtain an abnormal weight peak threshold value; A to-be-tested access abnormal weight value two of the to-be-tested access person in the associated device map is counted, and the maximum value and the minimum value in the to-be-tested access abnormal weight value two are removed to obtain a screened access abnormal weight value two, and the screened access abnormal weight value two is averaged to obtain an abnormal weight low peak threshold value.
[0011] Preferably, according to the preprocessed access abnormal weight value, a peak access abnormal weight value of the target access person in the associated device map is counted, and a low peak access abnormal weight value of the target access person in the associated device map is counted; It is judged whether the peak access abnormal weight value is greater than or equal to the abnormal weight peak threshold value, and a judgment result one is output, and it is judged whether the low peak access abnormal weight value is greater than or equal to the abnormal weight low peak threshold value, and a judgment result two is output; If the judgment result one and the judgment result two are both no, it is determined that the behavior of the target access person accessing the target access information is safe access; If at least one of the judgment result one and the judgment result two is yes, it is determined that the behavior of the target access person accessing the target access information is abnormal access, and a secondary abnormal access behavior warning is performed, and a secondary warning result is output.
[0012] Compared with the prior art, the present application has the following characteristics and beneficial effects: By preliminarily detecting the sensitivity of the target access information accessed by the target access person, if the sensitivity exceeds the information sensitivity interval value, it can be directly determined as abnormal access behavior, and a primary abnormal access behavior warning is performed, if it is within the information sensitivity interval value, it cannot be directly determined as abnormal access behavior or safe access behavior, further access data analysis is required for verification, to avoid the misjudgment caused by directly determining the access of sensitive data by the target access person during the non-normal working period as abnormal access behavior in the traditional technology, because the event has contingency, further analysis is required by expanding the data range, to improve the rigor of the hospital network security event warning management work and the efficiency of the warning judgment work, that is, the equipment accessed by the target access person in the recent historical period is graphically constructed according to the correlation between the target access information, so as to intuitively detect the access path rule of the target access person, in addition to the abnormal judgment of the access time, the continuity of the abnormal access time also needs to be considered, and the comprehensive sensitivity of the access sensitive information contained in each access equipment and the target access information also needs to be considered, according to the two main characteristic data, whether they all meet the safety threshold, if yes, it is determined as safe access behavior, if no, it is determined as abnormal access behavior, and a secondary abnormal access behavior warning is performed, if at least one is no, secondary verification processing is continued, at this time, the access characteristic data of other access persons in the same position as the target access person is used for auxiliary analysis, that is, the access data in the peak period and the low peak period is classified and analyzed, through the above-mentioned multiple situation abnormal access behavior severity level division warning and multiple verification analysis, the warning efficiency is further improved, and the probability of misjudgment or omission is reduced. BRIEF DESCRIPTION OF DRAWINGS
[0013] Figure 1 is a step block diagram of a hospital network security event emergency response management method mainly embodied by the present embodiment. DETAILED DESCRIPTION
[0014] The present application will be further described in detail below in combination with the following embodiments.
[0015] REFERENCE Figure 1 A hospital network security event emergency response management method, the method comprising the following steps: Step S1, obtaining target access information of a current target access person, if the sensitivity of the target access information is not less than the information sensitivity interval value, outputting a first-level early warning result, if the sensitivity of the target access information is in the information sensitivity interval value, statistics the associated equipment graph between the target access person and the equipment related to the target access information in the recent historical period.
[0016] Step S2, statistics the abnormal access time proportion and continuity of the target access person to the equipment in the associated equipment graph and the information associated with the target access information, obtaining visit time feature data, and comprehensively statistics the accessed information sensitivity, equipment access concentration or dispersion uniformity of the target access person and the information associated with the target access information in the associated equipment graph, obtaining a pre-processing visit number abnormal weight value.
