A method and system for managing adverse drug reaction traces

Abstract

The present application provides a method and system for managing adverse drug reaction traces, including: using a hash function to process adverse drug reaction records, and calculating a unique fingerprint code corresponding to each record based on the type, time, operator, and change content fields of each operation in the record; obtaining and analyzing user operation logs, using an isolation forest algorithm for anomaly detection, and analyzing the differences between normal operations and abnormal operations; combining drug use frequency, time series data of adverse reaction reports, and patient behavior diversity indicators to implement dynamic abnormal activity monitoring, and optimizing monitoring strategies and early warning thresholds based on monitoring result feedback; based on feature extraction of operation data, based on an isolation forest algorithm and an autoencoder network, identifying and evaluating tampering behavior, and optimizing the detection process through expert verification and parameter adjustment.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method and system for managing adverse drug reaction traces. Background Art

[0002] In the medical industry, the monitoring and management of adverse drug reactions (ADRs) has always been a critical and complex issue. With the development of the medical industry and the increase in the number of drug types, the adverse reactions that patients may encounter when receiving drug treatment have become more diverse and complex. ADRs not only pose a serious threat to patients' health, but also impose a significant burden on the medical system and the socio-economy. Existing adverse drug reaction reporting systems often rely on active reports from medical staff and patients. Such spontaneous reports may lead to incomplete, delayed or even erroneous reports, affecting the quality and accuracy of ADR data. Data security is an important issue in the collection, storage and processing of ADR data. How to effectively identify abnormal patterns from massive data, identify abnormal behaviors, and potential errors and fraud while ensuring data security and protecting personal privacy has also become a research focus. Summary of the invention

[0003] The present invention provides a method for managing adverse drug reaction traces, which mainly includes:

[0004] A hash function is used to process adverse drug reaction records, and a unique fingerprint code corresponding to each record is calculated based on the type, time, operator, and change content fields of each operation in the record; after the fingerprint code is generated, a digital signature operation is performed on it, and the fingerprint code is encrypted using the private key in the asymmetric encryption algorithm to form a signature mark. When a user tries to access the data, it is necessary to use the digital certificate of the public key infrastructure for identity authentication. Only after passing the authentication can the digital signature be decrypted and the data can be accessed; user operation logs are obtained and analyzed, and anomaly detection is performed using the isolation forest algorithm to analyze the differences between normal operations and abnormal operations; a user operation frequency prediction model is constructed in combination with the user's historical operation data, and normal operation frequency prediction is predicted based on the user's active time period and operation habits. The time and frequency of common operations are compared with the real-time monitored data and the user operation frequency prediction model, and the operations that deviate from the predicted behavior are marked as suspicious behaviors; dynamic abnormal activity monitoring is implemented based on the time series data of drug use frequency, adverse reaction reports, and patient behavior diversity indicators, and the monitoring strategy and early warning threshold are optimized according to the monitoring results feedback; based on the feature extraction of operation data, based on the isolation forest algorithm and autoencoder network, tampering behavior is identified and evaluated, and the detection process is optimized through expert verification and parameter adjustment; based on the drug use information and adverse reaction report data in the hospital blockchain network, smart contracts are designed and deployed to monitor the data on-chain behavior in real time, and the drug safety monitoring process is optimized according to the monitoring results and feedback information.

[0005] The present invention provides a drug adverse reaction trace management system, which mainly includes:

[0006] Hash function and digital signature module, used to generate a unique fingerprint code for records and encrypt to protect data security; public key infrastructure verification module, used to authenticate and decrypt data to ensure data access security; user operation analysis and prediction module, used to predict user behavior through historical data and mark abnormal operations; dynamic abnormal activity monitoring module, used to monitor drug use and adverse reactions in real time and optimize early warning strategies; tampering behavior identification module, using isolation forests and autoencoders to identify data tampering and improve system protection capabilities; blockchain smart contract module, used to monitor data on-chain behavior and optimize drug safety monitoring processes.

[0007] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0008] The present invention discloses a method for managing drug adverse reaction traces. The present invention ensures the security and integrity of drug use data, improves the ability to detect abnormal behaviors, and optimizes the drug safety monitoring process; improves the safety and management efficiency of drug use; performs hashing on drug adverse reaction records to generate unique fingerprint codes, and uses digital signatures to encrypt these fingerprint codes to ensure the data is not tampered with. In addition, the private key of the asymmetric encryption algorithm is used for encryption operations, and the identity of the visitor is verified by the digital certificate of the public key infrastructure, thereby ensuring the secure access to the data. Monitor and detect abnormal behaviors in the data, and ensure the security and integrity of the data during the entire processing process. By analyzing the user operation log, abnormal behaviors are detected, and then combined with the user's historical operation data, an operation frequency prediction model is constructed to monitor and predict user behavior, and suspicious operations that deviate from the normal mode are marked. Smart contracts are integrated in the blockchain network to monitor the data chain behavior in real time, and the drug safety monitoring process is optimized based on the feedback of the monitoring results. This not only improves the transparency of drug use, but also enhances the automation and intelligence of the monitoring process. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 The present invention is a flowchart of a method for managing adverse drug reaction traces.

[0010] Figure 2 A schematic diagram of a method and system for managing adverse drug reaction traces of the present invention.

[0011] Figure 3 This is another schematic diagram of a drug adverse reaction trace management method and system of the present invention. DETAILED DESCRIPTION

[0012] In order to further understand the content of the present invention, the present invention is described in detail in conjunction with the accompanying drawings and embodiments. The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are only used to explain the relevant inventions, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0013] like Figure 1-3 In this embodiment, a method and system for managing adverse drug reaction traces may specifically include:

[0014] S101. Process the adverse drug reaction records using a hash function, and calculate a unique fingerprint code corresponding to each record based on the type, time, operator, and change content fields of each operation in the record.

[0015] Acquire the adverse drug reaction record data, process it using a hash function, and obtain a unique fingerprint code for the adverse drug reaction record; analyze and summarize the attributes of the adverse drug reaction record, determine the correlation between the operation type, operation time, operator identity, and change content attributes, and determine the logical association between the attributes; based on the attribute analysis results, logically merge the operation type, operation time, operator identity, and change content attributes; determine the corresponding data processing flow by judging the different values ​​of the operation type attribute. If the operation type is new, the new adverse drug reaction record is added to the database; if the operation type is modified, locate the corresponding record according to the fingerprint code and update the value of the relevant attribute; based on the operation time attribute, perform time serialization processing on the adverse drug reaction record to obtain the data distribution in different time periods, and combine the operator identity attribute to determine the operation behavior characteristics of different operators in different time periods; use the change content attribute to track and analyze the change history of the adverse drug reaction record, analyze the evolution of the adverse drug reaction record by comparing the change content at different time points, and judge the rationality and compliance of the change.

[0016] Specifically, the adverse drug reaction record data is obtained, and the hash function is used to process the records according to the attributes such as operation type, operation time, operator identity and change content, so as to obtain the unique fingerprint code of each record. The unique fingerprint code is associated with the original record, and the mapping relationship between the fingerprint code and the record attribute is established to provide a data basis for the subsequent attribute analysis. The attributes of the adverse drug reaction records are analyzed and summarized, and the association rule mining algorithm, such as the Apriori algorithm or the FP-growth algorithm, is used to find the frequent co-occurrence patterns and association rules between the attributes such as operation type, operation time, operator identity and change content, and to judge the correlation and logical association between the attributes. According to the attribute analysis results, the rule-based reasoning method is used to convert the attribute association rules into reasoning rules in the form of IF-THEN, and they are applied to data processing and decision support to realize the logical integration and comprehensive utilization of adverse drug reaction records. The operation type and operation time attributes are comprehensively used to classify and cluster the adverse drug reaction records, and identify the typical operation mode and time distribution law. According to the analysis results, the newly added adverse drug reaction records are automatically classified and categorized, and the corresponding data processing flow and tasks are triggered according to the operation type and time attributes. The rationality and compliance of the changes in the adverse drug reaction records are judged. According to the drug clinical use specifications and adverse reaction reporting standards, compliance inspection rules are established to automatically review and warn the changes. The audit results are associated with the operator identity attributes to identify suspicious operation behaviors and risk events. After obtaining the adverse drug reaction record data, the SHA-256 hash function is used to process the attributes of each record, such as the operation type, operation time, operator identity, and change content, to obtain a 64-bit unique fingerprint code. A mapping relationship is established between the fingerprint code and the original record, and it is stored in a relational database or NoSQL database to facilitate subsequent attribute analysis and query. For attribute analysis, the FP-growth algorithm is used, and the minimum support is set to 0.05 and the minimum confidence is set to 0.8 to find the association rules between the attributes, such as "operation type = modification AND operation time>18:00->operator identity = administrator", which means that after 6 pm, the modification operation is usually performed by the administrator. Convert association rules into inference rules in the form of IF-THEN and apply them to data processing and decision support, such as "IF operation type = new AND operation time < 09:00 THEN trigger the new record review process". Perform K-means cluster analysis on adverse drug reaction records, set the number of clusters k = 5, the number of iterations to 100, and obtain typical categories of different operation modes and time distributions. Perform compliance checks on changes and set keyword matching rules, such as "Adverse reaction description CONTAINS 'death' OR 'serious adverse event' THEN trigger high-risk warning".

[0017] S102. After the fingerprint code is generated, a digital signature operation is performed on it. The fingerprint code is encrypted using the private key in the asymmetric encryption algorithm to form a signature mark. When the user attempts to access the data, the digital certificate of the public key infrastructure is used for identity authentication. Only after passing the authentication can the digital signature be decrypted and the data can be accessed.

[0018] After the unique fingerprint code of the adverse drug reaction record is generated, the RSA algorithm in the asymmetric encryption algorithm is used to encrypt the fingerprint code with the administrator's private key to obtain a digital signature, and the digital signature is stored in the database together with the fingerprint code to form a signature identification; when a user attempts to access the adverse drug reaction data, the user's digital certificate is obtained through the public key infrastructure according to the user's identity information, and the user is authenticated using the public key in the digital certificate; if the user passes the authentication, it is determined whether the user has the right to access the corresponding adverse drug reaction data based on the user's access rights. If the user has access rights, the user is allowed to access the data; otherwise, the user's access request is denied; for users who are allowed to access, the fingerprint code and digital signature of the adverse drug reaction record are obtained, and the digital signature is decrypted using the administrator's public key to obtain the original fingerprint code; the decrypted fingerprint code is compared with the fingerprint code stored in the database. If the two are consistent, it means that the data has not been tampered with, and the user is allowed to access the adverse drug reaction data; otherwise, the data tampering event is recorded and the user's access request is denied; in the process of the user accessing the adverse drug reaction data, the user's operation behavior is monitored, the user's access log is recorded, and the user's abnormal access behavior and potential risks are identified; the user's access rights are dynamically adjusted according to the results of the user behavior analysis.

