Fine-grained logging and rollback method and apparatus for tomo system operational behavior

Abstract

This application discloses a fine-grained logging and backtracking method and apparatus for the operational behavior of the TOMO system, relating to the field of medical technology. The method includes: acquiring raw operational data through multi-source acquisition; performing semantic recognition on the raw operational data according to a preset domain model to obtain standardized semantic events, and binding clinical context information to the standardized semantic events; aggregating the standardized semantic events into target sessions based on the clinical context information, and constructing a target event chain according to the temporal order and causal relationship of each standardized semantic event within the target session; differentially storing the data in the target event chain according to the risk level of the standardized semantic events; and, in response to a backtracking request, driving a three-dimensional digital twin model to simulate and reproduce the physical device behavior of the TOMO system based on the target event chain. This application solves the technical problems of coarse-grained log acquisition software and lack of domain-specific adaptation in existing technologies.

Description

Technical Field

[0001] This application relates to the field of medical technology, and more specifically, to a method and apparatus for fine-grained logging and backtracking of the operational behavior of a TOMO system. Background Technology

[0002] The operation log of the TOMO (Tomotherapy) system serves as a key data carrier for recording the system's operational status and user interactions. Its collection granularity and domain adaptability directly affect the accuracy of medical accident tracing and process compliance auditing.

[0003] In related technologies, log management software for medical devices often adopts a generalized design, with coarse-grained data collection. It only records information at the node level of the treatment process, lacking the ability to capture human-computer interaction behaviors and specific designs for TOMO parameters such as blade movement and gantry angle adjustment. This leads to log data easily becoming disconnected from clinical operating procedures. Furthermore, the backtracking process relies on manual text retrieval, lacking sufficient visualization and intelligence, making it difficult to meet the quality control needs of precision medicine.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This application provides a method and apparatus for fine-grained logging and backtracking of the operational behavior of the TOMO system, so as to at least solve the technical problems of coarse-grained log collection software and lack of domain-specific adaptation in the prior art.

[0006] According to one aspect of this application, a fine-grained logging and backtracking method for the operational behavior of a TOMO system is provided, comprising: acquiring raw operational data through multi-source acquisition operations, wherein the multi-source acquisition operations include listening operations on system interfaces and identifying operations on operational interfaces; performing semantic recognition on the raw operational data according to a preset domain model to obtain standardized semantic events, and binding clinical context information to the standardized semantic events, wherein the standardized semantic events are used to represent atomic operation records with clinically understood semantic information, and the domain model is a data structure for software-based modeling of atomic operations and parameters of the TOMO system; aggregating the standardized semantic events into target sessions based on clinical context information, and constructing target event chains according to the temporal order and causal relationship of each standardized semantic event within the target session, wherein the target event chains are used to represent the temporal association and causal dependency relationship between atomic operations in the same event process; performing differentiated storage of data in the target event chains according to the risk level of the standardized semantic events, wherein the differentiated storage is used to adaptively encode and hierarchically store the data according to the risk level; and responding to a backtracking request, driving a three-dimensional digital twin model to simulate and reproduce the physical device behavior of the TOMO system according to the target event chains.

[0007] Optionally, raw operation data is acquired through multi-source acquisition operations, including: deploying a read-only acquisition agent system, wherein the acquisition agent system includes at least a database acquisition unit, an interface acquisition unit, a system event acquisition unit, and an interface recognition unit; reading metadata from the TOMO system's directory through the database acquisition unit, monitoring parameter change data in the communication interface through the interface acquisition unit, obtaining state change information of the TOMO system's workstation operating system and TOMO system processes through the system event acquisition unit, and performing lightweight monitoring of the operation interface through the interface recognition unit, which is used to record control operation behavior; merging and deduplicating the data acquired by the database acquisition unit, interface acquisition unit, system event acquisition unit, and interface recognition unit to obtain the raw operation data.

[0008] Optionally, semantic recognition is performed on the original operation data according to a preset domain model to obtain standardized semantic events. This includes: semantic recognition of the original operation data through the domain model to obtain atomic operation types corresponding to preset atomic operation definitions, wherein atomic operation types include navigation, parameter, and execution types, and the atomic operation type is the type to which an indivisible single human-computer interaction action related to the TOMO system belongs; the atomic operation definition is a data template for software-based decomposition, hierarchical classification, and fingerprint modeling of an indivisible single human-computer interaction action of the TOMO system; parameter parsing of the original operation data is performed according to preset TOMO object units within the domain model to extract treatment parameters, imaging parameters, and mechanical control parameters; wherein the TOMO object unit is a data structure for software abstract modeling of the treatment parameters, imaging parameters, mechanical control parameters, and session flow parameters of the TOMO system; the determined atomic operation types and the extracted treatment parameters, imaging parameters, and mechanical control parameters are encapsulated according to the preset event field structure within the domain model to generate standardized semantic events, wherein the event field structure includes event identifier, timestamp, operation object, values ​​before and after operation, risk level, and data collection source identifier.

[0009] Optionally, binding clinical context information to standardized semantic events includes: detecting whether a unique clinical data identifier exists in the standardized semantic event, wherein the unique clinical data identifier is used to uniquely identify clinical data objects under medical digital imaging and communication standards; if a unique clinical data identifier is detected in the standardized semantic event, querying the associated clinical context information based on the unique clinical data identifier, and binding the queried clinical context information with the standardized semantic event, wherein the clinical context information includes: patient identifier, treatment plan identifier, and treatment fractionation identifier; if a unique clinical data identifier is detected not in the standardized semantic event, performing correlation matching between the timestamp of the standardized semantic event and the time window of the clinical record to obtain the clinical context information corresponding to the standardized semantic event, and then binding the obtained clinical context information with the standardized semantic event.

[0010] Optionally, a target event chain is constructed based on the temporal order and causal relationship of each standardized semantic event within the target session, including: sorting each standardized semantic event within the target session according to timestamps to obtain a time series; traversing the time series and determining the causal relationship between each standardized semantic event based on the state changes of the operation object; constructing a directed acyclic graph with standardized semantic events as nodes and temporal order and causal relationship as directed edges; and using the directed acyclic graph as the target event chain.

[0011] Optionally, the data in the target event chain is stored differentially according to the risk level of the standardized semantic events, including: identifying the risk level of the standardized semantic events in the target event chain, wherein the risk level includes at least a first risk level, a second risk level, and a third risk level with decreasing risk; when the risk level of the standardized semantic event is the first risk level, the standardized semantic event and the snapshot data associated with the standardized semantic event are stored in full without loss; when the risk level of the standardized semantic event is the second risk level, the state change between the standardized semantic event and the previous standardized semantic event is determined and the state change is stored; when the risk level of the standardized semantic event is the third risk level, multiple standardized semantic events of the third risk level are aggregated, compressed, and stored according to a preset time window.

[0012] Optionally, the physical device behavior of the TOMO system is simulated and reproduced using a 3D digital twin model driven by the target event chain. This includes: constructing a 3D digital twin model of the TOMO system, wherein the 3D digital twin model includes software mappings of device operation logic, parameter change characteristics, and dose output characteristics; parsing each standardized semantic event into driving instructions according to the time sequence in the target event chain and the software mappings in the 3D digital twin model; controlling the 3D digital twin model to reproduce parameter changes and operational actions according to the driving instructions, and displaying parameter curves and operation timelines in a 3D operation sandbox, wherein the 3D operation sandbox is used to provide a visual interactive interface to support multi-dimensional linkage playback of the treatment process.

[0013] Optionally, the fine-grained logging and backtracking method for TOMO system operation behavior also includes root cause analysis based on the comparison results between the target event chain and the preset standard process. The root cause analysis includes: comparing the target event chain with the preset TOMO standard treatment process model to identify process deviations and abnormal operation sequences, wherein the preset TOMO standard treatment process model is used to represent the preset standard process in software form; when abnormal operation sequences are identified, an analysis algorithm is used to trace back from the end event of the abnormal operation sequence to the root cause event, wherein the analysis algorithm is used to decompose the abnormal results layer by layer to the bottom cause event through logical gate relationships; and generating a structured backtracking report based on the risk level of the standardized semantic event corresponding to the root cause event, wherein the structured backtracking report includes an operation timeline, an anomaly summary, and root cause analysis results.

[0014] Optionally, the fine-grained logging and backtracking method for TOMO system operation behavior further includes: associating a multi-source evidence fingerprint with each standardized semantic event, wherein the multi-source evidence fingerprint includes a collection source identifier, an original data hash value, and a snapshot identifier, and the multi-source evidence fingerprint is used to cross-validate data obtained from different collection sources; determining the hash value of the standardized semantic event based on the hash value of the preceding standardized semantic event, and linking the hash values ​​of each standardized semantic event in chronological order to construct a hash chain, wherein the hash chain is used to verify the integrity of the log data; storing the hash chain and recording access logs for data in the target event chain, wherein the access logs are used to generate audit trajectory information, and the audit trajectory information is used to trace data access behavior.

[0015] According to another aspect of the embodiments of this application, a fine-grained log recording and backtracking device for the operation behavior of the TOMO system is also provided, comprising: an acquisition unit, configured to acquire raw operation data through multi-source acquisition operations, wherein the multi-source acquisition operations include listening to the system interface and identifying the operation interface; a first processing unit, configured to perform semantic recognition on the raw operation data according to a preset domain model to obtain standardized semantic events, and bind clinical context information to the standardized semantic events, wherein the standardized semantic events are used to characterize atomic operation records with clinically understood semantic information, and the domain model is a data structure for software-based modeling of the atomic operations and parameters of the TOMO system; and a second processing unit. The system comprises four processing units: a first unit, which aggregates standardized semantic events into a target session based on clinical context information, and constructs a target event chain according to the temporal order and causal relationship of each standardized semantic event within the target session. The target event chain is used to characterize the temporal correlation and causal dependency between atomic operations in the same event process; a second processing unit, which performs differentiated storage of data in the target event chain according to the risk level of the standardized semantic events. The differentiated storage is used to adaptively encode and hierarchically store the data according to the risk level; and a third processing unit, which, in response to a backtracking request, drives a three-dimensional digital twin model to simulate and reproduce the physical equipment behavior of the TOMO system based on the target event chain.