[0017] Step S3, presetting visit time abnormal threshold and visit number abnormal weight threshold, when the visit time feature data is greater than or equal to the visit time abnormal threshold, or, the pre-processing visit number abnormal weight value is greater than or equal to the visit number abnormal weight threshold, outputting a verification information, obtaining a to-be-tested access person with the same position as the target access person, statistics the visit number abnormal weight value of the to-be-tested access person in the associated equipment graph equipment access belongs to the peak period and the low peak period, obtaining an abnormal weight peak threshold and an abnormal weight low peak threshold, judging the access data of the target access person in the associated equipment graph equipment access belongs to the peak period and the low peak period as an abnormal state, outputting a second-level early warning result.
[0018] Specifically, by preliminarily detecting the sensitivity of the target access information accessed by the target access personnel, if the sensitivity exceeds the information sensitive interval value, it can be directly determined as abnormal access behavior, and a first-level abnormal access behavior warning is performed, if it is within the information sensitive interval value, it cannot be directly determined as abnormal access behavior or safe access behavior, further access data analysis is required for verification, to avoid the misjudgment caused by directly determining the target access personnel as abnormal access behavior during the non-normal working period, because the event has contingency, further analysis is required to expand the data range, to improve the rigor of the hospital network security event warning management work and the efficiency of the warning judgment work, that is, the devices accessed by the target access personnel in the recent history period are constructed into a graph according to the relevance between the target access information, so as to intuitively detect the access path rule of the target access personnel, in addition to the abnormal judgment of the access time, the continuity of the abnormal access time also needs to be considered, and the comprehensive sensitivity of the access sensitive information contained in each access device and the target access information also needs to be considered, according to the two main characteristic data, whether they all meet the safety threshold, if so, it is determined as safe access behavior, if not, it is determined as abnormal access behavior, and a second-level abnormal access behavior warning is performed, if at least one is no, then continue the secondary verification processing, at this time, the access characteristic data of other access personnel in the same position as the target access personnel is used for auxiliary analysis, that is, the access data in the peak period and the low peak period is classified and analyzed, through the above-mentioned multiple situation abnormal access behavior severity level division warning and multiple verification analysis, the warning efficiency is further improved and the probability of misjudgment or omission is reduced.
[0019] The specific step S1 includes the following sub-steps: The sensitivity of the target access information is detected, the information sensitive interval value is preset, if the sensitivity of the target access information is not less than the information sensitive interval value, a first-level abnormal access behavior warning is performed, and a first-level warning result is output.
[0020] If the sensitivity of the target access information is less than the information sensitive interval value, it is determined that the behavior of the target access personnel accessing the target access information is safe access.
[0021] If the sensitivity of the target access information is within the information sensitive interval value, the access device to which the target access information belongs is marked to obtain a main access device.
[0022] The auxiliary access device accessed by the target access personnel in the recent history period is obtained, the target access information is extracted from the auxiliary access device, the target access information is associated with the target access information, the target access information is associated with the target access information, and the target access information is associated with the target access information.
[0023] Specifically, as the target access personnel refers to the hospital internal personnel, the sensitivity of the target access information (for example, the proportion of sensitive data contained in the target access information) is detected, a preset information sensitive interval value (which can be set by itself and can be dynamically adjusted, that is, real-time adjustment according to historical detection data), a first warning result (such as directly closing the access channel, encrypting the password and locking, so that the target access personnel cannot perform the next step of authorized access), if the sensitivity of the target access information is in the information sensitive interval value (this case is not good for directly judging whether it is an abnormal data access, in order to reduce the probability of misjudgment or omission, the next step of expanding the range of access feature data analysis is performed, that is, further verification analysis), the main access device (referring to the device to which the target access personnel accesses the target access information), the auxiliary access device (such as the recent historical period access refers to one day, the recent two days, three days, one week, etc. The recent historical period, the auxiliary access device refers to all devices accessed by the target access personnel in the recent historical period), the to-be-measured access device (for example, the auxiliary access device includes device 1, device 2, device 3, device 4, and device 5, wherein the information accessed by the target access personnel in device 1, device 3, device 4, and device 5 is related to the target access information, for example, the target access information contains patient disease data information and identity information, and the information accessed by the target access personnel in device 1, device 3, device 4, and device 5 is partially the same as the patient disease data information or contains partially the same identity information, then device 1, device 3, device 4, and device 5 are to-be-measured access devices), and the associated device graph (that is, the main access device-device 1-device 3-device 4-device 5, wherein the accessed information is associated with the target access information).