[0019] Specifically, a PKI system is constructed in the adverse drug reaction trace management system, a root certificate is generated, and a user certificate is issued by a CA organization. The certificate is stored in a secure certificate library and distributed to users through secure channels. After generating the unique fingerprint code of the adverse drug reaction record, the AES symmetric encryption algorithm is used to encrypt the fingerprint code using the administrator's key, and the hash value of the fingerprint code is signed using the administrator's private key to generate a digital signature. The encrypted fingerprint code and digital signature are stored together in the database to form a signature identifier. When a user attempts to access the adverse drug reaction data, the user's digital certificate is obtained through the PKI system, and the validity of the certificate is verified using the CA's public key to ensure the legitimacy and credibility of the user's identity. If the user passes the identity authentication, the user is judged based on the user's access rights to access the specified adverse drug reaction data. If the user has access rights, the user is allowed to access the data; otherwise, the user's access request is denied. For users who are allowed to access, the encrypted fingerprint code and digital signature of the adverse drug reaction record are obtained from the database, and the digital signature is verified using the administrator's public key to ensure that the fingerprint code has not been tampered with. After verification, the fingerprint code is decrypted using the key of the AES algorithm to obtain the original fingerprint code, which is then compared with the fingerprint code stored in the database. If the two are consistent, the user is allowed to access the adverse drug reaction data; otherwise, the data tampering event is recorded and the user's access request is rejected. In the process of users accessing adverse drug reaction data, the user's operation behavior is continuously monitored. The ELK log collection framework is used to transmit the user's access log in a structured format to Elasticsearch in real time, and the data is cleaned and converted through Logstash. The index of user behavior data is established in Elasticsearch, and the data is visualized and displayed through Kibana. The user behavior data is regularly analyzed for association rules. The Apriori algorithm is used to set the minimum support and minimum confidence thresholds to mine frequent patterns and association rules between user access behaviors, identify abnormal access behaviors and potential risks, and trigger corresponding control measures according to the risk level, such as access frequency restrictions and manual review. According to the results of user behavior analysis, the user's access rights are dynamically adjusted. For users with frequent abnormal behaviors or high risk levels, their access rights are reduced, or the manual review process is triggered. At the same time, user behavior security reports are generated, and data access and identity authentication processes are regularly audited. To build a PKI system, the adverse reaction trace management system uses the RSA algorithm to generate a 2048-bit root certificate key pair, and uses the SHA-256 algorithm to hash the root certificate to generate a digital signature of the root certificate, and stores the root certificate and digital signature in a secure certificate library.When a user registers, the ECC algorithm is used to generate a 256-bit user certificate key pair, and the user's identity information and public key are submitted to the CA for certificate issuance. The CA uses the private key of the root certificate to digitally sign the user certificate, generate a user certificate, and securely transmit the certificate to the user through the HTTPS protocol. For each adverse drug reaction record, the SHA-256 algorithm is used to calculate the record's hash value as the record's unique fingerprint code, and then the AES-256 algorithm is used to encrypt the fingerprint code with the 32-byte key provided by the administrator, and the RSA algorithm is used to digitally sign the hash value of the fingerprint code. The signature result is stored in the MongoDB database together with the encrypted fingerprint code. When a user tries to access data, the validity of the user certificate can be queried from the CA through the OCSP protocol. If the certificate is valid, the user's public key in the certificate is used to verify the user's identity. After the verification is passed, the user's role permissions in the Redis cache are used to determine whether the user has access to the requested data. If the user has permission, the encrypted fingerprint code and digital signature are read from MongoDB, and the digital signature is verified using the administrator's public key. If the signature is valid, the fingerprint code is decrypted using the AES key to obtain the original hash fingerprint code, which is compared with the hash value of the requested adverse drug reaction record. If they are consistent, the user is allowed to access the data. Using the ELK log collection framework, the user's access request is recorded in Elasticsearch in JSON format, and Logstash is used to filter and convert the log data, extract key fields such as user ID, access time, access content, etc., and then use Kibana for real-time monitoring and visualization. At 2 a.m. every day, Apriori association rule analysis is performed on the user behavior logs in Elasticsearch. The minimum support is set to 0.05 and the minimum confidence is set to 0.8. Association rules between user access behaviors are discovered, such as "users who access between 2 and 4 a.m. and whose access content contains sensitive keywords are 90% likely to try to access unauthorized data within 1 hour." For users who meet the association rules, the adverse reaction trace management system reduces their access rights to read-only and triggers a manual review process. At the same time, the user's behavior log is exported to CSV format and saved to S3 object storage for compliance auditing.

[0020] S103: Obtain and analyze user operation logs, use the isolation forest algorithm to perform anomaly detection, and analyze the difference between normal operations and abnormal operations.

[0021] Obtain user operation log data; store, manage and desensitize log data; pre-process user operation log data to filter out incomplete, invalid or duplicate records, sort user operation log data according to the timestamp of the operation to form time series data; encode and normalize key fields such as user ID, IP address, operation type, and access resource; extract key indicators reflecting the characteristics of user operation behavior from the pre-processed user operation log data, and construct a user behavior feature vector; use the isolation forest algorithm to perform anomaly detection on the user behavior feature vector and identify abnormal operation behavior; calculate the anomaly score of the identified abnormal operation behavior, and determine the abnormal operation based on the anomaly score; classify, attribute and deal with abnormal operations, and formulate corresponding security defense strategies and measures.

[0022] Specifically, obtain user operation log data from various business systems and applications, including user login, logout, access, query, modification, deletion and other operation records, store and manage log data in a unified format, and desensitize sensitive information, such as hashing identification information such as user ID and IP address to generate irreversible hash values; encrypt sensitive text information, such as using AES algorithm for symmetric encryption; mask some sensitive digital information, such as mobile phone number, bank card number, etc., only retain some key bits, and indicate other bits with asterisks to ensure data security and compliance. Pre-process user operation log data, use regular expressions or string matching methods to filter out incomplete, invalid or duplicate records, and sort log data according to the timestamp of the operation to form time series data, and encode and normalize key fields such as user ID, IP address, operation type, access resource, etc. to improve data quality and availability. According to business needs, set some rule filters to remove some irrelevant or low-value log data; set a higher sampling ratio for some important operations, such as login and payment, and set a lower sampling ratio for some frequent but less important operations, such as browsing and query, to reduce the amount of data while ensuring data quality. Extract key indicators reflecting the characteristics of user operation behavior from the preprocessed log data, such as operation frequency, operation duration, operation resource type, operation time distribution, etc., and construct a high-dimensional user behavior feature vector as the input data of the anomaly detection model. At the same time, the feature vector is reduced in dimension and standardized to eliminate the dimensional differences between different indicators. The isolation forest algorithm is used to detect anomalies in the user behavior feature vector. By recursively randomly dividing the hyperplane in the feature space, the sample points are divided into different subspaces. Abnormal sample points are usually quickly isolated into a few subspaces, thereby realizing the identification and location of abnormal operation behaviors. The complexity of the algorithm is O(nlogn), where n is the number of samples, which is suitable for processing large-scale high-dimensional data. Train multiple isolation forest models and perform weighted average of their anomaly scores to improve the robustness of detection; dynamically adjust the number of isolation trees and sampling ratio according to the distribution characteristics of the data and the changes in the anomaly ratio to improve the adaptability of detection; for high-dimensional data, dimensionality reduction algorithms such as PCA and t-SNE can be used to map the data to a low-dimensional space, and then apply the isolation forest algorithm to reduce computational complexity. During the training process of the isolation forest algorithm, the detection accuracy and efficiency of the algorithm are optimized by setting appropriate parameters such as the number of trees, subsampling ratio, and abnormal sample ratio. At the same time, the Monte Carlo cross-validation method is used to evaluate the generalization ability of the model, and the model parameters are dynamically adjusted according to the evaluation results to improve the accuracy and robustness of anomaly detection.For abnormal operation behaviors identified by the isolation forest algorithm, calculate their anomaly scores. The higher the score, the more abnormal the operation behavior. According to the distribution of anomaly scores, set appropriate thresholds, and determine operations with scores exceeding the threshold as abnormal operations. Compare and analyze them with normal operations to explore the characteristic patterns and laws of abnormal operations, and provide a basis for subsequent security policy formulation. According to the results of anomaly detection, classify and attribute the identified abnormal operations, determine the type, risk level, and impact range of abnormal operations, and formulate corresponding disposal strategies and response measures in combination with specific business scenarios and security requirements. According to the risk level of abnormal operations, manage users in a hierarchical manner, focus on monitoring high-risk users, and dynamically adjust their permissions and resource access policies; connect anomaly detection results with SIEM security information and event management systems to achieve automated disposal and response of security incidents; use anomaly detection results to evaluate and optimize the security policies and defense mechanisms of the adverse reaction trace management system, timely discover and repair security vulnerabilities, and improve the overall security of the system. Flume and Kafka are used to build a pipeline for real-time log collection and transmission. User operation logs in a distributed environment are collected in JSON format into HDFS and HBase. For identification information such as user ID and IP address, the SHA-256 algorithm is used for hash desensitization to generate a 64-bit hash value; for sensitive text information, the AES-256 algorithm is used for encryption, and the encryption key is securely distributed and managed through the RSA algorithm; for digital information such as mobile phone numbers and bank card numbers, masking technology is used to retain the first 4 and last 4 digits, and replace the middle with asterisks. In the data preprocessing stage, regular expressions are used to filter out records that do not conform to the log format, and logs are sorted according to timestamps. One-hot encoding and Min-Max normalization methods are used to encode and normalize key fields, and the sampling ratio is set. A 100% sampling rate is set for key operations such as login and payment, and a 10% sampling rate is set for common operations such as browsing and querying. PySpark was used to extract 50 key features such as operation frequency, operation duration, and access resource type, and the Word2Vec algorithm was used to convert text features into 200-dimensional vector representations, ultimately generating a 5000-dimensional user behavior feature vector. Pandas' DataFrame was used for data storage and processing. Scikit-learn was used to implement the isolation forest algorithm, setting the number of trees to 100, the subsampling ratio to 256 / 5000, and the abnormal sample ratio to 0.05. The model was evaluated using 10-fold cross validation, with an average ROCAUC of more than 0.98. Based on the abnormal score distribution, operations with a score greater than 0.6 were identified as abnormal. Cluster analysis was performed on abnormal operations, and the DBSCAN algorithm was used with ε set to 0.5 and MinPts set to 10 to identify the main types and patterns of abnormal operations.

[0023] The isolation forest algorithm isolates samples by constructing multiple decision trees and identifies abnormal behaviors based on the characteristic that the path of abnormal behaviors is shorter than that of normal behaviors.

[0024] Key indicators reflecting user behavior characteristics are extracted from user operation logs, and user behavior feature space is constructed as input data for the isolation forest algorithm. Multiple isolation trees are constructed by recursively dividing the hyperplane in the feature space. Some sample points are selected as training sets, and corresponding parameters are set to control the scale and complexity of the isolation forest. The average path length of each sample point in the isolation tree is counted as the anomaly score, and abnormal behaviors are identified based on the anomaly score. Abnormal behaviors are classified and handled, triggering corresponding security defense measures, and the detection model of the isolation forest algorithm is optimized.

[0025] Specifically, key indicators reflecting user behavior characteristics, such as operation type, operation frequency, operation duration, operation resources, etc., are extracted from user operation log data, and these indicators are quantified and standardized, converted into numerical feature vectors, and the user behavior feature space is constructed as the input data of the isolation forest algorithm. According to the principle of the isolation forest algorithm, by randomly selecting features and feature values, using heuristic strategies or optimization algorithms, recursively dividing hyperplanes in the feature space, dividing sample points into different subspaces, and constructing multiple isolation trees. The depth of each isolation tree reflects the difficulty of isolating the sample point. Abnormal sample points are usually quickly isolated to leaf nodes, so the isolation tree depth of abnormal sample points is shallow. In the process of constructing the isolation tree, some sample points are selected as training sets by random sampling to improve the operation efficiency and generalization ability of the algorithm. At the same time, by setting parameters such as the number of trees, subsampling ratio, and stop conditions, the scale and complexity of the isolation forest are controlled to avoid overfitting or underfitting problems. For each sample point, the average path length in all isolation trees is counted as the abnormality score of the sample point. The shorter the path length, the higher the abnormality score, indicating that the sample point is more likely to be an abnormal point. By performing histogram analysis on the abnormality score, the distribution law of the abnormality score is found, and the threshold is determined according to the quantile or standard deviation; statistical analysis is performed on different types of abnormal behaviors, and different thresholds are determined according to the degree of harm and frequency of abnormal behaviors; ROC curve or PR curve is used to evaluate the detection performance under different thresholds, and the appropriate balance point is selected as the final threshold, and the sample points with abnormal scores exceeding the threshold are identified as abnormal behaviors. For the identified abnormal behaviors, they are classified and handled in combination with specific business scenarios and security strategies. For known attack behaviors, such as SQL injection and XSS attacks, rule-based methods are used to formulate special detection rules and defense measures; for unknown abnormal behaviors, machine learning-based methods, such as clustering and classification, are used to divide abnormal behaviors into different categories, and corresponding disposal strategies are formulated for each category; for high-risk abnormal behaviors, such as sensitive data leakage and system crashes, real-time alarms and rapid isolation measures are taken to reduce the scope and duration of the impact of the harm. In the application process of the isolation forest algorithm, user operation log data is continuously collected and updated. Using incremental learning, new user behavior data is regularly added to the training set to update the isolation forest model to adapt to the changing data distribution and abnormal patterns. Using active learning, some sample points with high uncertainty or close to the boundary are selected, and security experts are asked to manually label and provide feedback to improve the accuracy and interpretability of the model. Using model fusion, the isolation forest algorithm is combined with other anomaly detection algorithms, such as LOF and OCSVM, to complement each other and improve the robustness and generalization of detection. At the same time, the anomaly detection results are correlated with other security components such as intrusion detection and risk assessment for analysis.From the massive user operation log data, 20 key fields such as operation type, operation time, and operation object are extracted using regular expressions, and the Min-Max normalization method is used to normalize the numeric fields, converting all fields into real values ​​in the interval [0,1] to form a user behavior feature vector. Using the RandomForest class in SparkMLlib, the number of trees is set to 100, the maximum depth of each tree is 10, the subsampling ratio is 256 / 1024, and sqrt(20)=4 features are randomly selected as candidate features. Isolation trees are recursively constructed until the depth of the tree reaches the maximum depth or the number of samples in the node is less than 2. For each sample point, the average path length in 100 isolation trees is counted to obtain the anomaly score, and the 98th percentile of the score is taken as the anomaly threshold, that is, the anomaly ratio is 2%. Behaviors with anomaly scores greater than 0.6 are divided into five categories: frequent access to sensitive resources, unauthorized operations, long-term remote logins, batch modification of key data, and abnormal consumption of system resources. For each category, corresponding real-time alarms and action strategies are formulated, such as SMS notifications, account locks, and access restrictions. Every day, 10 million new user behavior logs are added to the historical data set to retrain the isolation forest model; 100 abnormal behavior data are manually checked every week, marked as true or false anomalies, and the accuracy, recall rate and other indicators of the model are calculated; the LOF algorithm is used to cross-validate abnormal behaviors every month, and model parameters and threshold selection strategies are continuously optimized. Abnormal user behavior data, network intrusion detection data, business risk control data, etc. are uniformly stored in the HBase distributed database, and OLAP analysis is performed using the Kylin multidimensional analysis engine to generate visual reports and alarm signals.