[0016] According to another aspect of this application, a computer-readable storage medium is also provided, in which a computer program is stored, wherein, when the computer program is executed, the device on which the computer-readable storage medium is located performs the above-described fine-grained logging and backtracking method for TOMO system operation.

[0017] According to another aspect of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform the fine-grained logging and backtracking method for the TOMO system operation described above.

[0018] According to another aspect of this application, a computer program product is also provided, including a computer program or instructions, which, when executed by a processor, implement the fine-grained logging and backtracking method for the TOMO system operation behavior described above.

[0019] In this application, the log processing platform, through fine-grained acquisition at the atomic operation level and TOMO domain-specific modeling, facilitates the effective mapping of log data to clinical semantics. Non-invasive multi-source acquisition via monitoring and interface recognition enhances data integrity while ensuring device operational safety. Automatic binding of clinical context information and construction of target event chains reduce log fragmentation and support precise backtracking; differentiated storage based on risk awareness helps balance storage costs and query efficiency; and 3D digital twin visualization for backtracking enhances the practical value of log data. Without modifying the TOMO ontology software, the log processing platform enables fine-grained logging and intelligent backtracking throughout the entire process, thus solving the technical problems of coarse-grained log acquisition software and lack of domain-specific adaptation in existing technologies. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0021] Figure 1 This is a schematic diagram of an optional fine-grained logging and backtracking method for TOMO system operation behavior according to an embodiment of this application;

[0022] Figure 2 This is a schematic diagram of an optional fine-grained logging and backtracking device for TOMO system operation behavior according to an embodiment of this application. Detailed Implementation

[0023] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0024] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0025] It should also be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected in this application are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has interfaces with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface, and the relevant information is obtained only after receiving consent from the aforementioned user or organization.

[0026] According to an embodiment of this application, an embodiment of a fine-grained logging and backtracking method for the operational behavior of a TOMO system is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0027] According to the embodiments of this application, a log processing platform of the TOMO system (hereinafter referred to as the platform) can be used as the execution subject of the fine-grained logging and backtracking method of the TOMO system operation behavior in the embodiments of this application. The system can be a software system or an embedded system combining software and hardware. Of course, the execution subject of the method in the embodiments of this application can also be other forms of execution subject, such as devices, equipment, etc. Those skilled in the art should know that this application does not particularly limit the specific form of the execution subject.

[0028] Figure 1This is a schematic diagram of a fine-grained logging and backtracking method for the operational behavior of the TOMO system according to an embodiment of this application, as shown below. Figure 1 As shown, the method includes the following steps:

[0029] Step S101: Obtain raw operation data through multi-source acquisition operation, wherein the multi-source acquisition operation includes listening operation of system interface and identification operation of operation interface.

[0030] Optionally, multi-source acquisition can characterize the process of acquiring TOMO system operation trace data in parallel from multiple independent data sources using software. Raw operation data can characterize the unstructured, low-level data set that directly reflects the TOMO system's operating status, including system interface communication data, operating system event data, and interface control operation data. System interface monitoring can characterize the process of data transmission between the TOMO system and external systems through software monitoring of communication interfaces, capturing parameter changes and command interaction information. Interface recognition can characterize the process of lightweight monitoring of the TOMO interface using computer vision technology, identifying and recording interface control operation behaviors. The coordinated operation of system interface monitoring and interface recognition helps to comprehensively capture operation traces from both the communication protocol layer and the human-computer interaction layer. Cross-validation of multi-source data can improve the completeness and accuracy of the raw operation data.

[0031] For example, system interface monitoring can be performed by deploying a bypass monitoring tool at the network layer to capture medical digital imaging and communication standard data between the TOMO system and the medical image archiving system, recording parameter changes during treatment plan transmission, image data exchange, and other processes. User interface recognition can be achieved by capturing the TOMO workstation's display screen using screen capture technology, parsing the text information on the interface using optical character recognition algorithms, and combining this with computer vision technology to identify button clicks, parameter input box modifications, and other control operations. The raw operation data acquired through multi-source acquisition is then merged and deduplicated to form a complete operation trace record.

[0032] For example, multi-source data acquisition can employ a parallel acquisition architecture. The system interface monitoring operation captures treatment parameter modification records by monitoring the write log files of the TOMO system database. The user interface recognition operation uses computer vision technology to identify button click events and input box content changes within the user interface. Both types of acquisition operations send the captured data to a message queue in real time, where duplicate records are eliminated using a data deduplication algorithm and merged to form the original operation data. This parallel acquisition architecture helps record the same operational behavior from different dimensions, and cross-validation improves the accuracy of the original operation data.

[0033] Step S102: Semantic recognition is performed on the original operation data according to the preset domain model to obtain standardized semantic events, and clinical context information is bound to the standardized semantic events. The standardized semantic events are used to represent atomic operation records with clinically understood semantic information, and the domain model is a data structure for software-based modeling of atomic operations and parameters of the TOMO system.

[0034] Optionally, the log processing platform performs semantic recognition on the raw operation data based on a pre-defined domain model. The pre-defined domain model represents the data structure for software-based modeling of atomic operations and parameters of the TOMO system, including atomic operation definitions, TOMO object unit definitions, and event field structure definitions. The log processing platform can use pattern matching algorithms to map the raw operation data to predefined atomic operation types in the domain model and extract parameter information from the TOMO object units to generate standardized semantic events. Standardized semantic events can represent atomic operation records with clinically understandable semantic information, including event identifiers, timestamps, operation objects, pre- and post-operation values, and risk levels.

[0035] Optionally, the log processing platform can assign millisecond-level timestamps to standardized semantic events. These timestamps record the precise time of occurrence of the standardized semantic event, with a precision of one-thousandth of a second. Millisecond-level timestamps help distinguish multiple operations occurring within a short period, ensuring fine-grained time series analysis. Based on the integrity and consistency of multi-source collected data, the log processing platform assigns event confidence levels to standardized semantic events. Event confidence levels characterize the credibility of standardized semantic events. For example, standardized semantic events with marked confidence levels may include core events and auxiliary events, with core events having higher confidence levels than auxiliary events. Core events can refer to standardized semantic events that have undergone multi-source cross-validation and exhibit good data consistency; auxiliary events can refer to standardized semantic events reported by only a single data source and lacking cross-validation. Millisecond-level timestamps facilitate accurate reconstruction of the temporal relationships of operations, supporting microsecond-level causal analysis; event confidence level marking helps distinguish reliable evidence from reference information, improving the accuracy of subsequent analysis.

[0036] Log processing platforms can bind clinical context information to standardized semantic events. Clinical context information can represent clinical entities associated with TOMO operations, such as patient identifiers, treatment plan identifiers, image-guided session identifiers, and treatment fractionation identifiers. The log processing platform can prioritize querying associated clinical context information using unique identifiers from medical digital imaging and communication standards. In the absence of explicit identifiers, indirect matching can be performed using time window relevance algorithms. Binding clinical context information to standardized semantic events helps establish the relationship between log data and clinical processes, improving the contextual organization and retrieval efficiency of log data.

[0037] For example, after receiving the raw operation data, the log processing platform performs semantic recognition using a predefined domain model. The predefined domain model may include sixty-two predefined atomic operation types and TOMO object unit definitions. The log processing platform parses the operation control identifiers and parameter change characteristics in the raw operation data, matches the corresponding atomic operation types, and extracts treatment parameters such as field width and pitch factor, encapsulating them into standardized semantic events according to the event field structure. Subsequently, the log processing platform can detect whether the standardized semantic events contain unique identifiers for medical digital imaging and communication standards, and obtain the corresponding patient identifier, treatment plan identifier, and treatment fractionation identifier by querying the hospital information system, binding clinical context information to the standardized semantic events.

[0038] For example, the log processing platform can use a rule engine to perform semantic recognition on the raw operation data. A pre-defined domain model can define a rule base for operation features of three types of atomic operations: navigation, parameter, and execution. Based on the operation type encoding and interface change characteristics in the raw operation data, the log processing platform can determine the atomic operation type using a decision tree algorithm, generating standardized semantic events containing pre- and post-operation values ​​and risk levels. For standardized semantic events lacking unique identifiers in medical digital imaging and communication standards, the log processing platform uses a time window correlation algorithm to calculate the time overlap between the timestamp of the standardized semantic event and the clinical record, selecting patient identifiers and treatment stage identifiers with overlap exceeding a threshold to complete the binding of clinical context information.

[0039] Step S103: Based on clinical context information, standardized semantic events are aggregated into target sessions, and target event chains are constructed according to the temporal order and causal relationship of each standardized semantic event in the target session. The target event chain is used to characterize the temporal association and causal dependency between atomic operations in the same event process.

[0040] Optionally, the log processing platform can aggregate standardized semantic events into target sessions based on clinical context information. Clinical context information may include patient identifier, treatment date, and treatment session identifier. The log processing platform can use the patient identifier, treatment date, and treatment session identifier as aggregation keys to group standardized semantic events with the same aggregation key, forming independent target sessions. Each target session represents a complete event flow data unit, containing all operation records of a specific patient in a specific treatment session.