[0024] The specific step S2 includes the following sub-steps: The recent period of time of the target access personnel accessing the associated device graph is counted, and the to-be-measured access time data is obtained.
[0025] The normal visited time period of the device in the associated device graph is counted, and the abnormal access time in the to-be-measured access time data is judged according to the normal visited time period, and the time access judgment result is output.
[0026] The proportion of abnormal access time in the time access judgment result is counted to obtain the abnormal visit time proportion value, and the time continuity of the abnormal access time in the time access judgment result is counted to obtain the abnormal visit time continuity, and the sum of the abnormal visit time proportion value and the abnormal visit time continuity is obtained. The visit time feature data is obtained.
[0027] The target access information of the target access personnel in the associated device graph is accessed, the accessed information associated with the target access information is accessed, the sensitivity of the sensitive access information is counted, the information access sensitivity set is obtained, the values of each sensitivity in the information access sensitivity set are superimposed, and the comprehensive sensitivity is obtained.
[0028] If the device with sensitive access information in the associated device graph is accessed in a concentrated manner, the access concentration is counted, and the access concentration is obtained.
[0029] If the device with sensitive access information in the associated device graph is accessed in a scattered manner, the dispersion uniformity is counted, and the access dispersion uniformity is obtained.
[0030] The access concentration and the access dispersion uniformity are combined into an access feature value, the comprehensive sensitivity and the access feature value are summed, and the pre-processing visit abnormal weight value is obtained.
[0031] Specifically, as the to-be-tested access time data (referring to the time when the main access device, device 1, device 3, device 4, and device 5 are accessed respectively, which are t1, t2, t3, t4, and t5 respectively), the normal visited time period (for example, the normal working time period, the morning normal working time period, the noon normal working time period, and the evening normal working time period), the time access judgment result (for example, t1, t2, t3, t4, and t5 are compared with the morning normal working time period, the noon normal working time period, and the evening normal working time period in turn to determine whether it is within the normal visited time period or outside the normal visited time period, and if t1, t2, and t4 are outside the normal visited time period and t4 and t5 are within the normal visited time period), the abnormal visit time proportion value (3 / 5), the abnormal visit time continuity (2 / 5: t1 and t2 are continuous for two times, 3 / 4: t2 and t4 are discontinuous with t3 in between, and so on: for example, if it is 2 / 4: t1 and t4 are discontinuous with t2 and t3 in between, if it is 1 / 4: t1 and t5 are discontinuous with t2, t3, and t4 in between, and if it is 1: t1 and t2 are continuous), the visit time characteristic data (3 / 5+3 / 10=0.9), the information access sensitivity set (if the sensitivity of the target access information is 40%, the information accessed by the target access personnel on device 1, device 3, device 4, and device 5 is partially the same as the patient's disease data information or contains partially the same identity information: the sensitivity is 20%, 15%, 10%, and 5% respectively), the comprehensive sensitivity (90%), the set visit concentration (for example, the correlation device graph: main access device-device 1-device 3-device 4-device 5, the concentration of device 1, device 3, device 4, and device 5 is mainly statistically analyzed, and the set visit concentration is (3 / 5)*(3 / 4)=9 / 20. The higher the concentration of the accessed device, the more likely it is that the access behavior is abnormal, and there is a high possibility of unreasonable information access), the set visit dispersion uniformity (by analogy, the lower the set visit dispersion uniformity, the more likely it is that the access behavior is abnormal, and there is a high possibility of unreasonable information access, and vice versa), and the preprocessing visit number abnormal weight value (here, the preprocessing visit number abnormal weight value is 9 / 10+9 / 20=27 / 20, which is illustrated by the case that the device with sensitive access information in the correlation device graph is accessed in a concentrated manner).