[0026] S104. Build a user operation frequency prediction model based on the user's historical operation data, predict the time and frequency of normal operations according to the user's active time period and operation habits, compare the real-time monitored data with the user operation frequency prediction model, and mark operations that deviate from the predicted behavior as suspicious.

[0027] Build a user operation data set based on the user's historical operation data, and use the user operation data set as a sample for training the user operation frequency prediction model; count the number and frequency of user operations in different time periods based on the user operation data set, draw a user active time distribution diagram, and identify the user's active peak period and inactive period from the active time distribution diagram; calculate the mean and variance of the operation frequency at different time granularities, and obtain statistical indicators for characterizing the overall characteristics of the user's operation habits; according to the user's historical operation data, fit the changing trend and periodic law of the user's normal operation frequency in different time periods, and build a user operation frequency prediction model; use the sliding window method to dynamically update the parameters of the user operation frequency prediction model to adapt to changes in user operation habits; extract the operation frequency from the user operation data monitored in real time. The key features of time and operation type are input into the user operation frequency prediction model to obtain the predicted value of the user's normal operation frequency at that time point; the deviation between the actual operation frequency and the predicted value is calculated. If the deviation exceeds the preset threshold, the operation is marked as a suspicious operation; for users who are marked as suspicious operations for multiple consecutive times, the abnormal behavior identification process is triggered to determine whether the user's behavior conforms to the known abnormal behavior pattern; if it conforms to the known abnormal behavior pattern, an abnormal behavior alarm is generated, and corresponding disposal measures are taken according to the risk level of the abnormal behavior; cluster analysis is performed on the user's behavioral characteristics, and users with similar behavior patterns are divided into the same group, and user portraits are constructed to characterize the behavioral preferences and risk characteristics of different user groups, providing prior knowledge for the identification and prevention of abnormal behaviors.

[0028] Specifically, historical operation data of users is obtained from data sources such as user operation logs and business system records, including operation type, operation time, operation object, operation result and other information. The data is cleaned, converted and integrated to build a structured user operation data set as a training sample for the user operation frequency prediction model. Exploratory analysis is performed on the user operation data set. By counting the number and frequency of users' operations in different time periods, a user active time distribution diagram is drawn to identify the user's active peak period and inactive period, and the mean and variance of the operation frequency at different time granularities are calculated to characterize the overall characteristics of the user's operation habits. The ARIMA time series analysis algorithm is used to build a user operation frequency prediction model. Based on the user's historical operation data, the changing trend and periodicity of the user's normal operation frequency in different time periods are fitted, and the sliding window method is used to dynamically update the model parameters to adapt to changes in user operation habits. Flume distributed log collection framework is used to collect user operation logs scattered on different servers into message queues such as Kafka, and log data is cleaned, filtered and converted in Kafka to extract key fields such as user ID, operation type, operation time, etc., and convert them into structured data formats such as JSON and Avro. Spark Streaming streaming computing framework is used to process real-time log data in Kafka, extract key features such as operation time and operation type, input them into the user operation frequency prediction model, obtain the predicted value of the user's normal operation frequency at that time point, and calculate the deviation between the actual operation frequency and the predicted value. Adopting the adaptive threshold method, the threshold size is automatically adjusted according to the dynamic changes of user behavior to avoid the problem of false positives or false negatives caused by fixed thresholds. If the deviation exceeds the preset threshold, the operation is marked as a suspicious operation and output to the downstream abnormal behavior recognition module for further analysis and disposal; for the deviation that does not exceed the threshold, the parameters of the prediction model are updated to adapt to the changing trend of user behavior. In the abnormal behavior identification module, for users who have been marked as suspicious operations for many consecutive times, by analyzing the user's operation sequence, operation content, operation object and other multi-dimensional information, it is determined whether the user's behavior conforms to the known abnormal behavior pattern, and corresponding disposal measures are taken according to the risk level of the abnormal behavior. For low-risk abnormal behaviors, such as frequent page refreshes, repeated form submissions, etc., mild prompts and guidance measures are taken, such as pop-up confirmation boxes, delayed responses, etc.; for medium-risk abnormal behaviors, such as remote logins, batch data modifications, etc., strong restrictions and warning measures are taken, such as requiring re-authentication, limiting operation frequency, recording operation logs, etc.; for high-risk abnormal behaviors, such as malicious crawlers, destructive operations, etc., decisive blocking and isolation measures are taken, such as blacklisting IPs, freezing accounts, and alarms.On the basis of abnormal behavior identification, cluster analysis of user behavior characteristics is performed using K-means or Prophet clustering algorithms. According to the type and characteristics of abnormal behavior, key features that can reflect abnormal behavior, such as operation frequency, operation duration, operation resources, etc., are selected. Feature selection algorithms, such as information gain and chi-square test, are used to automatically screen out the feature subset with the highest correlation with abnormal behavior. Prior knowledge of domain experts is introduced. Based on business experience and security common sense, some composite features are manually designed and constructed, such as the ratio of operation frequency to operation duration, sensitivity of operation resources, etc., to divide users with similar behavior patterns into the same group, build user portraits, characterize the behavior preferences and risk characteristics of different user groups, and provide prior knowledge for the identification and prevention of abnormal behavior. Association rule mining algorithms such as Apriori or DBSCAN are used to discover frequent co-occurrence patterns and association rules between different operation types, operation objects, operation time and other elements from massive user operation log data, reveal the internal logic and dependency of user behavior, and apply the mined association rules to abnormal behavior identification to improve the accuracy and interpretability of identification. Collect user operation logs from various business systems, use Flume to collect log data in real time at a rate of 1,000 per second, and cache and forward data through Kafka with 16 partitions and a data block size of 100MB to ensure high throughput and real-time performance of the data. Use SparkStreaming to process the log data in Kafka with a time window of 10 seconds, extract fields such as user ID, operation time, operation type, and operation object, use the Prophet algorithm to build a user operation frequency prediction model, train the model with the data of the last 3 days, predict the user's operation frequency in the next 1 hour online, and compare it with the actual operation frequency, calculate the JS divergence, and determine it as an abnormal operation if it exceeds the threshold of 0.6. Cluster analysis is performed on abnormal operations based on characteristics such as operation type, operation frequency, and operation time. The DBSCAN algorithm is used with ε set to 0.5 and MinPts set to 5 to discover abnormal user groups. The Apriori algorithm is used with the minimum support set to 0.1 and the minimum confidence set to 0.8 to mine association rules of abnormal user operations. The corresponding behavior patterns are matched in the rule base, and corresponding real-time intervention measures are taken for abnormal behaviors of different risk levels, such as remote login events triggering face recognition verification, batch data deletion events triggering operation confirmation pop-up windows, and frequent request events triggering verification code verification.

[0029] S105. Combine the frequency of drug use, the time series data of adverse reaction reports, and the diversity indicators of patient behavior to implement dynamic abnormal activity monitoring. Optimize the monitoring strategy and early warning thresholds based on the feedback of monitoring results.

[0030] Model and predict the drug use frequency data and adverse reaction report data to obtain the normal drug use pattern and adverse reaction occurrence pattern in the future, and calculate the confidence interval of the model as the basis for determining abnormal activities; extract features from patient behavior data to reflect the diversity of patient behavior indicators and find abnormal points and outliers in patient behavior patterns; conduct correlation analysis on the results of patient behavior abnormality detection and the results of drug use frequency prediction and adverse reaction report prediction to determine the correlation and causality between abnormal behavior and abnormal drug use and abnormal adverse reactions, and determine the impact range and severity of abnormal behavior; dynamically adjust the monitoring strategy and early warning threshold according to the type, impact range and severity of abnormal behavior; conduct feedback analysis on the monitoring results, evaluate the effectiveness and accuracy of the monitoring strategy and early warning threshold, and optimize the monitoring strategy by calculating the detection rate, false alarm rate and missed alarm rate indicators of abnormal behavior; apply the optimized monitoring strategy and early warning threshold to real-time abnormal activity monitoring, conduct real-time analysis and prediction of new drug use data, adverse reaction report data and patient behavior data, discover and warn potential erroneous behavior and fraudulent behavior, and respond and deal with early warning events in a graded manner.

[0031] Specifically, drug use frequency data, adverse reaction report data, and patient behavior data are obtained from data sources such as medical information systems and drug adverse reaction monitoring systems. The data are cleaned, integrated, and converted to form a data set in time series format as the input for abnormal activity monitoring. Time series analysis algorithms, such as ARIMA and Prophet, are used to model and predict drug use frequency data and adverse reaction report data. For the ARIMA model, information criteria such as AIC and BIC are used to evaluate the performance of models of different orders and select the optimal p, d, and q values. For seasonal factors, the autocorrelation graph and partial autocorrelation graph of the time series are used to judge. Seasonal decomposition methods, such as STL decomposition, can also be used to decompose the time series into trend terms, seasonal terms, and random terms, and model them separately. For the Prophet model, the time series is divided into a training set and a test set by cross-validation methods, such as the sliding window method, and the model is fitted on the training set. The prediction error of the model, such as MAE and MAPE, is evaluated on the test set, and the model parameters with the smallest prediction error are selected. Through appropriate parameter selection and model evaluation, the normal medication pattern and adverse reaction pattern in the future period are obtained, and the confidence interval of the model is calculated as the basis for determining abnormal activities. Multi-dimensional feature engineering is performed on patient behavior data to extract indicators that reflect the diversity of patient behavior, such as the change rate of medication dosage, the change rate of medication time interval, the diversity of adverse reaction symptoms, etc., and unsupervised learning algorithms are used for anomaly detection. For unsupervised learning anomaly detection algorithms, such as distance-based methods, such as KNN, LOF, density-based methods, such as DBSCAN, OPTICS, and ensemble-based methods, such as IsolationForest, XGBOD, appropriate algorithms are selected according to the distribution characteristics of the data and the type of anomaly. For supervised learning anomaly detection algorithms, such as support vector machines, random forests, neural networks, etc., a part of the abnormal data is marked in advance as training samples, and the abnormal feature patterns are learned, and then used for anomaly judgment of unknown data. It is suitable for scenarios where the abnormal type is known and relatively stable. Then, abnormal points and outliers in the patient's behavior pattern are discovered. The results of abnormal patient behavior detection were correlated with the results of drug use frequency prediction and adverse reaction report prediction. The Pearson correlation coefficient, Spearman rank correlation coefficient, etc. were used to measure the correlation between abnormal behavior and abnormal medication and abnormal adverse reactions. The larger the value, the stronger the correlation. The chi-square test, mutual information and other methods were used to determine whether there was a significant correlation between abnormal behavior and abnormal medication and abnormal adverse reactions. The smaller the p value, the more significant the correlation. The Granger causality test, cross entropy and other methods were used to analyze the causal relationship between abnormal behavior and abnormal medication and abnormal adverse reactions, to determine whether there was a temporal sequence and influence relationship, and finally to determine the scope and severity of the impact of abnormal behavior.According to the type, scope and severity of abnormal behavior, the monitoring strategy and warning threshold are adjusted dynamically. For the adjustment of monitoring frequency, the adaptive sampling method is adopted to dynamically adjust the frequency of data collection according to the probability and impact of abnormal behavior, while ensuring the abnormal capture rate, reducing the cost of data transmission and storage; for the adjustment of data granularity, a multi-level data aggregation method is adopted to increase the data collection and analysis granularity in the area or time period where the abnormality occurs, and reduce the data collection and analysis granularity in the peripheral area or calm period where the abnormality occurs, so as to achieve refined monitoring and analysis; for the adjustment of warning threshold, the adaptive threshold method is adopted to set the initial threshold according to historical data and expert experience, and dynamically adjust the threshold according to the actual warning effect, while improving the accuracy of warning and reducing the false alarm rate and missed alarm rate. For abnormal behaviors with major impact or long duration, the warning threshold is lowered, the monitoring frequency and data granularity are increased; for abnormal behaviors with minor impact or short duration, the warning threshold is increased, the monitoring frequency and data granularity are reduced, so as to balance the cost and benefit of monitoring. Feedback analysis is conducted on the monitoring results to evaluate the effectiveness and accuracy of the monitoring strategy and warning threshold. By calculating indicators such as the detection rate, false alarm rate, and missed alarm rate of abnormal behavior, the monitoring strategy is optimized to improve the recognition rate and prediction rate of abnormal behavior and reduce the cost of false alarms and the risk of missed alarms. The optimized monitoring strategy and warning threshold are applied to real-time abnormal activity monitoring, and new drug use data, adverse reaction report data, and patient behavior data are analyzed and predicted in real time to timely discover and warn of potential erroneous behaviors and fraudulent behaviors. In combination with expert knowledge and business rules, warning events are responded to and handled in a graded manner to form a closed-loop abnormal activity monitoring and risk management process. Drug use records and adverse reaction reports from the medical information system for the past three years, about 100,000 per day, and patient behavior logs from the patient behavior system for the past year, about 1 million per day, are extracted. Spark is used to clean, integrate, and transform the data to form a time series data set in units of days. The auto.arima function in R was used to perform autoregressive modeling on the frequency of drug use and the incidence of adverse reactions. The optimal model was selected according to the AIC criterion, and seasonal decomposition was performed to obtain the predicted values ​​and 95% confidence intervals of the frequency of drug use and the incidence of adverse reactions in the next 30 days. Feature engineering was performed on the patient behavior data to extract 20 indicators reflecting the diversity of medication behavior, such as average medication dosage, maximum medication interval, and number of adverse reaction symptoms. The IsolationForest algorithm in Python was used for anomaly detection, and the contamination parameter was set to 0.05, indicating that the abnormal proportion was 5%, and the score ranking of abnormal patient behavior was obtained.The Pearson correlation coefficient was used to calculate the correlation between abnormal behavior scores and the prediction errors of drug use frequency and adverse reaction incidence. If the correlation coefficient was greater than 0.6, the two were considered to be significantly positively correlated. The Granger causality test was used to calculate the causal relationship between abnormal behavior and prediction error. The lag was set to 24. If the p value was less than 0.05, the abnormal behavior was considered to be the Granger cause of the prediction error. For abnormal behaviors that were significantly correlated and causally related, the monitoring frequency and warning threshold were dynamically adjusted according to their abnormal scores. For abnormal scores greater than 0.9, they were monitored once an hour, and the threshold was set to 0.7; for abnormal scores less than 0.5, they were monitored once a day, and the threshold was set to 0.95; for the rest, they were monitored once every 4 hours, and the threshold was set to 0.8. Feedback analysis was performed on the monitoring results, and the detection rate, false alarm rate, and missed alarm rate of abnormal behavior were calculated. The grid search method was used to optimize the n_estimators and max_samples parameters of IsolationForest, so that the detection rate reached more than 90% on the validation set, and the false alarm rate and missed alarm rate were controlled within 5%. Use Redis to cache drug use records, adverse reaction reports, and patient behavior logs in real time, and use Storm to determine abnormal behavior in real time. If an alert is triggered, it will be sent through RabbitMQ.