[0041] The log processing platform constructs a target event chain based on the temporal order and causal relationships of various standardized semantic events within the target session. The platform can sort these events by millisecond-level timestamps to determine their temporal order. It can also determine the causal relationships between these standardized semantic events based on the state changes of the operated objects. Furthermore, the platform can construct a directed acyclic graph (DAG) using standardized semantic events as nodes and temporal order and causal relationships as directed edges, thus forming the target event chain. This target event chain characterizes the temporal correlations and causal dependencies between atomic operations within the same event, helping to reconstruct the complete logical path of operations and state changes.

[0042] Session aggregation facilitates the organization of data by treatment dimension, enabling full-process traceability for specific treatments; causal chain construction clearly presents the comparison and correlation of states before and after the operation, helping to identify dependencies and impact paths between operations.

[0043] For example, the log processing platform extracts patient identifiers and treatment stage identifiers from standardized semantic events as aggregation keys, and groups standardized semantic events with the same patient identifier and treatment stage identifier to form target sessions. Within the target session, the log processing platform sorts the standardized semantic events according to millisecond-level timestamps to determine the temporal order. The log processing platform determines causal relationships based on changes in the state of the operated object; for example, it can establish a causal association between parameter modification operations and subsequent device state change operations. The log processing platform can construct a directed acyclic graph as the target event chain, using standardized semantic events as nodes and temporal order and causal relationships as directed edges, to represent the temporal associations and causal dependencies between atomic operations.

[0044] For example, the log processing platform can employ a composite key aggregation strategy, using a combination of patient identifier, treatment date, and sequence number as aggregation conditions to aggregate standardized semantic events that meet the conditions into a target session. The log processing platform maintains the TOMO system state machine model, tracking treatment phase transitions and device parameter changes within the target session. When a standardized semantic event triggers a state transition in the state machine, the log processing platform can establish a causal relationship between the standardized semantic event that triggered the transition and the standardized semantic event corresponding to the previous state. The log processing platform uses a graph database to store the target event chain, supporting fast causal path queries based on graph traversal algorithms.

[0045] Step S104: Differentiated storage of data in the target event chain is performed according to the risk level of standardized semantic events. The differentiated storage is used to adaptively encode and hierarchically store the data according to the risk level.

[0046] Optionally, the log processing platform can differentiate the storage of data in the target event chain based on the risk level of standardized semantic events. The risk level characterizes the safety level based on the degree of impact of atomic operations on treatment effectiveness; for example, the risk level characterization can include a first risk level, a second risk level, and a third risk level. The log processing platform can read the risk level field in the standardized semantic events, identify the risk level category, and determine the corresponding storage encoding strategy and storage medium configuration based on the risk level category, which is beneficial for achieving differentiated data storage processing.

[0047] Optionally, differentiated storage represents a software strategy that adaptively encodes and hierarchically stores data based on risk levels. For example, a log processing platform can use lossless encoding for full storage of standardized semantic events at the first risk level, along with associated snapshot data; use differential encoding to store parameter changes for standardized semantic events at the second risk level; and use aggregate compression encoding to compress and store standardized semantic events at the third risk level within a time window. Through differentiated storage strategies, the log processing platform helps reduce storage resource consumption while ensuring the integrity of critical operational data, balancing data traceability and storage costs.

[0048] For example, the log processing platform reads the risk level field of standardized semantic events in the target event chain. When the log processing platform identifies the risk level of a standardized semantic event as the first risk level, it stores the entire standardized semantic event in lossless JSON format and associates it with the interface snapshot data of key nodes. When the log processing platform identifies the risk level of a standardized semantic event as the second risk level, it calculates the parameter change between the current standardized semantic event and the previous standardized semantic event and stores only the parameter change. When the log processing platform identifies the risk level of a standardized semantic event as the third risk level, it aggregates multiple standardized semantic events with the third risk level according to a preset time window and performs aggregated and compressed storage using a compression algorithm.

[0049] For example, a log processing platform can employ a hybrid storage architecture combining time-series and relational databases. The platform stores device parameter change data for standardized semantic events in the target event chain in the time-series database, and clinical context metadata such as patient identifiers and treatment plan identifiers associated with these standardized semantic events in the relational database. This allows for the selection of targeted storage solutions based on the characteristics of different data types, balancing write performance and query flexibility. The platform categorizes standardized semantic events into hot and cold data based on their generation time. Events generated within the last three months are stored as hot data in high-speed storage, such as solid-state drives (SSDs), while events generated more than three months ago are migrated to archive storage and compressed. This separation of hot and cold data reduces storage costs while ensuring rapid access to frequently accessed data. The platform can establish multi-level indexes based on time, device, patient, and risk level, for example, using B+ trees or skip lists. Combining query rewriting and software caching mechanisms helps maintain a stable and short response time for historical data queries over a one-month period. Multi-level indexing and caching mechanisms help keep query response time within a short time, meeting the needs of real-time clinical backtracking.

[0050] Step S105: In response to the backtracking request, the physical device behavior of the TOMO system is simulated and reproduced using a 3D digital twin model driven by the target event chain.

[0051] Optionally, in response to a retrospective request, the log processing platform can drive a 3D digital twin model to simulate and reproduce the physical equipment behavior of the TOMO system based on the target event chain. The retrospective request represents a query command initiated by a user or the system to view historical treatment procedures. The 3D digital twin model represents a virtual mapping of the physical equipment of the TOMO system constructed through software, and may include equipment operation logic, parameter change characteristics, and kinematic models. The log processing platform parses standardized semantic events in the target event chain, converts these standardized semantic events into driving commands, and controls the 3D digital twin model to execute corresponding operational actions and state changes according to the chronological order of the target event chain, simulating and reproducing the physical equipment behavior of the TOMO system, such as gantry rotation, treatment bed displacement, and multi-leaf collimator blade opening and closing.

[0052] The log processing platform uses a 3D digital twin model to simulate and reproduce the abstract target event chain data, which helps to transform the equipment operation process into a visual one. This allows users to intuitively observe the equipment operation status and operation sequence in historical treatments, improving the intuitiveness of treatment process retrospection and reducing cognitive barriers in retrospective analysis. Furthermore, the 3D visualization helps to identify operational anomalies and process deviations, thereby improving analysis and quality control efficiency.

[0053] For example, after receiving a backtracking request, the log processing platform can extract standardized semantic events from the target event chain. The platform parses these standardized semantic events according to the chronological order of the target event chain, converting the operation types and parameter values ​​within them into driving instructions. Based on these driving instructions, the platform controls the virtual devices in the 3D digital twin model to perform rotation, translation, or deformation actions, driving the 3D digital twin model to simulate and reproduce the physical device behaviors of the TOMO system, such as changes in gantry angle, adjustment of the treatment bed position, and opening and closing of the multi-leaf collimator blades.

[0054] For example, upon receiving a backtracking request, the log processing platform can read the timestamps and event sequences from the target event chain. The platform parses standardized semantic events into control scripts for a 3D digital twin model, displaying parameter curves and an operation timeline in a 3D operation sandbox interface. The log processing platform drives the 3D digital twin model to reproduce the entire event process in a virtual reality environment, allowing users to observe the physical device behavior of the TOMO system from an immersive perspective using a virtual reality headset, and to view the parameter status at corresponding moments in the 3D operation sandbox.

[0055] In some optional embodiments, raw operation data is obtained through multi-source acquisition operations, including: the log processing platform can deploy a read-only acquisition agent system, wherein the acquisition agent system includes at least a database acquisition unit, an interface acquisition unit, a system event acquisition unit, and an interface recognition unit; the database acquisition unit reads metadata from the TOMO system's directory, the interface acquisition unit listens for parameter changes in the communication interface, the system event acquisition unit obtains the state change information of the TOMO system's workstation operating system and TOMO system processes, and the interface recognition unit performs lightweight monitoring of the operation interface to record control operation behavior. Then, the data acquired by the database acquisition unit, interface acquisition unit, system event acquisition unit, and interface recognition unit are merged and deduplicated to obtain the raw operation data.

[0056] Optionally, the read-only mode indicates that the operation of the TOMO ontology software is not modified, which helps to ensure the stability and security of the TOMO system, facilitates non-intrusive deployment, and avoids interference or risks to the normal operation of the TOMO system.

[0057] Optionally, the acquisition agent system may include a database acquisition unit, an interface acquisition unit, a system event acquisition unit, and an interface recognition unit. The database acquisition unit can obtain metadata from the TOMO system directory through a file reading interface. The interface acquisition unit can capture parameter change data transmitted through the communication interface using network monitoring tools; for example, the interface acquisition unit can monitor the TOMO system's DICOM, HL7, and DICOM-RTV standard interfaces. DICOM-RTV (Real-Time Video) is an extended protocol for medical digital imaging and communication standards used for real-time video transmission, specifically for transmitting megavolt-level computed tomography (CT) real-time image streams. The interface acquisition unit captures frame sequences from the DICOM-RTV video stream through port mirroring or network proxy methods, extracting image acquisition parameters and real-time status information, which is beneficial for capturing dynamic parameters during real-time image guidance.

[0058] Optionally, the system event acquisition unit can collect state change information of the workstation operating system and TOMO system processes through the system call interface provided by the operating system. The interface recognition unit can perform lightweight monitoring of the operation interface and record control operation behavior through screen capture technology and optical character recognition algorithms. For example, the interface recognition unit can use a lightweight OCR (Optical Character Recognition) software engine to monitor the operation interface. The lightweight OCR software engine uses optimized character recognition algorithms, is small in size, consumes few resources, and runs fast. It can be trained on common font, font size, and color features of medical interfaces, reducing computational resource consumption while ensuring recognition accuracy. The lightweight OCR software engine supports selective region recognition, parsing only the text in key control areas, reducing the overhead of full-screen scanning, which is beneficial for achieving efficient interface text recognition on resource-constrained TOMO workstations. Through the collaborative operation between various acquisition units in the acquisition agent system, it is helpful to comprehensively capture operation traces from four dimensions: storage layer, communication layer, system layer, and interface layer.