[0032] The specific step S3 includes the following sub-steps: The preset visit time abnormal threshold and the visit number abnormal weight threshold are set. When the abnormal visit time proportion value is greater than or equal to the visit time abnormal threshold, and the pretreatment visit number abnormal weight value is greater than or equal to the visit number abnormal weight threshold, it is determined that the behavior of the target access personnel to the target access information is abnormal access, and a secondary abnormal access behavior warning is performed, and a secondary warning result is output.
[0033] When the abnormal visit time proportion value is less than the visit time abnormal threshold, and the pretreatment visit number abnormal weight value is less than the visit number abnormal weight threshold, it is determined that the behavior of the target access personnel to the target access information is safe access.
[0034] When the abnormal visit time proportion value is greater than or equal to the visit time abnormal threshold, and the pretreatment visit number abnormal weight value is less than the visit number abnormal weight threshold, or when the abnormal visit time proportion value is less than the visit time abnormal threshold, and the pretreatment visit number abnormal weight value is greater than or equal to the visit number abnormal weight threshold, a verification information is output.
[0035] According to the verification information, a to-be-tested access personnel in the same position as the target access personnel is obtained, a to-be-tested visit number abnormal weight value one of the to-be-tested access personnel in a peak period of the device in the associated device graph is counted according to the associated device graph and the pretreatment visit number abnormal weight value, the maximum value and the minimum value in the to-be-tested visit number abnormal weight value one are removed, a screened visit number abnormal weight value one is obtained, and the screened visit number abnormal weight value one is averaged to obtain an abnormal weight peak threshold.
[0036] A to-be-tested visit number abnormal weight value two of the to-be-tested access personnel in a low-peak period of the device in the associated device graph is counted, the maximum value and the minimum value in the to-be-tested visit number abnormal weight value two are removed, a screened visit number abnormal weight value two is obtained, and the screened visit number abnormal weight value two is averaged to obtain an abnormal weight low-peak threshold.
[0037] According to the pretreatment visit number abnormal weight value, a peak visit number abnormal weight value in a peak period and a low-peak visit number abnormal weight value in a low-peak period of the target access personnel in the associated device graph are counted.
[0038] It is determined whether the peak visit number abnormal weight value is greater than or equal to the abnormal weight peak threshold, and a determination result one is output. It is determined whether the low-peak visit number abnormal weight value is greater than or equal to the abnormal weight low-peak threshold, and a determination result two is output.
[0039] If the determination result one and the determination result two are both no, it is determined that the behavior of the target access personnel to the target access information is safe access.
[0040] If at least one of the determination result one and the determination result two is yes, it is determined that the behavior of the target access personnel to the target access information is abnormal access, and a secondary abnormal access behavior warning is performed, and a secondary warning result is output.
[0041] Specifically, as the preset visit time abnormal threshold value and the visit number abnormal weight threshold value (both are obtained according to historical access record data for self-adjusting setting, if T and Q respectively, that is, the critical values for determining abnormal data), the secondary warning result (when 0.9 is greater than or equal to T, and 27 / 20 is also greater than or equal to Q, it can be directly determined that the target access personnel's behavior of accessing target access information is abnormal access, therefore, the sensitivity of the target access information is in the information sensitive interval value, and secondary abnormal access behavior warning is performed, otherwise, it is indicated that the target access personnel's access behavior of accessing target access information belongs to a security event, because the access characteristic data is in the normal index, and the access at this time is most likely an accidental event, such as overtime data arrangement), the verification information (if the abnormal visit time proportion value is compared with the visit time abnormal threshold value, and the preprocessed visit number abnormal weight value is compared with the visit number abnormal weight threshold value, only one comparison result is that the former is less than the latter, then in order to reduce the probability of misjudgment, secondary verification analysis is performed, because there may be errors in the data processing process or inaccurate data collection), the first to be measured visit number abnormal weight value (that is, according to the preprocessed visit number abnormal weight value, and the same is true, and the associated device graph of the to-be-measured access personnel belongs to the same access as the target access personnel, in order to reduce the regularity error of different data, the peak period here refers to the high frequency of the accessed device in the associated device graph in the recent historical period, and the peak period access is most likely to exist confused malicious