[0032] Track the changing trends of drug usage frequency and adverse reactions, establish a baseline through historical data, and generate a warning and indicate possible abnormal behavior if the new data monitored fluctuates from the baseline by more than the preset threshold.

[0033] Obtain historical data on drug use frequency and adverse reaction frequency; use time series analysis methods to predict trends and detect anomalies in drug use frequency and adverse reaction frequency; fit drug use frequency and adverse reaction frequency to obtain the fitting curve as the baseline, and calculate the distribution characteristics of the fitting residual as a reference indicator for baseline fluctuations; for newly monitored drug use frequency and adverse reaction frequency data; if the predicted residual exceeds the threshold range of baseline fluctuations, it is determined to be an outlier and an abnormal behavior warning is generated; dynamically adjust the warning threshold based on the frequency and severity of abnormal behavior warnings; if the abnormal warning has not appeared for a long time, increase the warning threshold and reduce the sensitivity of anomaly detection; cluster analysis is performed on the abnormal values ​​of drug use frequency and adverse reaction frequency, divide the abnormal values ​​into different abnormal events, analyze the correlation and conductivity between abnormal events, and construct the causal chain and impact network of abnormal events; formulate corresponding response strategies and disposal plans for different types of abnormal events.

[0034] Specifically, historical data on drug use frequency and adverse reaction frequency are obtained, with a data granularity of days and a time span of the past three years. The data is cleaned, deduplicated and outliers are processed to construct a time series data set, and the data of the most recent year is used as the test set, and the data of the previous two years is used as the training set and validation set. At the same time, stratified sampling is used to stratify the data according to key attributes such as drug category and patient demographic characteristics, and then random sampling is performed within each stratum to ensure the representativeness and balance of data division. ARIMA time series analysis methods are used to predict trends and detect anomalies in drug use frequency and adverse reaction frequency. Through grid search and cross-validation, the hyperparameters of the model are optimized, such as the p, d, q values ​​of the ARIMA model, the seasonal parameters of the Prophet model, etc., so that the prediction error of the model on the validation set is minimized, such as RMSE, MAE, etc. On the training set, the optimized model is used to fit the drug use frequency and adverse reaction frequency, and the fitting curve is obtained as the baseline. The distribution characteristics of the fitting residuals, such as the mean, standard deviation, quantile, etc., are calculated as reference indicators for baseline fluctuations. For the newly monitored data on drug usage frequency and adverse reaction frequency, the trained model is used for prediction to obtain the predicted value and confidence interval, and the predicted residual is calculated. A variety of abnormality detection methods are used, such as the predicted residual exceeds the 95th percentile of the baseline residual, or the predicted residual exceeds 3 times the standard deviation of the truncated mean, to determine whether it is an abnormal value. If it is determined to be an abnormal value, an abnormal behavior warning is generated. At the same time, the moving average control chart (EWMA) method is used to calculate the exponentially weighted moving average and upper and lower control limits of the predicted value. If the predicted value exceeds the control limit, the abnormal behavior is further confirmed. According to the frequency and severity of abnormal behavior warnings, the early warning threshold is dynamically adjusted. For the quantification of abnormal warning frequency, the number of abnormal warnings per unit time, such as daily and weekly, is calculated, the changing trend of the number of abnormal warnings over time is tracked, and the upper and lower control limits of the number of abnormal warnings are set; for the quantification of the severity of abnormal warnings, different levels are set according to the degree of abnormality, such as mild, moderate, and severe, and different weights are assigned to each level, such as 1, 2, and 3. The number of weighted abnormal warnings is calculated, and a mathematical model for threshold adjustment is designed in combination with the quantitative indicators of abnormal warning frequency and severity. For example, the threshold is inversely proportional to the linear combination of the number of abnormal warnings and the number of weighted abnormal warnings. When the number of abnormal warnings or the number of weighted abnormal warnings exceeds the upper limit, the threshold is automatically lowered; when the number of abnormal warnings or the number of weighted abnormal warnings is lower than the lower limit, the threshold is automatically increased to balance the accuracy and timeliness of abnormal detection.Cluster analysis was performed on the outliers of drug use frequency and adverse reaction frequency. The DBSCAN density clustering algorithm was used to divide the outliers into different abnormal events according to their time, frequency, amplitude and other characteristics. The clustered abnormal events were classified, such as classification according to dimensions such as the time, location, and object of the abnormality, to form a type system of abnormal events. Each type of abnormal event was evaluated, and qualitative and quantitative evaluations were performed from aspects such as severity, scope of impact, and probability of occurrence. The risk level of abnormal events was calculated, the correlation and conductivity between abnormal events were analyzed, and the causal chain and impact network of abnormal events were constructed. Formulate corresponding response strategies and disposal plans for abnormal events of different types and risk levels. For isolated and sporadic abnormal events, adopt observation and tracking strategies to closely monitor their subsequent changes; for continuous and trending abnormal events, adopt early warning and intervention strategies, analyze the causes of abnormalities, and formulate rectification measures; for related and coupled abnormal events, adopt linkage and coordination strategies, coordinate and formulate emergency plans to control the scope and extent of the impact of abnormal events to the maximum extent; for high-risk abnormal events, adopt real-time early warning and rapid response mechanisms; for low-risk abnormal events, adopt post-event review and continuous monitoring mechanisms to form a complete abnormal management closed loop. Obtain drug use and adverse reaction data from sources such as drug order management systems, electronic medical record systems, and adverse reaction reporting systems. The time granularity is daily, and the time span is from January 1, 2020 to December 31, 2022, a total of 1095 days of data. Perform ETL processing on the data, remove sensitive information such as drug codes and patient IDs, and standardize text fields such as drug names and adverse reaction symptoms to form a structured time series data set. The data were randomly divided into training set, validation set and test set in a ratio of 7:2:1, and stratified sampling was performed according to drug categories, such as antibiotics and analgesics. The data volume of each category was kept consistent with the overall data volume. The SARIMAX model in Python was used to model the frequency of use and adverse reaction rate of each drug. GridSearchCV was used to optimize the parameters, and the (1,1,1) (0,1,1,7) parameter combination that minimized the RMSE on the validation set was selected. The Ljung-Box test was used to test the white noise of the residuals. The mean, standard deviation and quartile of the fitted residuals on the training set were calculated, and the abnormal threshold was determined using the 3σ rule. The trained model was used to predict the test set on a daily basis, and the predicted residuals were calculated. The residuals that exceeded the 3σ threshold were marked as abnormal, and a daily report was generated. Prometheus was used to monitor the minute-level change trend of the predicted residuals, and the upper and lower control limits were calculated using the EWMA chart to dynamically adjust the warning trigger conditions.DBSCAN clustering was performed on the abnormal data, with the eps parameter set to 0.5 and the min_samples parameter set to 5. Representative events of each cluster were extracted to build an abnormal event library. The severity level of each abnormal event was manually annotated in combination with the adverse reaction description in the drug instructions. The association rule mining algorithm Apriori was used to analyze the correlation between abnormal events, with the support threshold set to 0.05, the confidence threshold set to 0.8, and the lift threshold set to 1.5. The mined association rules were applied to real-time anomaly detection. If a high-confidence risk event occurred, an early warning would be automatically triggered, and the relevant drug manufacturers, medical institutions, and regulatory authorities would be notified by SMS, email, etc. according to the severity of the abnormality. The disposal process and results were recorded to form a case library for optimizing the algorithm model and adjusting the early warning strategy.

[0035] S106. Based on the feature extraction of the operation data, the tampering behavior is identified and evaluated based on the isolation forest algorithm and the autoencoder network, and the detection process is optimized through expert verification and parameter adjustment.

[0036] Construct an operation feature vector based on the features extracted from the user operation data; perform anomaly detection on the operation feature vector; perform dimensionality reduction and reconstruction on the operation feature vector; perform weighted fusion of the anomaly scores of the isolation forest algorithm and the autoencoder network to obtain a comprehensive anomaly score for the operation, set an anomaly threshold, determine operations that exceed the anomaly threshold as tampering behavior, evaluate the impact and harm of the tampering behavior based on the comprehensive anomaly score, and generate a tampering behavior report; extract a certain proportion of samples from suspected tampering behaviors detected, and have them manually reviewed and confirmed by business experts; annotate false alarm samples, collect false alarm causes and contextual information; review missed alarm samples, supplement new patterns and features of tampering behaviors, and form a tampering behavior knowledge base; optimize the hyperparameters of the isolation forest algorithm and the autoencoder network based on false alarms and missed alarms reported by experts; when tampering behavior is detected, trace the source and conduct correlation analysis on the tampering behavior, dig out the behavior pattern, group characteristics, and impact links of the tampering behavior, and construct a tampering behavior knowledge graph.