[0059] Optionally, the merging operation represents the process of integrating multi-source heterogeneous data into a unified dataset. The deduplication operation represents the process of eliminating duplicate records through data fingerprint comparison or time-series alignment algorithms. Through merging and deduplication operations, redundant information generated by multi-source data collection can be eliminated, improving the consistency and accuracy of the original operational data.

[0060] For example, the log processing platform can deploy a read-only acquisition agent system on the TOMO workstation. The acquisition agent system comprises four independent processes: a database acquisition unit, an interface acquisition unit, a system event acquisition unit, and an interface recognition unit. The database acquisition unit reads metadata files in the TOMO system's treatment plan directory using read-only query statements. The interface acquisition unit captures communication data between the TOMO system and the medical image archiving system through bypass listening. The system event acquisition unit obtains workstation process status change information through the operating system's application programming interface (API). The interface recognition unit records interface control operations using screenshots and optical character recognition (OCR) technology. The log processing platform aligns the data acquired by the four acquisition units by timestamp, detects and removes duplicate records using a hash algorithm, and obtains the original operation data.

[0061] For example, the log processing platform can also deploy a read-only data acquisition agent system using a microservice architecture. The database acquisition unit, interface acquisition unit, system event acquisition unit, and interface recognition unit run as independent containerized services. The database acquisition unit polls the log tables of the TOMO system database, the interface acquisition unit listens on network ports to capture medical digital imaging and communication standard messages, the system event acquisition unit subscribes to operating system event notifications, and the interface recognition unit periodically captures screen images and parses text information. The log processing platform can receive data streams from each acquisition unit in the acquisition agent system through a message queue, then use a Bloom filter for fast deduplication, merging the data to form the original operational data.

[0062] Optionally, the log processing platform automatically triggers software snapshot recording at key nodes such as plan loading, treatment initiation, parameter modification, and treatment pause. Software snapshots include complete image captures of the user interface, read-only dumps of the system memory state, and serialized storage of the current process context. Snapshot data is associated with standardized semantic events through indexes, supporting auxiliary verification during backtracking. Snapshots at key nodes help preserve evidence of the system state during high-risk operations.

[0063] Optionally, the data acquisition agent system implements automatic detection and switching between primary and backup modes. The primary acquisition mode uses API bypass listening as the data source, while the backup acquisition mode uses visual recognition from the user interface as the data source. The log processing platform monitors the data flow continuity in the primary acquisition mode through a heartbeat detection mechanism. When a data flow interruption or delay exceeding a threshold is detected, it automatically switches to the backup acquisition mode. Data acquired in both modes is time-aligned and feature-matched, then merged and deduplicated to ensure the integrity and consistency of the acquired data. Automatic primary / backup switching helps maintain acquisition continuity in the event of a single point of failure, improving system reliability.

[0064] In some optional embodiments, semantic recognition is performed on the original operation data according to a preset domain model to obtain standardized semantic events. This includes: the log processing platform can perform semantic recognition on the original operation data through the domain model to obtain atomic operation types corresponding to preset atomic operation definitions. The atomic operation types include navigation, parameter, and execution types, and the atomic operation type is the type of an indivisible single human-computer interaction action related to the TOMO system. The atomic operation definition is a data template for software-based decomposition, grading, and fingerprint modeling of the indivisible single human-computer interaction action of the TOMO system. The original operation data is parsed according to the preset TOMO object unit in the domain model to extract treatment parameters, imaging parameters, and mechanical control parameters. The TOMO object unit is a data structure for software abstract modeling of the treatment parameters, imaging parameters, mechanical control parameters, and session flow parameters of the TOMO system. Then, the determined atomic operation type and the extracted treatment parameters, imaging parameters, and mechanical control parameters are encapsulated according to the preset event field structure in the domain model to generate standardized semantic events. The event field structure includes event identifier, timestamp, operation object, values ​​before and after operation, risk level, and collection source identifier.

[0065] Optionally, a pre-defined domain model represents the data structure for software-based modeling of the atomic operations and parameters of the TOMO system, including atomic operation definitions. The log processing platform can determine the atomic operation type corresponding to the pre-defined atomic operation definition by comparing the operation characteristics of the original operation data with the fingerprint characteristics in the atomic operation definition. For atomic operation types, navigation types represent browsing behaviors such as interface navigation and menu selection. Parameter types represent numerical adjustment operations, such as dosage parameters and mechanical parameter adjustments. Execution types represent command-triggered operations, such as treatment initiation and plan confirmation. Each type of operation corresponds to a specific parameter structure and risk level. The log processing platform facilitates mapping raw input events to operation types with clear clinical semantics, which is beneficial for subsequent risk assessment and process analysis.

[0066] Optionally, the log processing platform can extract treatment parameters, imaging parameters, and mechanical control parameters from the raw operational data based on the parameter acquisition fields defined in the TOMO object unit. This facilitates the extraction of clinically significant parameter data specific to the TOMO system, enabling domain-specific in-depth data acquisition. By modeling TOMO-specific parameters, log data can directly reflect key information in clinical treatment, helping to avoid the disconnect between general log systems and TOMO clinical workflows. Treatment parameters may include field width, pitch factor, and modulation factor; imaging parameters may include megavolt-level computed tomography acquisition intervals; and mechanical control parameters may include gantry angle and multi-leaf collimator blade positions.

[0067] Optionally, standardized semantic events represent atomic operation records with clinically understandable semantic information. By converting heterogeneous raw operation data into standardized semantic events containing clinical semantic information, it helps to eliminate data format differences, establish a unified clinical language system, and improve the readability and clinical usability of log data.

[0068] For example, after receiving raw operation data, the log processing platform performs semantic recognition using a pre-defined domain model. The domain model may include sixty-two atomic operation definitions, each including operation fingerprint features and risk level information. The log processing platform can extract operation control identifiers and parameter change features from the raw operation data, perform pattern matching with the atomic operation definitions, and determine whether the atomic operation type is navigation-type, parameter-type, or execution-type. Based on the treatment parameter field, imaging parameter field, and mechanical control parameter field defined in the TOMO object unit, the log processing platform extracts parameter values ​​such as field width, megavolt computed tomography acquisition interval, gantry angle, and multi-leaf collimator blade position from the raw operation data. The log processing platform encapsulates the determined atomic operation type, extracted treatment parameters, imaging parameters, and mechanical control parameters, along with event identifiers, timestamps, operation objects, pre- and post-operation values, risk levels, and acquisition source identifiers, into a standardized semantic event according to the event field structure.

[0069] For example, the log processing platform can use a decision tree algorithm to perform semantic recognition on the raw operation data. The atomic operation definition in the domain model contains a set of decision rules. Based on the operation type encoding, interface change characteristics, and parameter change range of the raw operation data, the log processing platform determines whether the atomic operation type belongs to the navigation, parameter, or execution class through decision tree reasoning. The log processing platform can call the parameter parsing interface in the TOMO object unit to extract treatment parameters, imaging parameters, and mechanical control parameters from the raw operation data. It then performs Kalman filtering noise reduction on the extracted treatment parameters. The Kalman filtering algorithm is an optimal estimation algorithm based on a state-space model. Through a prediction-update iteration mechanism, it fuses model predictions and sensor observations to obtain the filtered optimal parameter estimate. The log processing platform performs software modeling and analysis on the multi-leaf collimator blade motion trajectory and dose rate changes, establishing a dynamic model of parameter changes and capturing the continuous law of parameter changes. The Kalman filtering algorithm helps eliminate sensor noise and transmission interference, improving the accuracy and stability of parameter data; software modeling and analysis facilitate the reconstruction of continuous change processes from discrete sampled data, accurately capturing key control points. The log processing platform maps the parsed atomic operation types, treatment parameters, imaging parameters, and mechanical control parameters to the corresponding fields in the event field structure, generating standardized semantic events that include event identifier, timestamp, operation object, values ​​before and after the operation, risk level, and data collection source identifier.

[0070] In some optional embodiments, binding clinical context information to standardized semantic events includes: the log processing platform can detect whether a unique clinical data identifier exists in the standardized semantic event, wherein the unique clinical data identifier is used to uniquely identify clinical data objects under medical digital imaging and communication standards; if a unique clinical data identifier is detected in the standardized semantic event, the platform queries the associated clinical context information based on the unique clinical data identifier and binds the queried clinical context information to the standardized semantic event, wherein the clinical context information includes: patient identifier, treatment plan identifier, and treatment fractionation identifier; if a unique clinical data identifier is detected not in the standardized semantic event, the platform performs correlation matching between the timestamp of the standardized semantic event and the time window of the clinical record to obtain the clinical context information corresponding to the standardized semantic event, and then binds the obtained clinical context information to the standardized semantic event.

[0071] Optionally, the log processing platform can determine the existence of a unique identifier for clinical data by parsing the data fields of standardized semantic events. For example, a unique identifier for clinical data can be an identifier in the DICOM standard used to uniquely identify clinical data objects such as patients, examinations, sequences, and images.

[0072] Optionally, if a unique clinical data identifier is detected within a standardized semantic event, the log processing platform can query the associated clinical context information based on the unique clinical data identifier. The clinical context information includes patient identifiers, treatment plan identifiers, and treatment fraction identifiers. The log processing platform can send a query request to the hospital information system, i.e., it can retrieve the patient identifier, treatment plan identifier, and treatment fraction identifier corresponding to the unique clinical data identifier by querying the database of the hospital information system or radiotherapy information system. The log processing platform can then use the retrieved patient identifier, treatment plan identifier, and treatment fraction identifier as clinical context information and bind them to the standardized semantic event to form a standardized semantic event with clinical context information.