access, so that the differential data access characteristic analysis needs to be performed), the second to be measured visit number abnormal weight value (the maximum value and the minimum value in the second to be measured visit number abnormal weight value are removed, so as to reduce the error interference of accidental data that is too large or too small), the abnormal weight peak threshold value (that is, a maximum safety threshold value of the peak period is obtained), the abnormal weight low peak threshold value (the same is true, the low peak period refers to the low frequency of the accessed device in the associated device graph in the recent historical period, and the low peak period access is most likely to exist unintentional malicious access, so that the differential data access characteristic analysis needs to be performed, that is, a maximum safety threshold value of the low peak period is obtained), the peak visit number abnormal weight value and the low peak visit number abnormal weight value (according to the preprocessed visit number abnormal weight value, and the same is true), the peak visit number abnormal weight value is compared with the abnormal weight peak threshold value, and the low peak visit number abnormal weight value is compared with the abnormal weight low peak threshold value, if both judgment results are that the former is greater than or equal to, it is indicated that the target access personnel's access behavior of accessing target access information is unreasonable, and timely warning is performed, therefore, the sensitivity of the target access information is in the information sensitive interval value, and secondary abnormal access behavior warning is performed, otherwise, one of the judgment results is that the former is less than the latter, it is indicated that the target access personnel's access behavior of accessing target access information is an accidental behavior, for example, a sudden illness event needs to be queried, that is, a security event, and a security access behavior is determined.
[0042] The above are all preferred embodiments of the present application, and do not limit the protection scope of the present application, so that: all equivalent changes made according to the structure, shape, principle of the present application should be covered in the protection scope of the present application.
Claims
1. A hospital network security incident emergency response management method, characterized by, The method comprises the following steps: Step S1, obtaining target access information of a current target access person, if the sensitivity of the target access information is not less than an information sensitivity interval value, outputting a first-level early warning result, if the sensitivity of the target access information is in the information sensitivity interval value, statistics of an associated device graph between devices accessed by the target access person in a recent historical period and information associated with the target access information are obtained; Step S2, statistics of abnormal access time proportion and continuity of the target access person to the devices in the associated device graph and information associated with the target access information are obtained, and pre-processing visit number abnormal weight values are obtained by comprehensively statistics of the accessed information sensitivity, device access concentration or dispersion uniformity of the target access person to the information associated with the target access information in the associated device graph; Step S3, presetting visit time abnormal threshold and visit number abnormal weight threshold, when the visit time characteristic data is greater than or equal to the visit time abnormal threshold, or the pre-processing visit number abnormal weight value is greater than or equal to the visit number abnormal weight threshold, outputting a follow-up verification information, obtaining a to-be-tested access person with the same position as the target access person, statistics of visit number abnormal weight values of the to-be-tested access person to the devices in the associated device graph in peak period and off-peak period are obtained, and abnormal weight peak threshold and abnormal weight off-peak threshold are obtained, the access data of the target access person in the peak period and off-peak period of the devices in the associated device graph is determined as an abnormal state, and a second-level early warning result is outputted.
2. The hospital network security incident emergency response management method of claim 1, wherein, Step S1 comprises: Sensitivity detection is performed on the target access information, an information sensitivity interval value is preset, if the sensitivity of the target access information is not less than the information sensitivity interval value, a first-level abnormal access behavior early warning is performed, and a first-level early warning result is outputted; If the sensitivity of the target access information is less than the information sensitivity interval value, it is determined that the behavior of the target access person to the target access information is safe access; If the sensitivity of the target access information is in the information sensitivity interval value, the access device to which the target access information belongs is marked, and a main access device is obtained; Obtaining auxiliary access devices accessed by the target access person in a recent historical period, extracting to-be-tested access devices from the auxiliary access devices according to the target access information, the to-be-tested access devices are associated with the main access device to construct a device association graph, and an associated device graph is obtained.