[0037] Specifically, feature engineering is performed on user operation data to extract multi-dimensional features such as operation type, operation time, operation object, and operation result. The operation type is classified according to CRUD and then One-hot encoded. The time window, periodicity, continuity and other features are extracted for the operation time. A keyword dictionary is constructed for the operation object according to the business field, and TF-IDF features or word vector features are extracted. The operation results are represented by binarization, discretization and other methods, and finally a high-dimensional sparse operation feature vector is constructed as the input of the subsequent anomaly detection algorithm. The isolation forest algorithm is used to detect anomalies in the operation feature vector. By randomly selecting features and feature values, hyperplanes are recursively divided in the feature space, and the operation sample points are divided into different subspaces. Abnormal operation sample points are usually quickly isolated to leaf nodes. Therefore, the isolation tree depth of abnormal operations is shallow. The anomaly score of the operation is calculated according to the average depth of the isolation tree. The higher the score, the more likely the operation is abnormal. The advantages of the isolation forest algorithm are that it does not require labeling of abnormal samples, there is no prior assumption on the abnormal type, the computational complexity is low, and it is suitable for high-dimensional data. The disadvantage is that it cannot detect local anomalies and semantic anomalies. The autoencoder network is used to reduce the dimension and reconstruct the operation feature vector. Through unsupervised learning, the high-dimensional sparse operation features are mapped to the low-dimensional dense latent space, and then the original features are reconstructed from the latent space. The larger the reconstruction error, the more likely the operation is abnormal. The autoencoder network can learn the inherent patterns and laws of the operation data, and has a good detection effect on unknown types of abnormal operations. The advantage of the autoencoder network is that it can automatically learn the low-dimensional representation of the data and capture the nonlinear relationship in the data. At the same time, the restoration error can reflect the degree of abnormality. The disadvantage is that the model training is slow, the parameter adjustment is more complicated, and it is easy to overfit. In order to take into account both global and local anomalies, the anomaly scores of the isolation forest algorithm and the autoencoder network are weighted and fused to obtain the comprehensive anomaly score of the operation. The weight can be set according to prior knowledge or expert experience, or it can be automatically adjusted through methods such as Bayesian optimization. According to business experience and historical data, different thresholds are set for different levels of anomalies, such as Info level, Warning level, and Critical level; an adaptive threshold method is used to dynamically adjust the threshold according to the frequency and impact of abnormal operations, such as using the EWMA model to predict the probability of anomalies and updating the threshold according to the prediction error; the cost matrix of abnormal operations is introduced, and the risk loss and underreporting cost of different types of anomalies are considered, and the optimal threshold is determined by minimizing the expected loss. Operations that exceed the threshold are judged as tampering behaviors, and the impact and harm of the tampering behaviors are evaluated based on the comprehensive anomaly score. A tampering behavior report is generated, presenting the operation trajectory, abnormal characteristics, and impact range of the tampering behavior.For the suspected tampering behaviors detected, a certain proportion of samples are extracted and manually reviewed and confirmed by business experts. False positive samples are annotated, and the causes and contextual information of false positives are collected. The missed negative samples are reviewed, and new patterns and characteristics of tampering behaviors are supplemented to form a tampering behavior knowledge base to guide the optimization of detection algorithms. Based on the false positives and missed negatives reported by experts, the hyperparameters of the isolation forest algorithm and the autoencoder network are optimized. For the isolation forest algorithm, the main optimized hyperparameters include the number of trees, subsampling ratio, anomaly threshold, etc., which are tuned using grid search, random search, Bayesian optimization and other methods; for the autoencoder network, the main optimized hyperparameters include the number of hidden layers and nodes, activation function, loss function, optimizer, learning rate, which are tuned using genetic algorithms and other methods. The optimized evaluation indicators include the F1 value of anomaly detection. On the basis of tampering behavior detection, the tampering behavior is traced and associated, and time series decomposition and trend analysis are used to find the high-incidence period, mutation time point, periodic law, etc. of tampering behavior, which are used for behavioral trend warning and abnormal location; graph embedding and community discovery algorithms are used to mine the group behavior pattern of common tampering on the operator-operation object bipartite graph for group behavior identification and control; causal inference and influence estimation methods are used to analyze the propagation path and impact range of tampering behavior in the organizational network for traceability investigation and risk assessment; the multi-dimensional features of tampering behavior are mapped to low-dimensional space, and a visual map of tampering behavior is constructed for the analysis and interpretation of behavior patterns, forming a full-link tampering behavior governance solution. Feature extraction is performed on user operation log data, and a total of 50 features are obtained, including operation type, including One-hot encoding of CREATE, READ, UPDATE, and DELETE, operation time hours, weekdays, whether it is a weekend, etc., TF-IDF vector of the operation object, binary encoding of the operation result, etc., forming a 5000-dimensional sparse feature vector. The isolation forest algorithm was implemented using Python's sklearn library. The number of trees was set to 100, the subsampling ratio was 256 / 5000, and the anomaly threshold was 0.6. The model was fitted on the operation feature vector to obtain the anomaly score of each operation. The autoencoder network was built using Keras. The input layer had 5000 nodes, which were compressed into 3 hidden layers with 128, 32, and 4 nodes respectively. The output layer was then decompressed through 3 hidden layers to 5000 nodes. The ReLU activation function was used, the optimizer was Adam, the MSE loss function was minimized, and the training was performed for 100 epochs. The model was trained on the operation feature vector to obtain the reconstruction error of each operation. The isolation forest anomaly score and the autoencoder reconstruction error were normalized by Min-Max, and then fused at a weighted ratio of 3:1 to obtain the comprehensive anomaly score of the operation.Based on business experience, we set three levels of abnormal thresholds. The comprehensive abnormal score is greater than 0.9 for the Critical level, greater than 0.7 for the Warning level, and greater than 0.5 for the Info level. We use Python's statsmodels library to implement the EWMA model. We calculate the exponentially weighted moving average of the number of abnormal operations in units of days, with a weight parameter of 0.8. When the actual number of abnormal operations exceeds 3 times the standard deviation of the EWMA predicted value, the abnormal threshold is automatically lowered by 10%. We count the average losses caused by different types of abnormal operations from historical cases to calculate the abnormal cost matrix. We use the scipy library to solve the optimal threshold when minimizing the expected loss, and dynamically update the cost matrix. For operations with a comprehensive abnormal score exceeding the Warning level threshold, we randomly select 20% of the samples for review by business experts. For batches with a false alarm rate of more than 5%, we trace the causes of the false alarms, such as feature deviation and low thresholds, optimize features and thresholds, and design new features for new tampering techniques and add them to the model. The number of trees and subsampling ratio of the isolation forest are re-tuned every month. The parameter combinations are evaluated using grid search, and the parameter combination with the highest F1 value is selected. The autoencoder network is retrained every week, and the particle swarm algorithm is used to optimize the hidden layer structure, learning rate and other parameters to minimize the reconstruction error. The tsfresh library and Prophet library of Python are used to extract the time series characteristics of abnormal behavior, such as mean, variance, curvature, etc., to predict the trend and periodicity of abnormal occurrence, and analyze the causes of abnormality. The Node2Vec algorithm is used to learn the low-dimensional embedding vectors of operators and objects, and the Louvain algorithm is used for community discovery to identify abnormal groups that work closely together. The multi-dimensional features of abnormal operations are reduced by principal component analysis, and the T-SNE algorithm is used for visualization to generate a map of abnormal operations.

[0038] S107. Based on the drug use information and adverse reaction report data in the hospital blockchain network, design and deploy smart contracts to monitor the data on-chain in real time. Optimize the drug safety monitoring process based on the monitoring results and feedback information.

[0039] In the hospital blockchain network, a data model and storage structure for drug use information and adverse reaction report data are constructed; smart contracts are developed to define the trigger conditions and verification rules for data on-chain; for data on-chain requests that do not meet the conditions, the smart contract rejects and logs them; a data access control mechanism is designed in the smart contract, and different access rights are set for users with different roles; for unauthorized access or illegal access, the smart contract blocks and triggers an alarm; an early warning threshold is set for abnormal indicators, and the relevant responsible persons are notified when the early warning is triggered; security measure judgment logic is embedded in the smart contract, and suspicious data on-chain behaviors are identified and marked based on the characteristic patterns of drug use information and adverse reaction report data, triggering a manual verification process.

[0040] Specifically, in the hospital blockchain network, the data model and storage structure of drug use information and adverse reaction report data are designed, including fields such as drug code, use time, dosage, adverse reaction symptoms, severity, etc., and the hash algorithm is used to store the data on the chain to ensure the integrity and immutability of the data. For drug use information, define mandatory and optional fields, such as drug code, use time, dosage, etc., and patient weight, allergy history, etc., and set constraints such as field data type, format, value range, etc.; for adverse reaction reports, refer to the standards and specifications for adverse drug reaction reports, clarify the key information that must be included, such as drug name, adverse reaction symptoms, severity, time of occurrence, reporter, etc., and set clear classification standards for severity, such as mild, moderate, severe, fatal, etc. Develop smart contracts and define the trigger conditions and verification rules for data on the chain. For example, only authorized medical personnel can submit drug use information, and adverse reaction reports contain key fields and meet the severity classification standards. For data on the chain that do not meet the conditions, the smart contract automatically rejects and logs. Set data format verification and logic verification rules in smart contracts. For data that does not meet format requirements or is logically inconsistent, automatically refuse to upload to the chain and prompt error information to ensure the standardization and accuracy of the uploaded data. Design a data access control mechanism in the smart contract, set different access rights for users of different roles, such as doctors can only view the drug use information of their own patients, and drug regulatory authorities can view all adverse reaction report data. For unauthorized access or illegal access, the smart contract automatically blocks and triggers an alarm. According to the running status and transaction records of smart contracts, important events such as contract deployment, call, and exceptions are monitored and counted, and monitoring is carried out at the same time, such as the number of contract calls. Based on historical data and statistical analysis, calculate the mean, variance, quantile and other statistical quantities of indicators, and determine the warning threshold based on business experience and risk preferences, such as taking a value outside 3 times the standard deviation as the abnormal threshold; adopt a dynamic threshold method, according to the trend and fluctuation of the indicator, adaptively adjust the warning threshold, such as using the EWMA (exponential weighted moving average) model, and calculate the dynamic threshold based on the weighted average of the latest data point and historical data; automatically notify the relevant responsible person when an abnormal indicator triggers a warning. Automated security measure judgment logic is embedded in the smart contract, and suspicious data on-chain behaviors are identified and marked through anomaly detection algorithms based on the characteristic patterns of drug usage information and adverse reaction report data.Rule-based anomaly detection is used. According to expert knowledge and experience, a series of anomaly judgment rules are set, such as drug dosage exceeding the maximum recommended dosage, frequent reports of adverse reactions of the same drug by the same patient, etc., and data that meets the rules are marked as abnormal; the Z-score method is used for anomaly detection statistics, and statistical analysis is performed on indicators such as drug usage and adverse reaction incidence, and the mean, variance, percentile, etc. are calculated to mark data points that deviate from the normal distribution as abnormal; machine learning-based anomaly detection is used. Unsupervised learning algorithms such as K-means clustering and One-ClassSVM are used to cluster or model data, and outliers or data that do not conform to the normal pattern are marked as abnormal. Supervised learning algorithms such as decision trees and random forests are used to train anomaly recognition models and predict and classify new data; time series-based anomaly detection is used to model and predict time series data of indicators such as drug usage and adverse reaction incidence. For example, using ARIMA, Prophet and other models, points where the residual between the predicted value and the actual value exceeds a certain threshold are marked as abnormal. Further manual verification processes are automatically triggered based on abnormal behavior. Based on the immutable characteristics of blockchain, the drug safety data on the chain is traced and audited, and data query and analysis interfaces are provided through smart contracts to track the entire process of drug use, identify key links and responsible persons, and form audit reports for violations or management loopholes found and automatically distribute them to relevant parties through smart contracts. The proxy contract method is adopted to separate the logical implementation of the smart contract from the data storage. The proxy contract is responsible for managing and forwarding requests, so that the contract can be upgraded separately without affecting the integrity and consistency of the data; the multi-version coexistence method is adopted, and the new version of the smart contract runs in parallel with the old version for a period of time. For new requests, the new version is processed first, and for historical data, the old version is still used to provide services until the new version is stable and then completely switched; set the upgrade and rollback mechanism in the smart contract, and authorize and confirm the contract upgrade through the administrator role or multi-signature mechanism. In the case of upgrade failure or the introduction of new problems, it can quickly roll back to the last stable version; it can also use the consensus mechanism of blockchain at the same time to achieve multi-party collaborative supervision and improve the fairness and transparency of supervision. In the blockchain network, the Fabric framework is used to design a drug safety data model, which includes 20 fields such as drug code, usage time, dosage, adverse reactions, etc. Among them, drug code, usage time, and adverse reaction symptoms are required fields, and the SHA256 hash algorithm is used to store data on the chain. The smart contract is written in Go language, and the digital certificate of the medical staff role is set as the permission requirement for submitting data. Regular expressions are used to format the key fields of the adverse reaction report, such as the drug code must be a 10-digit string starting with YP, and the adverse reaction symptoms must contain at least 5 Chinese words, and the severity is divided into 1-5 levels.Using role-based access control strategy, the doctor role can only view the data of patients in the department to which he belongs, and the regulatory department role can view all data. Unauthorized access behavior will be recorded in the violation log. Develop Grafana visualization panel to display the current value, historical mean and abnormal threshold of indicators such as the number of smart contract calls and gas consumption in real time. Use Z-score anomaly detection algorithm to dynamically calculate the upper and lower limits of the threshold. When the indicator value exceeds 3 times the standard deviation, an alarm is triggered and the alarm message is pushed to the administrator's mobile APP through WebHook. Built-in anomaly detection algorithm based on association rule mining in the smart contract, using Apriori algorithm from drug prescriptions and adverse reaction report data, with parameters of minimum support 0.01 and minimum confidence 0.8, to mine frequently co-occurring drug combination patterns. If it is found that the proportion of adverse reactions in patients using a certain drug combination is significantly higher than the average level, the relevant prescription will be marked as abnormal and manually reviewed. Use blockchain to provide data query function to realize combined query based on drug code, usage time, patient ID and other conditions, and support exporting query results into CSV format audit report, which is automatically sent to the mailbox of the regulatory department and responsible hospital. The proxy contract is used to upgrade the smart contract. After the new version of the contract is deployed, the historical data is still provided by the old version of the contract, and the new data is processed by the new version of the contract. The administrator role initiates a multi-signature vote, and after obtaining the consent of more than 2 / 3 of the nodes, the new version of the contract is switched. The A / B test method is used to gradually expand the application scope of the new version of the contract, collect the abnormal detection rate and audit duration data before and after the upgrade, and use the paired t-test method to evaluate the effect of the improvement, forming a closed loop of version iteration optimization.