[0073] Optionally, if a unique identifier for clinical data is detected in the standardized semantic event, the log processing platform performs correlation matching based on the timestamp of the standardized semantic event and the time window of the clinical record. The log processing platform can extract the timestamp of the standardized semantic event and calculate the overlap between the timestamp of the standardized semantic event and the time range (i.e., time window) of each clinical record. It can select the clinical record with the highest time overlap (or the time overlap exceeds a threshold) to obtain the patient identifier, treatment plan identifier, and treatment fractionation identifier corresponding to the standardized semantic event, and then bind the obtained clinical context information with the standardized semantic event.

[0074] In this way, the log processing platform helps to automatically link log data with clinical information, reduce the situation of isolated log data storage, and the unique identifier of clinical data helps to avoid duplicate entry and information inconsistency, thereby improving the efficiency of data retrieval based on clinical dimensions.

[0075] In some optional embodiments, a target event chain is constructed based on the temporal order and causal relationship of each standardized semantic event within the target session. This includes: the log processing platform sorting each standardized semantic event within the target session according to timestamps to obtain a time series; traversing the time series and determining the causal relationship between each standardized semantic event based on the state changes of the operation object; constructing a directed acyclic graph with standardized semantic events as nodes and temporal order and causal relationship as directed edges; and using the directed acyclic graph as the target event chain.

[0076] Optionally, timestamps are used to record the precise time points when standardized semantic events occur, with millisecond-level precision. The objects of operation can be TOMO system components such as treatment beds, gantry cranes, and multi-leaf collimators. Changes in the state of the object represent changes in its attribute values, such as position movement, angle rotation, and switching between open and closed states. Causal relationships are used to represent how the occurrence of one standardized semantic event leads to a state change or the fulfillment of a triggering condition for another standardized semantic event. For example, modifying dosage parameters can lead to an update in dosage calculation, and clicking "start treatment" can cause the gantry to begin rotating. The log processing platform can construct a directed acyclic graph (DAG) using standardized semantic events as nodes and time sequence and causal relationships as directed edges. A DAG can be a directed graph data structure without loops, suitable for representing operation flows with a clear sequence and no cyclic dependencies. The log processing platform can use the DAG as a target event chain, which is used to represent the temporal associations and causal dependencies between atomic operations within the same treatment process.

[0077] The log processing platform identifies causal relationships, distinguishing between concurrent independent operations and sequentially dependent operations, which helps in understanding the mutual influence between operations. Through directed acyclic graph (DAG) modeling, it avoids logical confusion caused by circular dependencies and ensures process traceability. The DAG structure supports topological sorting, quickly determining the execution order of operations; path search, tracing the complete operation chain from the initial state to a specific result; and parallel branch identification, distinguishing between serial and concurrent operations.

[0078] For example, a log processing platform can use a topological sorting algorithm to process time series, which can linearly arrange standardized semantic events according to their occurrence time. The log processing platform traverses the sorted time series, compares the operation object identifiers and state values ​​of adjacent standardized semantic events, and when it detects that the operation object identifiers are the same and the state values ​​have changed, it establishes a causal edge from the previous standardized semantic event to the next standardized semantic event. The log processing platform can use an adjacency list to store the graph structure, where nodes store the complete fields of the standardized semantic events, and edges store the causal type labels and time intervals.

[0079] For example, the log processing platform can also predefine a state transition rule base for the TOMO system. This rule base includes standard state sequences of the operation objects and allowed state transition paths. The log processing platform performs pattern matching between the actual time series and the state transition rule base, identifying standardized semantic event pairs that conform to the preset patterns and automatically labeling causal relationships. The log processing platform adopts a hierarchical directed acyclic graph structure, with top-level nodes representing treatment stages and bottom-level nodes representing atomic operations. Cross-layer causal edges are established through reference relationships between layers.

[0080] Optionally, the log processing platform can automatically complete missing core fields during semantic recognition. When fields are missing in the original operation data due to collection delays or packet loss, the log processing platform can complete key fields such as event identifiers, timestamps, and operator identifiers through context inference, default value filling, or adjacent event interpolation. The completed operation marker is generated through inference and is distinguished from the original collected data. Automatic completion helps improve data integrity and reduce information loss caused by collection defects.

[0081] Optionally, after constructing the target event chain, the log processing platform performs a consistency check. The check includes timestamp monotonicity checks to reduce time reversal, causal loop checks to reduce logical inconsistencies, and state continuity checks to ensure reasonable state transitions. The target event chain that passes the check is passed to the software storage; nodes that fail the check are marked as exceptions, triggering a manual review process. Consistency checks help ensure the logical correctness of the event chain and improve the reliability of subsequent analysis.

[0082] In some optional embodiments, data in the target event chain is stored differentially according to the risk level of standardized semantic events, including: the log processing platform can identify the risk level of standardized semantic events in the target event chain, wherein the risk level includes at least a first risk level, a second risk level, and a third risk level with decreasing risk; when the risk level of a standardized semantic event is the first risk level, the standardized semantic event and the snapshot data associated with the standardized semantic event are stored in full without loss; when the risk level of a standardized semantic event is the second risk level, the amount of state change between the standardized semantic event and the preceding standardized semantic event is determined and the amount of state change is stored; when the risk level of a standardized semantic event is the third risk level, multiple standardized semantic events of the third risk level are aggregated, compressed, and stored according to a preset time window.

[0083] Optionally, the log processing platform identifies the risk level of standardized semantic events in the target event chain. The risk level characterizes the potential impact of the standardized semantic events on patient safety or treatment quality. The risk level includes at least a first risk level, a second risk level, and a third risk level, with the risk decreasing sequentially. The first risk level corresponds to high-risk operations, such as treatment initiation and dosage parameter modification; the second risk level can correspond to medium-risk operations, such as plan loading and imaging parameter setting; and the third risk level can correspond to low-risk operations, such as interface navigation and data query.

[0084] Optionally, when the risk level of a standardized semantic event is at the first risk level, the log processing platform can perform lossless full storage of the standardized semantic event and its associated snapshot data. Snapshot data may include auxiliary evidence such as screenshots and system state images. When the risk level of a standardized semantic event is at the second risk level, the log processing platform can determine the amount of state change between the standardized semantic event and its preceding standardized semantic event. The platform stores this state change, which can characterize the difference in the attribute values ​​of the operated object. When the risk level of a standardized semantic event is at the third risk level, the log processing platform can aggregate and compress multiple standardized semantic events at the third risk level according to a preset time window before storing them. Aggregation and compression include statistical analysis of event frequency, operator lists, and operation type distribution.

[0085] By employing risk-driven differentiated storage, storage resource allocation can be optimized while ensuring the integrity of critical data. Lossless full storage helps ensure the complete traceability of high-risk operations, incremental storage helps reduce redundant occupation of medium-risk data, and aggregated compression helps significantly reduce the storage cost of low-risk data.

[0086] For example, the log processing platform can use a rule engine to identify risk levels, and the rule base can predefine the mapping relationship between atomic operation types and risk levels. For first-risk-level events, the log processing platform can store the complete event fields in JSON format and synchronously trigger a snapshot collection thread to capture the interface state. For second-risk-level events, the log processing platform calculates the difference of numerical parameters and the edit distance of string parameters, storing only the changes. For third-risk-level events, the log processing platform can use a 5-minute sliding window and the Count-Min Sketch algorithm to statistically analyze event features, achieving a compression rate of up to 92%. The Count-Min Sketch algorithm can refer to a probabilistic algorithm used to estimate the frequency of elements in a data stream, which can be implemented based on hash functions and counting arrays. The accuracy and space usage of the estimation can be controlled by adjusting the number of hash functions and the size of the counting array.

[0087] For example, the log processing platform can also use a machine learning classifier to dynamically assess risk levels. The machine learning classifier can take operational context, patient status, and device mode as input. The storage strategy employs a tiered architecture: first-risk-level data is written to high-speed SSD storage, second-risk-level data is written to standard SATA storage, and third-risk-level data is compressed and archived to object storage. Hot and cold data are automatically migrated; data from the past three months remains online and queryable, while historical data is stored offline.

[0088] In some optional embodiments, the physical device behavior of the TOMO system is simulated and reproduced according to the target event chain using a 3D digital twin model. This includes: a log processing platform constructing a 3D digital twin model of the TOMO system, wherein the 3D digital twin model includes software mappings of device operation logic, parameter change characteristics, and dose output characteristics; and parsing each standardized semantic event into driving instructions according to the time sequence in the target event chain and the software mappings in the 3D digital twin model; then controlling the 3D digital twin model to reproduce parameter changes and operation actions according to the driving instructions, and displaying parameter curves and operation timelines in a 3D operation sandbox, wherein the 3D operation sandbox is used to provide a visual interactive interface to support multi-dimensional linkage playback of the treatment process.

[0089] Optionally, the 3D digital twin model can be a virtual mapping of the TOMO physical system at the software level. The 3D digital twin model includes software mappings of equipment operation logic, parameter change characteristics, and dose output characteristics. The equipment operation logic represents the control rules, state transition conditions, and interlocking mechanisms of each component of the TOMO system; the parameter change characteristics represent the dynamic changes in motion parameters such as gantry angle, treatment bed position, and multi-leaf collimator blade position; and the dose output characteristics represent radiation physics characteristics such as irradiation field shape, dose rate distribution, and cumulative dose calculation. The log processing platform, according to the time sequence in the target event chain, parses each standardized semantic event into driving instructions based on the software mapping in the 3D digital twin model. These driving instructions are used to control the 3D digital twin model to execute corresponding parameter changes and operational actions. The log processing platform can control the 3D digital twin model to reproduce parameter changes and operational actions based on the driving instructions, and display parameter curves and operation timelines in a linked 3D operation sandbox. The 3D manipulation sandbox provides a visual interactive interface to support multi-dimensional, synchronized playback of the treatment process. Features include playback control (play, pause, fast forward, rewind), perspective switching (global view, close-up, first-person view), and hotspot annotation (highlighting abnormal events). Parameter graphs display the trends of parameters such as dose rate and gantry angle over time, while the operation timeline displays the sequence and time point distribution of standardized semantic events.