3. The hospital network security incident emergency response management method of claim 2, wherein, Step S2 comprises: Statistics of historical access time of the target access person to the devices in the associated device graph in a recent period are obtained, and to-be-tested access time data are obtained; Statistics of normal visited time periods of the devices in the associated device graph are obtained, and abnormal access time in the to-be-tested access time data is determined according to the normal visited time periods, and a time access judgment result is outputted; The abnormal access time proportion in the time access judgment result is counted to obtain an abnormal access time proportion value, and the time continuity of the abnormal access time in the time access judgment result is counted to obtain an abnormal access time continuity, and the abnormal access time proportion value and the abnormal access time continuity are summed to obtain the access time feature data.
4. The hospital network security incident emergency response management method of claim 3, wherein, Step S2 further includes: The sensitivity of the sensitive access information is counted for the target access information of the target access personnel in the associated device graph and the accessed information associated with the target access information, to obtain an information access sensitivity set, and the values of the sensitivities in the information access sensitivity set are superimposed to obtain a comprehensive sensitivity; If the devices with sensitive access information in the associated device graph are accessed in a concentrated manner, the access concentration is counted to obtain a device access concentration; If the devices with sensitive access information in the associated device graph are accessed in a scattered manner, the scattering uniformity is counted to obtain a device access scattering uniformity; The device access concentration and the device access scattering uniformity are combined to obtain a device access feature value, and the comprehensive sensitivity and the device access feature value are summed to obtain a preprocessed access number abnormal weight value.
5. The hospital network security incident emergency response management method of claim 4, wherein, Step S3 includes: The abnormal access time threshold and the access number abnormal weight threshold are preset, and when the abnormal access time proportion is greater than or equal to the access time abnormal threshold, and the preprocessed access number abnormal weight value is greater than or equal to the access number abnormal weight threshold, it is determined that the behavior of the target access personnel to access the target access information is abnormal access, and a secondary abnormal access behavior warning is performed, and a secondary warning result is output; When the abnormal access time proportion is less than the access time abnormal threshold, and the preprocessed access number abnormal weight value is less than the access number abnormal weight threshold, it is determined that the behavior of the target access personnel to access the target access information is safe access; When the abnormal access time proportion is greater than or equal to the access time abnormal threshold, and the preprocessed access number abnormal weight value is less than the access number abnormal weight threshold, or when the abnormal access time proportion is less than the access time abnormal threshold, and the preprocessed access number abnormal weight value is greater than or equal to the access number abnormal weight threshold, a verification information is output.
6. The hospital network security incident emergency response management method of claim 5, wherein, Step S3 further includes: According to the verification information, a to-be-tested access personnel in the same position as the target access personnel is obtained, a to-be-tested access number abnormal weight value one of the to-be-tested access personnel in the peak period of the device access in the associated device graph is counted according to the associated device graph and the preprocessed access number abnormal weight value, the maximum value and the minimum value in the to-be-tested access number abnormal weight value one are removed, a filtered access number abnormal weight value one is obtained, and an average value of the filtered access number abnormal weight value one is obtained to obtain an abnormal weight peak threshold; A to-be-tested access number abnormal weight value two of the to-be-tested access personnel in the off-peak period of the device access in the associated device graph is counted, the maximum value and the minimum value in the to-be-tested access number abnormal weight value two are removed, a filtered access number abnormal weight value two is obtained, and an average value of the filtered access number abnormal weight value two is obtained to obtain an abnormal weight off-peak threshold.
7. The hospital network security incident emergency response management method of claim 6, wherein, Step S3 further includes: According to the preprocessed access number abnormal weight value, a peak access number abnormal weight value in the peak period and an off-peak access number abnormal weight value in the off-peak period of the device access in the associated device graph by the target access personnel are counted. determining whether the peak-visit-abnormal-weight value is greater than or equal to an abnormal weight peak threshold value, and outputting a determination result one, and determining whether the low-peak-visit-abnormal-weight value is greater than or equal to an abnormal weight low-peak threshold value, and outputting a determination result two; if both the determination result one and the determination result two are no, it is determined that the behavior of the target access person in accessing the target access information is safe access; if at least one of the determination result one and the determination result two is yes, it is determined that the behavior of the target access person in accessing the target access information is abnormal access, and a secondary abnormal access behavior warning is performed, and a secondary warning result is output.