[0041] Whenever new drug use information or adverse reaction report data is submitted to the blockchain network, the potential risks of the data are evaluated and judged. If there is any abnormal or suspicious behavior, the corresponding security measures are triggered.

[0042] Whenever new drug use information or adverse reaction report data is submitted to the blockchain network, the smart contract uses predefined anomaly detection rules to verify the drug use information or adverse reaction report data on the chain in real time; when suspected abnormal data is identified, the risk score is calculated. The risk score results are divided into three levels, and the corresponding threshold boundaries are set. When the risk score results exceed the preset threshold, the smart contract triggers the corresponding level of security measures.

[0043] Specifically, for newly submitted drug data, the smart contract is set to be based on event-driven architecture (EDA). By defining drug data submission events and processing logic in the contract, real-time monitoring and automatic processing of on-chain data are realized. The smart contract is written in Solidity language. It monitors events such as Drug_Usage and ADR_Report on the blockchain through event filters. When the event is triggered, the corresponding event processing function is automatically called to parse the key fields such as drug code, medication time, dosage, adverse reaction symptoms in the event parameters, and use them as input for subsequent anomaly detection and risk assessment. The rules are expressed in the form of IF-THEN, and trigger conditions and thresholds are set for safety factors such as usage and dosage, contraindications, and incompatibility of different drugs. The conditional expression of the rule is implemented through Solidity's require statement. When the data does not meet the conditional constraints, an exception is automatically thrown and the transaction is rolled back. For complex rules involving multiple condition combinations, a rule engine based on Drools is used to externalize the rules and store them in the KV database of the smart contract to achieve dynamic management and real-time update of the rules. When suspected abnormal data is identified, the contract automatically marks the data status and records the meta-information such as the time, rules, and thresholds when the abnormality occurs. For suspected abnormal data, the smart contract automatically calls the risk assessment model to calculate the risk level. The risk assessment model adopts a rule-based scoring card mechanism. According to indicators such as the type, duration, and cumulative number of abnormal data, risk factors and weights are set, and the scores of each risk factor are weighted and accumulated to obtain the final risk score. The calculation logic of the risk assessment model is implemented through Solidity functions and encapsulated as an internal method of the contract for the abnormal processing logic to call. The risk score results are divided into three levels: low, medium, and high, and the corresponding threshold boundaries are set. When the risk score results exceed the preset threshold, the corresponding level of security measures are triggered. According to the risk assessment results, the smart contract automatically executes hierarchical control measures. For low-risk level anomalies, such as data format errors and incomplete data, the data submitter is prompted to modify and resubmit through event logs. For medium-risk level anomalies, such as excessive drug dosage and abnormal increase in drug frequency, the contract automatically sends a warning notification to the relevant responsible person and transfers the abnormal data to the isolated ledger to restrict its access and use. The isolated ledger uses the same underlying blockchain architecture as the main ledger, but sets up a separate consensus domain and access policy, and controls the life cycle of isolated data through hash locking and time locking mechanisms. For high-risk abnormalities, such as repeated medication and contraindicated drug use, the contract automatically blocks the transaction and immediately freezes the on-chain status of abnormal data through the Inquire function. The execution process of the smart contract is recorded and tracked throughout the entire process through the event log mechanism. The operation log structure is designed in the contract, which contains fields such as the initiator of the operation, timestamp, behavior type, result status, and target data.The log plug-in code is embedded in the contract function, and the operation log is recorded in the key business logic and exception handling process. The log information is uploaded to the blockchain in real time through the event publishing mechanism, and is summarized and statistically analyzed in real time through the security analysis contract. The blockchain browser provides a visualization function of contract execution based on log events to realize the full-chain audit of the contract operation status. Before the data is uploaded to the chain, the drug information is standardized using the coding rules of the Chinese drug electronic supervision code, and the authenticity of the caller's identity is verified through the Internet identity authentication interface of the medical institution. The transmitted drug code, medication time, adverse reaction description and other fields are spliced ​​in sequence, the hash fingerprint is calculated using the SHA-256 algorithm, the hardware encryption machine of the medical institution is called, and the hash summary is signed using the SM2 elliptic curve key to generate a secure on-chain transaction. Deploy a role-based permission control strategy in the smart contract, set data access rules for different subjects such as doctors, pharmacists, and patients, and use the zero-knowledge proof protocol to verify role attributes and authorize without leaking privacy. The attribute-based AES-256 encryption scheme is used for sensitive data. According to the sensitivity of the data attributes, the key length is selected as 128 bits, 192 bits and 256 bits, and the encryption key is stored in a secure hardware module. The smart contract monitors about 10 drug safety-related events on the chain, such as prescription, drug dispensing, adverse reaction reporting, etc., and extracts key elements from the event parameters, such as the generic name of the drug, specifications, daily dose, adverse reaction symptoms, etc., and applies 20 preset anomaly recognition rules for real-time verification. The rules are implemented using the Drools rule engine, and the rule conditions are defined through MVEL expressions, such as a single dose greater than 1.5 times the clinically recommended dose, and the time interval between repeated prescriptions of the same drug is less than 5 days, so as to achieve configurable management of the rules. For the matching of complex rules, the Rete algorithm is used to optimize the mode, embed the drug knowledge ontology into the working memory, and improve the reasoning efficiency. The risk scoring model includes two dimensions: drug characteristic factors and behavioral characteristic factors. Drug characteristic factors include drug risk categories, severity of adverse reactions, etc., and behavioral characteristic factors include the number of repeated medications, abnormal degree of medication time intervals, etc., and are assigned a score of 1-5 points. The weight coefficient of each factor is determined by the hierarchical analysis method, and the scores of each layer of factors are comprehensively calculated by the geometric mean method to obtain the overall risk score. The low, medium and high risk thresholds are set to 2 points, 3 points and 4 points respectively, and different contract actions are triggered according to the risk level. Medium-risk events trigger abnormal data isolation, deploy isolated ledger contracts in an independent Ethereum test network, and record the isolation address and timestamp in the main ledger. The hash time lock mechanism is used to set the isolation period to 72 hours after the event occurs. High-risk events trigger the arbitration process, and the data summary, rule hit record and other information are sent to the designated address of the arbitration committee through the secure message queue MQ. After the arbitration committee verifies the evidence, it makes an on-chain ruling on the contract status through the multi-signature mechanism.Drug safety event statistics use the Lambda architecture that combines offline batch processing with online stream processing. Offline analysis uses MapReduce tasks in days to count the distribution of various abnormalities in the full amount of data on the chain; online analysis uses the SparkStreaming engine, sets a micro-batch time interval of 30 seconds, and a sliding window size of 5 minutes to perform real-time aggregation calculations on event data, and uses the EWMA model to predict the trend of events. The statistical results of abnormal events are written to the Kafka cluster specified by the regulator in JSON format by the Kafka client producer. The Topic name is "Drug_Safety_Alert", the message key is the date, and the value is the event statistics information. The Kafka consumer subscribes to the Topic, transmits the message to Elasticsearch for storage, and uses Kibana to display abnormal event situation charts, linking drug regulatory business applications to achieve closed-loop supervision of the entire life cycle of drugs.

[0044] Based on historical adverse drug reaction data and usage records, the reporting frequency and time delay benchmarks are determined to evaluate the calculated credibility of adverse drug reaction reports. When the user operation frequency prediction model marks an erroneous or fraudulent report, the smart contract rejects the request to upload such data to the chain, or marks it as pending review until manual review, confirmation or correction.

[0045] Conduct statistical analysis on historical data of adverse drug reactions, calculate the frequency distribution of adverse reaction reports for each drug in different time periods, and obtain a benchmark value for the reporting frequency that reflects the safety risk level of each drug; analyze the timestamp information of adverse drug reaction data, analyze the timeliness differences in report submission between different drugs and different medical institutions, calculate the average delay from the occurrence of adverse reactions to report submission, and establish a benchmark distribution of report time delays; combine the adverse reaction report frequency and delay time benchmark characteristics to build an assessment model for the credibility of adverse drug reaction reports, and score and predict the credibility of newly submitted adverse reaction reports; calculate the adverse reaction report data on the chain and compare it with the reporting frequency benchmark and time delay benchmark to identify abnormal reports; for suspicious reports with a credibility score below the set threshold, the smart contract will mark them as pending review, and adjust the synchronization strategy of report data based on the credibility score and report type.

[0046] Specifically, for different drug types, indications, routes of administration, population characteristics and other dimensions, the frequency distribution of adverse reaction reports in different time windows, such as monthly, quarterly, and annual, is calculated, corresponding to the incidence rate per thousand people and per ten thousand people, to form a reporting frequency benchmark library that reflects the drug safety risk level. The benchmark library uses Pandas and NumPy to build a multidimensional data structure, supporting combined queries of multiple dimensions such as drug-indication-time window-frequency. For the longitudinal trend of reporting frequency, time series analysis models such as ARIMA are used to characterize the periodicity, seasonality and other change characteristics of the reporting frequency of drugs with different ingredients, and anomaly detection algorithms are used to automatically identify abnormal fluctuations in frequency and promptly identify safety risk signals. For the timeliness of report submission, the survival analysis method is used to establish a time distribution model from the occurrence of adverse reactions to report submission, identify the difference characteristics of different drugs and institutions in reporting delay time, and use statistical indicators such as truncated mean and quantiles to generate threshold intervals and outlier judgment rules for reporting time delay. An evaluation model for the credibility of adverse drug reaction reports was constructed. The model takes frequency abnormality and delay time abnormality as core indicators, and also incorporates data quality indicators such as report integrity, standardization, and rationality. A weighted scoring method was used to generate quantitative indicators of report credibility. The model was trained using classification algorithms such as logistic regression and support vector machine. Historical report data was used as samples. Model parameters were optimized through cross-validation and other methods to improve the accuracy and robustness of credibility scoring. The feature engineering of the model includes steps such as feature selection, feature encoding, and feature scaling. Significant features were selected using tree-based feature importance and ANOVA methods. WOE encoding and methods were used to achieve feature discretization. Max-Min normalization methods were used to achieve feature numerical scaling. The model was optimized through hyperparameter search, regularization and other methods to improve the generalization performance of the model, and evaluation indicators such as precision, recall, F1 value, and ROC curve were used to judge the classification effect of the model. The credibility evaluation model was encapsulated as a prediction function on the chain, which accepted report data as input and output credibility scores and abnormal identification. For suspicious reports identified by smart contracts, a report review and collaborative disposal mechanism based on blockchain is established. According to the task management contract for report review, suspicious reports are assigned to different auditors, and the audit status, audit opinions, etc. are recorded on the chain. Auditors obtain the report tasks to be reviewed through the blockchain client or audit platform, and verify and judge the report content according to standardized audit procedures and judgment criteria, form audit opinions, and sign the audit records with the auditor's private key. According to the audit results, a transaction contract for report correction is set up to allow the report submitter or auditor to initiate a report correction transaction and attach the revised report details. Establish a full-process supervision mechanism for report data before, during, and after the event to achieve comprehensive coordination with drug vigilance business.Beforehand, the dispatch service is used to regularly synchronize report data from the chain, and combined with the full amount of historical data, the frequency benchmark, delay benchmark and credibility assessment model are dynamically optimized to maintain the accuracy and timeliness of risk assessment. During the process, the drug vigilance management system of the regulatory agency is connected, and the report data is pushed to the regulatory agency through RestfulAPI, message middleware, etc., and the screening and presentation of the report data are customized based on regulatory needs, supporting multi-dimensional and multi-indicator report data query and statistical analysis, and assisting daily supervision work. Afterwards, thematic data analysis and assessment are carried out for specific drugs, and association rules are used to mine the association patterns, evolution laws, abnormal signals, etc. in adverse reaction reports, evaluate the safety risks of drug varieties and production batches, identify high-risk populations and taking scenarios, and form a risk map and panoramic insight of adverse drug reactions, providing data support for regulatory decisions such as drug inspection, risk control, and standard revision. At the same time, the drug safety monitoring situation is regularly produced and released through various channels such as drug instructions, regulatory documents, and academic conferences to guide medical institutions and patients to use drugs rationally, and the institutions that do not have adequate management of report data quality are notified and interviewed to continuously improve the maturity of the adverse drug reaction monitoring system. According to the data standards of the National Adverse Drug Reaction Monitoring System, 12 million individual reports of adverse drug reactions and 150 million prescription drug records from January 2015 to December 2022 were collected. Regular expressions and semantic rules were used to normalize drug trade names, extract structured fields such as drug ingredients, dosage forms, and specifications, standardize the coding of adverse reaction symptoms, and use the FP-Growth algorithm to mine drug association rules and automatically fill in missing fields, with a data accuracy of 98%. HiveSQL was used on the Hadoop cluster to calculate the number of adverse events per 100,000 people based on the dimensions of active ingredients, indications, and routes of administration, with quarterly and annual time windows, to obtain a reporting frequency benchmark that reflects the group's drug safety risks, and use the ARIMA model to characterize the time series characteristics of the reporting frequency of drugs with different ingredients. By setting the residual 3σ control limit, abnormal risk signals that are significantly higher than expected are identified. The date difference between the first report time and the follow-up report time of adverse events was calculated, and the empirical distribution curve of the report submission time interval was drawn. The quantile estimation was used to obtain the confidence interval of the report delay time, and the heteroscedastic Ansari-Bradley test was used to test the significance of the delay time among different reporting agencies, forming a statistical basis for the timely management of agency reports.Based on the five dimensions of abnormality of report frequency, abnormality of report delay, completeness, rationality, and traceability, a report credibility evaluation index system was constructed. A weighted scoring model was constructed using Logistic regression, and the L1 regularization coefficient was iteratively optimized to achieve feature screening. The SMOTE algorithm was used to balance the sample ratio of high-quality and low-quality reports. The model performance was tested through 5-fold cross-validation, with accuracy and recall rates exceeding 90%. For 1 million adverse reaction report details, Protocol Buffers was used to define the on-chain evidence structure, SHA256 hash was used to calculate the data fingerprint, the smart contract interface of the blockchain platform was called, and the report hash was written into the block in batches. The TPS throughput reached 5,000 times / second, the data on-chain delay was controlled within 100 milliseconds, and the error rate of on-chain and off-chain data consistency verification was less than 0.01‰. Embed rule-based quality inspection logic in smart contracts, use Solidity language to write data verification and cross-domain call functions, design event log structure for abnormal report data, record event timestamp, data hash, abnormal type, etc., realize real-time warning of on-chain quality problems, and use Chainlink's decentralized oracle to access heterogeneous blockchain report data to expand the data source of report quality assessment. Set up multi-party report review task management contracts and report correction transaction contracts, store manual review behavior and data correction process on the chain, use zero-knowledge proof algorithm to protect the identity privacy of auditors, and incentivize Attack-Resistant mechanism through pledged tokens and reputation points to ensure the credibility of on-chain collaborative review. Regularly synchronize on-chain report data from the blockchain, use incremental update method, update nearly 1 month of report data daily, transmit report data to regulatory agencies in real time through Kafka, use InfluxDB time series database to manage aggregate indicators, and realize real-time visualization of report data monitoring screen through Grafana. For 12 key monitored drugs, the heterogeneous network representation learning algorithm metapath2vec++ is used to mine the risk association network of drugs, indications and adverse reactions, and the drug safety risk knowledge graph is continuously optimized through active learning methods.