[0090] Digital twin technology transforms abstract operational logs into intuitive representations of device behavior, helping to reduce cognitive barriers in retrospective analysis and improve the accuracy and efficiency of anomaly identification. Multi-dimensional, interconnected playback supports understanding the treatment process from multiple perspectives—time, parameters, and space—facilitating problem localization. Through multi-view linkage, users can understand the treatment process from different angles, and interactive control allows them to focus on key time periods, improving analysis efficiency.

[0091] For example, the log processing platform can construct a 3D mesh model of the TOMO device based on CAD drawings and import it into the Unity rendering engine for real-time rendering. Software mapping can use a state machine model to define the device's operation logic, kinematic equations to define parameter variation characteristics, and a pencil-beam convolution algorithm to define dose output characteristics. The log processing platform traverses the target event chain, mapping the event types and parameter values ​​of standardized semantic events to driving commands. The 3D operation sandbox can use a multi-pane layout; the main view can display the 3D device animation, the side view displays the dose rate curve and rack angle trajectory, and the bottom displays the operation timeline. Clicking on a standardized semantic event on the timeline automatically jumps to the corresponding moment and highlights it.

[0092] For example, a log processing platform can also employ WebGL technology (Web Graphics Library).

[0093] A lightweight 3D digital twin model is constructed using a network graphics library, supporting direct access via a browser. Software mapping can adopt a microservice architecture, with device operation logic services, motion simulation services, and dosage calculation services deployed independently. The log processing platform uses a publish-subscribe pattern to parse standardized semantic events, and the event bus routes these events to the corresponding services to generate driver instructions. The 3D operation sandbox supports VR mode, allowing users to enter a virtual treatment room via a head-mounted display, control playback progress with controllers, and receive spatial audio prompts for key events. Parameter graphs support multi-axis comparison, and the operation timeline supports thumbnail previews.

[0094] In some optional embodiments, the fine-grained logging and backtracking method for TOMO system operation behavior further includes root cause analysis based on the comparison results between the target event chain and the preset standard process. The root cause analysis includes: the log processing platform can compare the target event chain with the preset TOMO standard treatment process model to identify process deviations and abnormal operation sequences, wherein the preset TOMO standard treatment process model is used to represent the preset standard process in software form; when an abnormal operation sequence is identified, an analysis algorithm is used to trace back from the end event of the abnormal operation sequence to the root cause event, wherein the analysis algorithm is used to decompose the abnormal result layer by layer to the underlying cause event through logical gate relationships; then, according to the risk level of the standardized semantic event corresponding to the root cause event, a structured backtracking report is generated, wherein the structured backtracking report includes an operation timeline, an anomaly summary, and root cause analysis results.

[0095] Optionally, the preset standard process may include standard operating sequences and timing constraints for stages such as treatment preparation, image guidance, positioning verification, treatment execution, and treatment termination. Deviation points represent positions in the target event chain that violate the standard process order or skip necessary steps, while abnormal operating sequences represent standardized semantic event combinations that do not match the standard pattern.

[0096] Optionally, the logic gate relationships include Boolean logic operations such as AND, OR, and NOT gates, used to characterize the causal structure of multiple cause events combined to lead to the result event. The operation timeline is used to visualize the temporal distribution of standardized semantic events, the anomaly summary is used to list process deviations and anomaly characteristic statistics, and the root cause analysis results are used to present the decomposition path from the end event to the root cause event.

[0097] Automated process comparison and root cause analysis help to quickly screen abnormal cases from massive amounts of treatment records, locate the root cause of problems, reduce the workload of manual review and subjective judgment bias, and pinpoint the specific stage at which the problem occurred by identifying deviation points. Systematic root cause analysis can distinguish between direct and fundamental causes, avoiding superficial treatments, and logical decomposition can identify complex failures caused by the coupling of multiple factors.

[0098] For example, the log processing platform can use a finite state machine to define the TOMO standard treatment process model. State nodes represent treatment stages, and state transition edges represent allowed operation types and preconditions. The log processing platform traverses the target event chain, monitors state transition paths, and marks process deviation points when undefined transitions or violations of preconditions are detected. The log processing platform can use fault tree analysis or event tree analysis as the analysis algorithm. When using fault tree analysis, the top-level event is the terminal event of the abnormal operation sequence, the bottom-level events are equipment failures or operational errors, and intermediate nodes connect upper and lower level events through AND gates and OR gates. The log processing platform traverses the fault tree upwards from the terminal events, calculates the occurrence probability and contribution of each bottom-level event, and selects the event with the highest contribution as the root cause event. The structured backtracking report can be in PDF format, the operation timeline is displayed in Gantt chart form, the anomaly summary is listed in tabular form, and the root cause analysis results are presented in tree diagram form.

[0099] For example, the log processing platform can also use Petri nets to define the TOMO standard treatment process model, where places represent system states, transitions represent operation triggers, and token flows represent treatment progress. The log processing platform uses token flow simulation to compare target event chains and identify abnormal patterns such as deadlock and missing tokens. The platform can use Bayesian networks as the analysis algorithm, where nodes represent event variables, edges represent conditional dependencies, and probabilistic reasoning calculates the causal path with the highest posterior probability. The platform combines the risk levels of standardized semantic events to adjust root cause priorities, and high-risk root cause events can trigger alarm flags. Structured backtracking reports support interactive web page formats, operation timelines support zooming and filtering, anomaly summaries support drill-down to view details, and root cause analysis results support expanding and collapsing branches.

[0100] In some optional embodiments, the fine-grained logging and backtracking method for TOMO system operation behavior further includes: the log processing platform can associate a multi-source evidence fingerprint with each standardized semantic event, wherein the multi-source evidence fingerprint includes a collection source identifier, an original data hash value, and a snapshot identifier, and the multi-source evidence fingerprint is used to cross-validate data obtained from different collection sources; then, based on the hash value of the preceding standardized semantic event, the hash value of the standardized semantic event is determined, and the hash values ​​of each standardized semantic event are linked in chronological order to construct a hash chain, wherein the hash chain is used to verify the integrity of the log data; the hash chain is stored, and access logs for data in the target event chain are recorded, wherein the access logs are used to generate audit trajectory information, and the audit trajectory information is used to trace data access behavior.

[0101] Optionally, the data source identifier is used to mark the data source of standardized semantic events, including database acquisition units, interface acquisition units, system event acquisition units, or interface identification units. The raw data hash value is used to characterize the cryptographic digest of the raw data, and the snapshot identifier is used to index associated interface screenshots or system state images. Multi-source evidence fingerprints can be used to cross-validate data obtained from different acquisition sources to detect data consistency and integrity.

[0102] Optionally, the log processing platform can employ a role-based access control (RBAC) software model. RBAC defines roles such as radiation oncologists, physicists, technicians, and administrators, assigning differentiated operational permissions and query scopes to each role. For example, radiation oncologists can view treatment records for their assigned patients, physicists can view dosage parameters for all patients, technicians can only view equipment operation logs, and administrators have system configuration permissions. The log processing platform can also implement multi-factor authentication software. Multi-factor authentication can combine username / password, digital certificate, and biometric credentials, improving the reliability of identity verification and facilitating granular access control and strong authentication.

[0103] Optionally, the hash chain adopts a blockchain-like chain structure, where the hash value calculation for each standardized semantic event includes the hash value of the previous standardized semantic event as input. The hash chain is used to verify the integrity of log data; any tampering with historical standardized semantic events can lead to mismatches in subsequent hash values. The log processing platform stores the hash chain and records access logs for data in the target event chain. These access logs include the visitor identifier, access time, access type, and scope of accessed objects. The access logs are used to generate audit trail information. This audit trail information is used to trace data access behavior, supporting compliance auditing and security analysis.

[0104] By using multi-source evidence fingerprinting and hash chain mechanisms, a verifiable evidence system and a tamper-proof data protection mechanism can be constructed, which helps to improve the legal evidentiary value and security credibility of log data.

[0105] For example, the log processing platform can use the SHA-256 algorithm to calculate the hash value of the original data and use a UUID (Universally Unique Identifier) ​​as the snapshot identifier. The log processing platform encapsulates the source identifier, the original data hash value, and the snapshot identifier into a multi-source evidence fingerprint in JSON format and stores it along with standardized semantic events. The log processing platform can construct a hash chain using an MD (Merkle-Damgård) structure. The hash value calculation for each standardized semantic event includes the event content, timestamp, and the hash value of the previous standardized semantic event. The log processing platform can store the hash chain on a separate secure log server, physically isolated from business data. The log processing platform can use a WORM (Write Once Read Many) storage strategy to record access logs, ensuring that log data cannot be modified or deleted once written. This is implemented at the physical level using one-time write media or at the logical level using mandatory access control to prevent audit trail tampering. WORM storage helps to ensure the immutability of evidence at the physical level. The log processing platform can perform multi-source data consistency reconciliation. The reconciliation operation compares the differences in records from different collection sources for the same standardized semantic event, calculates field-level consistency scores, and labels the reconciliation results as consistent, slightly different, or significantly different. Significant differences can trigger alarms, notifying administrators to check the status of the collection system. Multi-source reconciliation helps to promptly detect collection anomalies or data contamination, improving the reliability of the evidence chain.

[0106] For example, the log processing platform can also use the BLAKE3 algorithm to calculate the hash value of the raw data, supporting parallel computing and incremental updates. The platform can use a Merkle tree to organize multi-source evidence fingerprints, with leaf nodes representing the hash values ​​of each data source and the root node representing the comprehensive evidence fingerprint, supporting efficient batch verification. The platform uses a circular linked list structure to construct a hash chain, periodically anchoring the tail hash value to a trusted timestamp service or public blockchain, providing verifiable time proofs to third parties. The platform can use streaming processing to record access logs, analyze access patterns in real time, and detect abnormal access behavior, such as batch exports outside of working hours, triggering real-time alarms. Audit trajectory information is displayed graphically, supporting access path tracing and permission attribution.

[0107] Optionally, the log processing platform can employ multi-layered software encryption methods. The data transmission layer uses the TLS 1.3 (Transport Layer Security) protocol, which supports faster handshake speeds and stronger security. The data storage layer uses the AES-256 (Advanced Encryption Standard) algorithm, which uses a 256-bit key length and provides high-strength data encryption protection. For sensitive data such as patient identity information and treatment prescriptions, the application layer can use the national standard SM4 algorithm for additional encryption. SM4 is a block cipher algorithm suitable for medical data compliance requirements. The log processing platform is designed with a software-defined key management system. The key management system uses a hardware security module (HSM) to store the root key, supporting lifecycle management such as hierarchical key derivation, periodic rotation, and emergency revocation. Key usage records are written to an audit log, supporting traceability of key access behavior.

[0108] like Figure 2 As shown, according to another aspect of the embodiments of this application, a fine-grained log recording and backtracking device for the operation behavior of a TOMO system is also provided, including: an acquisition unit 201, a first processing unit 202, a second processing unit 203, a third processing unit 204 and a fourth processing unit 205.

[0109] The system comprises four processing units: an acquisition unit 201, which acquires raw operational data through multi-source acquisition operations, including monitoring system interfaces and recognizing operational interfaces; a first processing unit 202, which performs semantic recognition on the raw operational data according to a preset domain model to obtain standardized semantic events and binds clinical context information to the standardized semantic events, wherein the standardized semantic events represent atomic operation records with clinically understood semantic information, and the domain model is a data structure for software-based modeling of atomic operations and parameters of the TOMO system; a second processing unit 203, which aggregates standardized semantic events into target sessions based on clinical context information and constructs target event chains according to the temporal order and causal relationship of each standardized semantic event within the target session, wherein the target event chains represent the temporal association and causal dependency between atomic operations in the same event process; a third processing unit 204, which performs differentiated storage of data in the target event chains according to the risk level of the standardized semantic events, wherein the differentiated storage is used for adaptive encoding and hierarchical storage of data according to the risk level; and a fourth processing unit 205, which, in response to a backtracking request, drives a three-dimensional digital twin model to simulate and reproduce the physical device behavior of the TOMO system according to the target event chains.

[0110] Optionally, the acquisition unit 201 includes: a first processing subunit for deploying a read-only acquisition agent system, wherein the acquisition agent system includes at least a database acquisition unit, an interface acquisition unit, a system event acquisition unit, and an interface recognition unit; a second processing subunit for reading metadata in the directory of the TOMO system through the database acquisition unit, listening to parameter change data in the communication interface through the interface acquisition unit, obtaining state change information of the workstation operating system and TOMO system processes of the TOMO system through the system event acquisition unit, and performing lightweight listening on the operation interface through the interface recognition unit, the lightweight listening being used to record control operation behavior; and a third processing subunit for merging and deduplicating the data acquired by the database acquisition unit, the interface acquisition unit, the system event acquisition unit, and the interface recognition unit to obtain the original operation data.

[0111] Optionally, the first processing unit 202 includes: a fourth processing subunit, used to perform semantic recognition on the original operation data through the domain model to obtain atomic operation types corresponding to preset atomic operation definitions, wherein the atomic operation types include navigation type, parameter type and execution type, and the atomic operation type is the type to which an indivisible single human-computer interaction action related to the TOMO system belongs; the atomic operation definition is a data template for software decomposition, classification and fingerprint modeling of the indivisible single human-computer interaction action of the TOMO system; a fifth processing subunit, used to perform parameter parsing on the original operation data according to the preset TOMO object unit in the domain model to extract treatment parameters, imaging parameters and mechanical control parameters; wherein the TOMO object unit is a data structure for software abstract modeling of the treatment parameters, imaging parameters, mechanical control parameters and session flow parameters of the TOMO system; a sixth processing subunit, used to encapsulate the determined atomic operation type and the extracted treatment parameters, imaging parameters and mechanical control parameters according to the preset event field structure in the domain model to generate standardized semantic events, wherein the event field structure includes event identifier, timestamp, operation object, values ​​before and after operation, risk level and collection source identifier.

[0112] Optionally, the first processing unit 202 includes: a seventh processing subunit, used to detect whether a unique clinical data identifier exists in the standardized semantic event, wherein the unique clinical data identifier is used to uniquely identify clinical data objects under the medical digital imaging and communication standard; an eighth processing subunit, used to query the associated clinical context information based on the unique clinical data identifier when the existence of a unique clinical data identifier is detected in the standardized semantic event, and bind the queried clinical context information with the standardized semantic event, wherein the clinical context information includes: patient identifier, treatment plan identifier, and treatment fractionation identifier; and a ninth processing subunit, used to perform correlation matching between the timestamp of the standardized semantic event and the time window of the clinical record when the absence of a unique clinical data identifier is detected in the standardized semantic event, to obtain the clinical context information corresponding to the standardized semantic event, and then bind the obtained clinical context information with the standardized semantic event.

[0113] Optionally, the second processing unit 203 includes: a tenth processing subunit, used to sort each standardized semantic event in the target session according to the timestamp to obtain a time series; an eleventh processing subunit, used to traverse the time series and determine the causal relationship between each standardized semantic event based on the state change of the operation object; a twelfth processing subunit, used to construct a directed acyclic graph with standardized semantic events as nodes and time sequence and causal relationship as directed edges; and a thirteenth processing subunit, used to use the directed acyclic graph as the target event chain.

[0114] Optionally, the third processing unit 204 includes: a fourteenth processing subunit, used to identify the risk level of standardized semantic events in the target event chain, wherein the risk level includes at least a first risk level, a second risk level, and a third risk level with decreasing risk; a fifteenth processing subunit, used to perform lossless full storage of the standardized semantic event and the snapshot data associated with the standardized semantic event when the risk level of the standardized semantic event is the first risk level; a sixteenth processing subunit, used to determine the amount of state change between the standardized semantic event and the preceding standardized semantic event when the risk level of the standardized semantic event is the second risk level, and store the amount of state change; and a seventeenth processing subunit, used to aggregate and compress multiple standardized semantic events of the third risk level according to a preset time window and store them when the risk level of the standardized semantic event is the third risk level.

[0115] Optionally, the fourth processing unit 205 includes: an eighteenth processing subunit for constructing a three-dimensional digital twin model of the TOMO system, wherein the three-dimensional digital twin model includes software mappings of device operation logic, parameter change characteristics, and dose output characteristics; a nineteenth processing subunit for parsing each standardized semantic event into driving instructions according to the time sequence in the target event chain and the software mappings in the three-dimensional digital twin model; and a twentieth processing subunit for controlling the three-dimensional digital twin model to reproduce parameter changes and operation actions according to the driving instructions, and displaying parameter curves and operation timelines in a three-dimensional operation sandbox, wherein the three-dimensional operation sandbox is used to provide a visual interactive interface to support multi-dimensional linkage playback of the treatment process.

[0116] Optionally, the fine-grained logging and backtracking device for TOMO system operation behavior further includes a fifth processing unit. This fifth processing unit performs root cause analysis based on the comparison results between the target event chain and a preset standard procedure. The fifth processing unit includes: a twenty-first processing subunit, used to compare the target event chain with a preset TOMO standard treatment procedure model to identify deviations and abnormal operation sequences, wherein the preset TOMO standard treatment procedure model represents the preset standard procedure in software form; a twenty-second processing subunit, used to, upon identifying an abnormal operation sequence, use an analysis algorithm to trace back from the end event of the abnormal operation sequence to the root cause event, wherein the analysis algorithm decomposes the abnormal results layer by layer to the underlying cause event through logical gate relationships; and a twenty-third processing subunit, used to generate a structured backtracking report based on the risk level of the standardized semantic event corresponding to the root cause event, wherein the structured backtracking report includes an operation timeline, an anomaly summary, and root cause analysis results.

[0117] Optionally, the fine-grained logging and backtracking device for the TOMO system's operational behavior further includes: a sixth processing unit, used to associate multi-source evidence fingerprints with each standardized semantic event, wherein the multi-source evidence fingerprint includes a source identifier, an original data hash value, and a snapshot identifier, and the multi-source evidence fingerprint is used to cross-validate data obtained from different sources; a seventh processing unit, used to determine the hash value of a standardized semantic event based on the hash value of the preceding standardized semantic event, and to link the hash values ​​of each standardized semantic event in chronological order to construct a hash chain, wherein the hash chain is used to verify the integrity of the log data; and an eighth processing unit, used to store the hash chain and record access logs for data in the target event chain, wherein the access logs are used to generate audit trajectory information, and the audit trajectory information is used to trace data access behavior.

[0118] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, which stores a computer program, wherein, when the computer program is executed, the device where the computer-readable storage medium is located performs the above-described fine-grained logging and backtracking method for TOMO system operation behavior.