[0047] It will be apparent to those skilled in the art that the present application is not limited to the details of the exemplary embodiments described above, and that the present application can be implemented in other specific forms without departing from the spirit or essential features of the present application. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the present application is defined by the appended claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims be included in the present application. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A method for managing adverse drug reaction traces, characterized in that: The method comprises: A hash function is used to process adverse drug reaction records, and a unique fingerprint code corresponding to each record is calculated based on the type, time, operator and change content fields of each operation in the record; After the fingerprint code is generated, a digital signature operation is performed on it. The fingerprint code is encrypted using the private key in the asymmetric encryption algorithm to form a signature mark. When a user tries to access data, he needs to use the digital certificate of the public key infrastructure for identity authentication. Only after passing the authentication can the digital signature be decrypted and the data can be accessed; Obtain and analyze user operation logs, use the isolation forest algorithm to detect anomalies, and analyze the differences between normal operations and abnormal operations; Combine historical user operation data to build a user operation frequency prediction model. According to the user's active time period and operation habits, predict the time and frequency of normal operations. Compare the real-time monitored data with the user operation frequency prediction model, and mark operations that deviate from the predicted behavior as suspicious. Combined with the time series data of drug use frequency, adverse reaction reports and patient behavior diversity indicators, dynamic abnormal activity monitoring is implemented, and the monitoring strategy and early warning threshold are optimized based on the feedback of monitoring results; Based on feature extraction of operational data, the tampering behavior is identified and evaluated based on the isolation forest algorithm and autoencoder network, and the detection process is optimized through expert verification and parameter adjustment; Based on the drug use information and adverse reaction report data in the hospital blockchain network, design and deploy smart contracts to monitor the data on-chain in real time, and optimize the drug safety monitoring process based on the monitoring results and feedback information; The method uses a hash function to process the adverse drug reaction record, and calculates a unique fingerprint code corresponding to each record according to the type, time, operator and change content fields of each operation in the record, including: obtaining adverse drug reaction record data, and using a hash function to process it to obtain a unique fingerprint code of the adverse drug reaction record; Analyze and summarize the attributes of adverse drug reaction records, determine the correlation between operation type, operation time, operator identity and change content attributes, and determine the logical association between attributes; According to the attribute analysis results, the operation type, operation time, operator identity and change content attributes are logically integrated; By judging different values ​​of the operation type attribute, the corresponding data processing flow is determined, and if the operation type is new addition, the new adverse drug reaction record is added to the database; If the operation type is modification, the corresponding record is located according to the fingerprint code, and the value of the relevant attribute is updated; According to the operation time attribute, the adverse drug reaction record is processed in time series to obtain the data distribution in different time periods, and combined with the operator identity attribute, the operation behavior characteristics of different operators in different time periods are judged; Adopting the change content attribute, the change history of the adverse drug reaction record is tracked and analyzed, and by comparing the change content at different time points, the evolution process of the adverse drug reaction record is analyzed, and the rationality and compliance of the change are judged; After the fingerprint code is generated, a digital signature operation is performed on it, and the fingerprint code is encrypted using a private key in an asymmetric encryption algorithm to form a signature mark. When a user attempts to access data, it is necessary to use a digital certificate of a public key infrastructure for identity authentication. Only after passing the authentication can the digital signature be decrypted and the data can be accessed, including: after generating a unique fingerprint code for the adverse drug reaction record, the RSA algorithm in the asymmetric encryption algorithm is used to encrypt the fingerprint code using the administrator's private key to obtain a digital signature, and the digital signature is stored in a database together with the fingerprint code to form a signature mark; When a user attempts to access the adverse drug reaction data, the user's digital certificate is obtained through the public key infrastructure based on the user's identity information, and the user is authenticated using the public key in the digital certificate; If the user passes the identity authentication, the user's access rights are used to determine whether the user has the right to access the corresponding adverse drug reaction data. If the user has the access rights, the user is allowed to access the data; Otherwise, the user's access request is denied; For users who are allowed to access, obtain the fingerprint code and digital signature of the adverse drug reaction record, and use the administrator's public key to decrypt the digital signature to obtain the original fingerprint code; The decrypted fingerprint code is compared with the fingerprint code stored in the database. If the two are consistent, it means that the data has not been tampered with, and the user is allowed to access the adverse drug reaction data; Otherwise, the data tampering event is recorded and the access request of the user is denied; During the process of users accessing adverse drug reaction data, monitor the user's operation behavior, record the user's access log, and identify the user's abnormal access behavior and potential risks; Dynamically adjust user access rights based on the results of user behavior analysis; The obtaining and analyzing the user operation log, using the isolation forest algorithm to perform anomaly detection, and analyzing the difference between normal operation and abnormal operation, includes: obtaining the user's operation log data; By storing, managing and desensitizing log data; Preprocess the user operation log data to filter out incomplete, invalid or duplicate records, and sort the user operation log data according to the timestamp of the operation to form time series data; At the same time, the user ID, IP address, operation type, and key fields of accessed resources are encoded and normalized; Extract key indicators reflecting user operation behavior characteristics from the preprocessed user operation log data and construct user behavior feature vectors; The isolation forest algorithm is used to detect anomalies in user behavior feature vectors and identify abnormal operation behaviors; Calculate the anomaly score of the identified abnormal operation behavior, and determine the abnormal operation according to the anomaly score; classify, attribute and deal with abnormal operations, and formulate corresponding security defense strategies and measures; also include: the isolation forest algorithm isolates samples by constructing multiple decision trees, and identifies abnormal behaviors based on the characteristic that the path where the abnormal behavior is located is shorter than the normal behavior; specifically include: extracting key indicators reflecting user behavior characteristics from user operation logs, and constructing user behavior feature space as input data for the isolation forest algorithm; constructing multiple isolation trees by recursively dividing hyperplanes in the feature space; selecting some sample points as training sets, and setting corresponding parameters to control the scale and complexity of the isolation forest; counting the average path length of each sample point in the isolation tree as the anomaly score, and identifying abnormal behaviors according to the anomaly score; classifying and dealing with abnormal behaviors, triggering corresponding security defense measures, and optimizing the detection model of the isolation forest algorithm; The method combines the user's historical operation data to build a user operation frequency prediction model, predicts the time and frequency of normal operations according to the user's active time period and operation habits, compares the real-time monitored data with the user operation frequency prediction model, and marks the operation that deviates from the predicted behavior as suspicious behavior, including: building a user operation data set based on the user's historical operation data, and using the user operation data set as a sample for training the user operation frequency prediction model; Counting the number and frequency of operations of users in different time periods based on the user operation data set, drawing a user active time distribution graph, and identifying the user's active peak period and inactive period from the active time distribution graph; Calculate the mean and variance of operation frequency at different time granularities to obtain statistical indicators for describing the overall characteristics of user operation habits; According to the user's historical operation data, the changing trend and periodicity of the user's normal operation frequency in different time periods are fitted to build a user operation frequency prediction model; Dynamically update the parameters of the user operation frequency prediction model using a sliding window to adapt to changes in user operation habits; Extracting key features of operation time and operation type from the user operation data monitored in real time, and inputting them into the user operation frequency prediction model to obtain a predicted value of the user's normal operation frequency at that time point; Calculate the deviation between the actual operation frequency and the predicted value. If the deviation exceeds the preset threshold, mark the operation as a suspicious operation. For users who are marked as suspicious operations multiple times in a row, the abnormal behavior identification process is triggered to determine whether the user's behavior conforms to the known abnormal behavior pattern; If it matches a known abnormal behavior pattern, an abnormal behavior alarm is generated, and corresponding disposal measures are taken according to the risk level of the abnormal behavior; Conduct cluster analysis on user behavior characteristics, classify users with similar behavior patterns into the same group, build user portraits, characterize the behavior preferences and risk characteristics of different user groups, and provide prior knowledge for the identification and prevention of abnormal behavior; The method combines the drug use frequency, the time series data of adverse reaction reports and the patient behavior diversity index to implement dynamic abnormal activity monitoring; optimizes the monitoring strategy and early warning threshold according to the monitoring result feedback, including: modeling and predicting the drug use frequency data and adverse reaction report data to obtain the normal drug use pattern and adverse reaction occurrence pattern in the future period, and calculates the confidence interval of the model as the basis for determining abnormal activities; Extract features from patient behavior data to identify indicators that reflect the diversity of patient behavior and to identify abnormalities and outliers in patient behavior patterns; Conduct correlation analysis on the results of abnormal patient behavior detection and the results of drug use frequency prediction and adverse reaction report prediction to determine the correlation and causality between abnormal behavior and abnormal drug use and abnormal adverse reactions, and to determine the impact scope and severity of abnormal behavior; Dynamically adjust monitoring strategies and warning thresholds based on the type, impact scope, and severity of abnormal behavior; Conduct feedback analysis on monitoring results, evaluate the effectiveness and accuracy of monitoring strategies and warning thresholds, and optimize monitoring strategies by calculating the detection rate, false alarm rate, and missed alarm rate of abnormal behaviors; Apply the optimized monitoring strategy and warning threshold to real-time abnormal activity monitoring, conduct real-time analysis and prediction of new drug use data, adverse reaction report data and patient behavior data, discover and warn of potential erroneous and fraudulent behaviors, and respond and deal with warning events in a graded manner; also include: tracking the changing trends of drug use frequency and adverse reactions, establishing a baseline through historical data, and generating a warning and indicating possible abnormal behavior if the new data monitored fluctuates from the baseline by more than a preset threshold; specifically include: obtaining historical data on drug use frequency and adverse reaction frequency; using time series analysis methods to predict trends and detect anomalies in drug use frequency and adverse reaction frequency; fitting drug use frequency and adverse reaction frequency to obtain The fitting curve is used as the baseline, and the distribution characteristics of the fitting residuals are calculated as a reference indicator for baseline fluctuations; for the newly monitored drug use frequency and adverse reaction frequency data; if the predicted residual exceeds the threshold range of the baseline fluctuation, it is determined to be an abnormal value and an abnormal behavior warning is generated; according to the frequency and severity of abnormal behavior warnings, the warning threshold is dynamically adjusted; if the abnormal warning does not appear for a long time, the warning threshold is increased to reduce the sensitivity of abnormal detection; cluster analysis is performed on the abnormal values ​​of drug use frequency and adverse reaction frequency, and the abnormal values ​​are divided into different abnormal events. The correlation and conductivity between abnormal events are analyzed to construct the causal chain and impact network of abnormal events; for different types of abnormal events, corresponding response strategies and disposal plans are formulated; The feature extraction based on the operation data, based on the isolation forest algorithm and the autoencoder network, identifies and evaluates the tampering behavior, and optimizes the detection process through expert verification and parameter adjustment, including: constructing an operation feature vector based on the features extracted from the user operation data; Perform anomaly detection on the operated feature vector; Reduce the dimension and reconstruct the operational feature vector; The anomaly scores of the isolation forest algorithm and the autoencoder network are weighted and fused to obtain the comprehensive anomaly score of the operation. The anomaly threshold is set, and operations exceeding the anomaly threshold are judged as tampering behaviors. The impact and harm of the tampering behavior are evaluated based on the comprehensive anomaly score, and a tampering behavior report is generated. For suspected tampering behaviors detected, a certain percentage of samples will be drawn for manual review and confirmation by business experts; Label the false positive samples and collect the false positive reasons and context information; Review the missed samples, add new patterns and features of tampering behavior, and form a tampering behavior knowledge base; Optimize the hyperparameters of the isolation forest algorithm and the autoencoder network based on false positives and false negatives reported by experts; When tampering behavior is detected, the tampering behavior is traced and associated, the behavior pattern, group characteristics and influence links of the tampering behavior are excavated, and the tampering behavior knowledge graph is constructed; Based on the drug use information and adverse reaction report data in the hospital blockchain network, the smart contract is designed and deployed to monitor the data on-chain behavior in real time; based on the monitoring results and feedback information, the drug safety monitoring process is optimized, including: constructing a data model and storage structure for drug use information and adverse reaction report data in the hospital blockchain network; Develop smart contracts to define the triggering conditions and verification rules for data on-chain; For data upload requests that do not meet the requirements, the smart contract rejects them and records the logs; Design data access control mechanisms in smart contracts and set different access rights for users with different roles; For unauthorized or illegal access, the smart contract blocks it and triggers an alarm; Set warning thresholds for abnormal indicators and notify relevant responsible persons when warnings are triggered; The security measure judgment logic is embedded in the smart contract. According to the characteristic patterns of drug use information and adverse reaction report data, suspicious data on-chain behaviors are identified and marked, triggering the manual verification process. It also includes: whenever new drug use information or adverse reaction report data is submitted to the blockchain network, the potential risks of the data are evaluated and judged. If there are abnormal or suspicious behaviors, the corresponding security measures are triggered; based on historical drug adverse reaction data and usage records, the reporting frequency and time delay benchmarks are determined, and the calculation credibility of drug adverse reaction reports is evaluated; when the user operation frequency prediction model marks a report with errors or fraud, the smart contract rejects the request to upload such data to the chain, or marks it as pending review until manual review, confirmation or correction; Whenever new drug use information or adverse reaction report data is submitted to the blockchain network, the potential risk of the data is evaluated and judged, and if there is abnormal or suspicious behavior, the corresponding security measures are triggered; specifically, whenever new drug use information or adverse reaction report data is submitted to the blockchain network, the drug use information or adverse reaction report data on the chain is verified in real time through the smart contract through predefined anomaly detection rules; when suspected abnormal data is identified, the risk score is calculated; the risk score results are divided into three levels, and the corresponding threshold boundaries are set; when the risk score results exceed the preset threshold, the smart contract triggers the corresponding level of security measures; The method comprises: determining the reporting frequency and time delay benchmark based on historical adverse drug reaction data and usage records, and evaluating the calculation credibility of adverse drug reaction reports; when the user operation frequency prediction model marks a report with errors or fraud, the smart contract rejects the request to upload such data to the chain, or marks it as pending review until manual review, confirmation or correction; specifically, statistical analysis of historical adverse drug reaction data, calculating the frequency distribution of adverse reaction reports for each drug in different time periods, and obtaining a reporting frequency benchmark value reflecting the safety risk level of each drug; analyzing the timestamp information of adverse drug reaction data, analyzing the differences between different drugs and different medical The timeliness of report submission varies between institutions, the average time delay from the occurrence of adverse reactions to report submission is calculated, and a benchmark distribution of report time delays is established; a credibility assessment model for adverse drug reaction reports is constructed based on the benchmark characteristics of adverse reaction report frequency and delay time, and the credibility of newly submitted adverse reaction reports is scored and predicted; the adverse reaction report data on the chain is calculated and compared with the report frequency benchmark and time delay benchmark to identify abnormal reports; for suspicious reports with a credibility score below the set threshold, the smart contract will mark them as pending review, and based on the credibility score and report type, the smart contract will adjust the synchronization strategy for report data.