[0119] According to another aspect of the embodiments of this application, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when one or more programs are executed by one or more processors, the one or more processors cause the one or more processors to perform the fine-grained logging and backtracking method for the TOMO system operation behavior described above.

[0120] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program or instructions, which, when executed by a processor, implement the fine-grained logging and backtracking method for the TOMO system operation behavior described above.

[0121] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0122] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0123] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0124] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0125] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0126] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0127] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A fine-grained logging and backtracking method for the operational behavior of a TOMO system, characterized in that, include: Raw operation data is acquired through multi-source acquisition operations, wherein the multi-source acquisition operations include listening to the system interface and recognizing the operation interface. The original operation data is semantically recognized according to the preset domain model to obtain standardized semantic events, and clinical context information is bound to the standardized semantic events. The standardized semantic events are used to represent atomic operation records with clinically understood semantic information. The domain model is a data structure for software-based modeling of atomic operations and parameters of the TOMO system. Based on the clinical context information, the standardized semantic events are aggregated into a target session, and a target event chain is constructed according to the temporal order and causal relationship of each standardized semantic event in the target session. The target event chain is used to characterize the temporal association and causal dependency between atomic operations in the same event process. The data in the target event chain is stored differentially according to the risk level of the standardized semantic events, wherein the differential storage is used to adaptively encode and hierarchically store the data according to the risk level; In response to a backtracking request, a three-dimensional digital twin model is driven to simulate and reproduce the physical device behavior of the TOMO system based on the target event chain.

2. The fine-grained logging and backtracking method for TOMO system operation behavior according to claim 1, characterized in that, Raw operational data is acquired through multi-source acquisition, including: A read-only data acquisition agent system is deployed, wherein the data acquisition agent system includes at least a database acquisition unit, an interface acquisition unit, a system event acquisition unit, and an interface recognition unit; The database acquisition unit reads metadata from the directory of the TOMO system, the interface acquisition unit listens for parameter changes in the communication interface, the system event acquisition unit obtains the status change information of the workstation operating system and the TOMO system process of the TOMO system, and the interface recognition unit performs lightweight monitoring of the operation interface, which is used to record control operation behavior. The data acquired by the database acquisition unit, the interface acquisition unit, the system event acquisition unit, and the interface recognition unit are merged and deduplicated to obtain the original operation data.

3. The fine-grained logging and backtracking method for TOMO system operation behavior according to claim 1, characterized in that, Based on a preset domain model, semantic recognition is performed on the original operational data to obtain standardized semantic events, including: The original operation data is semantically recognized using the domain model to obtain atomic operation types corresponding to preset atomic operation definitions. The atomic operation types include navigation, parameter, and execution types, and the atomic operation type is the type to which an indivisible single human-computer interaction action related to the TOMO system belongs. The atomic operation definition is a data template for software-based decomposition, hierarchical classification, and fingerprint modeling of the indivisible single human-computer interaction action of the TOMO system. The original operation data is parsed according to the preset TOMO object unit within the domain model to extract treatment parameters, imaging parameters, and mechanical control parameters; wherein, the TOMO object unit is a data structure for software abstract modeling of the treatment parameters, imaging parameters, mechanical control parameters, and session flow parameters of the TOMO system; The determined atomic operation type and the extracted treatment parameters, imaging parameters and mechanical control parameters are encapsulated according to the preset event field structure within the domain model to generate the standardized semantic event. The event field structure includes an event identifier, timestamp, operation object, values ​​before and after the operation, risk level and acquisition source identifier.

4. The fine-grained logging and backtracking method for TOMO system operation behavior according to claim 1, characterized in that, Binding clinical context information to the standardized semantic events includes: The system detects whether a unique clinical data identifier exists in the standardized semantic event, wherein the unique clinical data identifier is used to uniquely identify clinical data objects under the medical digital imaging and communication standard. If the clinical data unique identifier is detected in the standardized semantic event, the associated clinical context information is queried based on the clinical data unique identifier, and the queried clinical context information is bound to the standardized semantic event. The clinical context information includes: patient identifier, treatment plan identifier, and treatment fractionation identifier. If the unique identifier of the clinical data is not found in the standardized semantic event, the clinical context information corresponding to the standardized semantic event is obtained by matching the timestamp of the standardized semantic event with the time window of the clinical record, and then the obtained clinical context information is bound to the standardized semantic event.

5. The fine-grained logging and backtracking method for TOMO system operation behavior according to claim 1, characterized in that, Based on the temporal order and causal relationship of each standardized semantic event within the target session, a target event chain is constructed, including: The standardized semantic events within the target session are sorted according to their timestamps to obtain a time series; Traverse the time series and determine the causal relationships between the standardized semantic events based on the state changes of the operation objects; Using the standardized semantic events as nodes and the temporal order and causal relationship as directed edges, a directed acyclic graph is constructed. The directed acyclic graph is used as the target event chain.

6. The fine-grained logging and backtracking method for TOMO system operation behavior according to claim 1, characterized in that, Based on the risk level of the standardized semantic events, the data in the target event chain is stored differentially, including: Identify the risk level of the standardized semantic events in the target event chain, wherein the risk level includes at least a first risk level, a second risk level, and a third risk level with decreasing risk in sequence; If the risk level of the standardized semantic event is the first risk level, the standardized semantic event and the snapshot data associated with the standardized semantic event will be stored in full without loss. If the risk level of the standardized semantic event is the second risk level, determine the state change amount between the standardized semantic event and the previous standardized semantic event, and store the state change amount; When the risk level of the standardized semantic event is the third risk level, multiple standardized semantic events of the third risk level are aggregated, compressed, and stored according to a preset time window.

7. The fine-grained logging and backtracking method for TOMO system operation behavior according to claim 1, characterized in that, The physical device behavior of the TOMO system is simulated and reproduced using a 3D digital twin model driven by the target event chain, including: A three-dimensional digital twin model of the TOMO system is constructed, wherein the three-dimensional digital twin model includes software mapping of the device operation logic, parameter change characteristics and dose output characteristics; According to the time sequence in the target event chain, each of the standardized semantic events is parsed into driving instructions based on the software mapping in the three-dimensional digital twin model; The driving instructions control the three-dimensional digital twin model to reproduce parameter changes and operational actions, and display parameter curves and operation timelines in a three-dimensional operation sandbox. The three-dimensional operation sandbox is used to provide a visual interactive interface to support multi-dimensional playback of the treatment process.

8. The fine-grained logging and backtracking method for TOMO system operation behavior according to claim 1, characterized in that, The fine-grained logging and backtracking method for the TOMO system's operational behavior also includes root cause analysis based on the comparison results between the target event chain and the preset standard process. The root cause analysis includes: The target event chain is compared with the preset TOMO standard treatment process model to identify process deviations and abnormal operation sequences. The preset TOMO standard treatment process model is used to represent the preset standard process in a software form. Upon identifying the abnormal operation sequence, an analysis algorithm is used to trace back from the end event of the abnormal operation sequence to the root cause event. The analysis algorithm is used to decompose the abnormal result layer by layer to the underlying cause event through logical gate relationships. Based on the risk level of the standardized semantic events corresponding to the root cause events, a structured backtracking report is generated, wherein the structured backtracking report includes an operation timeline, anomaly summary, and root cause analysis results.

9. The fine-grained logging and backtracking method for TOMO system operation behavior according to claim 1, characterized in that, The fine-grained logging and backtracking method for the TOMO system's operational behavior also includes: A multi-source evidence fingerprint is associated with each of the standardized semantic events, wherein the multi-source evidence fingerprint includes a source identifier, an original data hash value, and a snapshot identifier, and the multi-source evidence fingerprint is used to cross-validate data obtained from different sources; Based on the hash value of the preceding standardized semantic event, the hash value of the standardized semantic event is determined, and the hash values ​​of each standardized semantic event are linked in chronological order to construct a hash chain, wherein the hash chain is used to verify the integrity of the log data; The hash chain is stored, and access logs for data in the target event chain are recorded. The access logs are used to generate audit trail information, which is used to trace data access behavior.

10. A fine-grained logging and backtracking device for the operational behavior of a TOMO system, characterized in that, include: The acquisition unit is used to acquire raw operation data through multi-source acquisition operations, wherein the multi-source acquisition operations include listening to the system interface and identifying the operation interface. The first processing unit is used to perform semantic recognition on the original operation data according to the preset domain model to obtain standardized semantic events, and bind clinical context information to the standardized semantic events. The standardized semantic events are used to represent atomic operation records with clinically understood semantic information. The domain model is a data structure for software-based modeling of atomic operations and parameters of the TOMO system. The second processing unit is used to aggregate the standardized semantic events into a target session based on the clinical context information, and to construct a target event chain according to the temporal order and causal relationship of each standardized semantic event in the target session, wherein the target event chain is used to characterize the temporal association and causal dependency between atomic operations in the same event process; The third processing unit is used to perform differentiated storage of data in the target event chain according to the risk level of the standardized semantic event, wherein the differentiated storage is used to adaptively encode and hierarchically store the data according to the risk level. The fourth processing unit is used to respond to the backtracking request and drive the three-dimensional digital twin model to simulate and reproduce the physical device behavior of the TOMO system according to the target event chain.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device on which the computer-readable storage medium is located performs a fine-grained logging and backtracking method for the TOMO system operation behavior as described in any one of claims 1 to 9.

12. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform a fine-grained logging and backtracking method for the operational behavior of the TOMO system as described in any one of claims 1 to 9.

13. A computer program product, characterized in that, It includes a computer program or instructions that, when executed by a processor, implement a fine-grained logging and backtracking method for the TOMO system operation behavior as described in any one of claims 1 to 9.

Images