2. A drug adverse reaction trace management system, characterized in that: The system comprises: The hash function and digital signature module are used to generate a unique fingerprint code for the record and encrypt it to protect data security; the generation of the unique fingerprint code for the record and the encryption to protect data security include: obtaining the adverse drug reaction record data, processing it with a hash function, and obtaining a unique fingerprint code for the adverse drug reaction record; analyzing and summarizing the attributes of the adverse drug reaction record, judging the correlation between the operation type, operation time, operator identity and change content attributes, and determining the logical association between the attributes; logically integrating the operation type, operation time, operator identity and change content attributes according to the attribute analysis results; determining the corresponding data handler by judging different values ​​of the operation type attribute The processing flow is as follows: if the operation type is adding, the new adverse drug reaction record is added to the database; if the operation type is modifying, the corresponding record is located according to the fingerprint code, and the value of the relevant attribute is updated; according to the operation time attribute, the adverse drug reaction record is time-serialized to obtain the data distribution in different time periods, and combined with the operator identity attribute, the operation behavior characteristics of different operators in different time periods are judged; the change content attribute is used to track and analyze the change history of the adverse drug reaction record, and by comparing the change content at different time points, the evolution process of the adverse drug reaction record is analyzed, and the rationality and compliance of the change are judged; The public key infrastructure verification module is used for identity authentication and data decryption to ensure data access security; the identity authentication and decryption of data to ensure data access security include: after generating a unique fingerprint code for the adverse drug reaction record, using the RSA algorithm in the asymmetric encryption algorithm, using the administrator's private key to encrypt the fingerprint code to obtain a digital signature, and storing the digital signature together with the fingerprint code in the database to form a signature identification; when a user attempts to access the adverse drug reaction data, the user's digital certificate is obtained through the public key infrastructure based on the user's identity information, and the user is authenticated using the public key in the digital certificate; if the user passes the identity authentication, then judging whether the user has the right to access the corresponding adverse drug reaction data based on the user's access rights. If the user has access rights, the user is allowed to access the data; otherwise, the user's access request is rejected; for users who are allowed to access, the fingerprint code and digital signature of the adverse drug reaction record are obtained, and the digital signature is decrypted using the administrator's public key to obtain the original fingerprint code; the decrypted fingerprint code is compared with the fingerprint code stored in the database. If the two are consistent, it means that the data has not been tampered with, and the user is allowed to access the adverse drug reaction data; otherwise, the data tampering event is recorded and the user's access request is rejected; during the user's access to the adverse drug reaction data, the user's operation behavior is monitored, the user's access log is recorded, and the user's abnormal access behavior and potential risks are identified; according to the results of the user behavior analysis, the user's access rights are dynamically adjusted; The user operation analysis and prediction module is used to predict user behavior through historical data and mark abnormal operations; the prediction of user behavior through historical data and marking abnormal operations include: obtaining and analyzing user operation logs, using the isolation forest algorithm for anomaly detection, and analyzing the difference between normal operations and abnormal operations; combining the user's historical operation data to build a user operation frequency prediction model, predicting the time and frequency of normal operations based on the user's active time period and operation habits, comparing the real-time monitored data with the user operation frequency prediction model, and marking operations that deviate from the predicted behavior as suspicious behaviors; obtaining and analyzing user operation logs, using the isolation forest algorithm for anomaly detection, analyzing the difference between normal operations and abnormal operations, including The process includes: obtaining the user's operation log data; storing, managing and desensitizing the log data; preprocessing the user's operation log data to filter out incomplete, invalid or duplicate records, and sorting the user's operation log data according to the timestamp of the operation to form time series data; encoding and normalizing the user ID, IP address, operation type, and access resource key fields; extracting key indicators reflecting the user's operation behavior characteristics from the preprocessed user operation log data to construct a user behavior feature vector; using the isolation forest algorithm to perform anomaly detection on the user's behavior feature vector to identify abnormal operation behaviors; calculating the anomaly score of the identified abnormal operation behaviors, and determining abnormal operations based on the anomaly score; The operation is classified, attributed and handled, and corresponding security defense strategies and measures are formulated; it also includes: the isolation forest algorithm isolates samples by constructing multiple decision trees, and identifies abnormal behavior based on the characteristic that the path of abnormal behavior is shorter than that of normal behavior; specifically includes: extracting key indicators reflecting user behavior characteristics from user operation logs, and constructing user behavior feature space as input data for the isolation forest algorithm; constructing multiple isolation trees by recursively dividing hyperplanes in the feature space; selecting some sample points as training sets, and setting corresponding parameters to control the scale and complexity of the isolation forest; counting the average path length of each sample point in the isolation tree as the anomaly score, and identifying abnormal behavior based on the anomaly score; classifying and handling abnormal behavior , triggering corresponding security defense measures, and optimizing the detection model of the isolation forest algorithm; combining the user's historical operation data to build a user operation frequency prediction model, predicting the time and frequency of normal operations according to the user's active time period and operation habits, comparing the real-time monitored data with the user operation frequency prediction model, and marking the operation that deviates from the predicted behavior as suspicious behavior, including: building a user operation data set based on the user's historical operation data, and using the user operation data set as a sample for training the user operation frequency prediction model; counting the number and frequency of user operations in different time periods based on the user operation data set, drawing a user active time distribution map, and identifying the user's active peak period and inactive period from the active time distribution map;Calculate the mean and variance of the operation frequency at different time granularities to obtain statistical indicators for describing the overall characteristics of the user's operation habits; fit the changing trend and periodicity of the user's normal operation frequency in different time periods based on the user's historical operation data, and build a user operation frequency prediction model; dynamically update the parameters of the user operation frequency prediction model using a sliding window to adapt to changes in user operation habits; extract the key features of operation time and operation type from the user operation data monitored in real time, input them into the user operation frequency prediction model, and obtain the predicted value of the user's normal operation frequency at that time point; calculate the actual operation The deviation between the frequency and the predicted value, if the deviation exceeds the preset threshold, the operation is marked as a suspicious operation; for users who are marked as suspicious operations for multiple times in a row, the abnormal behavior identification process is triggered to determine whether the user's behavior conforms to the known abnormal behavior pattern; if it conforms to the known abnormal behavior pattern, an abnormal behavior alarm is generated, and corresponding disposal measures are taken according to the risk level of the abnormal behavior; cluster analysis is performed on the user's behavioral characteristics, and users with similar behavioral patterns are divided into the same group, and user portraits are constructed to characterize the behavioral preferences and risk characteristics of different user groups, providing prior knowledge for the identification and prevention of abnormal behaviors; The dynamic abnormal activity monitoring module is used to monitor drug use and adverse reactions in real time and optimize early warning strategies; the real-time monitoring of drug use and adverse reactions and optimization of early warning strategies include: modeling and predicting drug use frequency data and adverse reaction report data to obtain normal drug use patterns and adverse reaction occurrence patterns in the future, and calculating the confidence interval of the model as a basis for determining abnormal activities; extracting features from patient behavior data to reflect indicators of patient behavior diversity, and discovering abnormal points and outliers in patient behavior patterns; and correlating the results of patient behavior abnormality detection with the results of drug use frequency prediction and adverse reaction report prediction. , judge the correlation and causality between abnormal behavior and abnormal medication and abnormal adverse reactions, and determine the scope and severity of the abnormal behavior; dynamically adjust the monitoring strategy and early warning threshold according to the type, scope and severity of the abnormal behavior; conduct feedback analysis on the monitoring results, evaluate the effectiveness and accuracy of the monitoring strategy and early warning threshold, and optimize the monitoring strategy by calculating the detection rate, false alarm rate and missed alarm rate indicators of abnormal behavior; apply the optimized monitoring strategy and early warning threshold to real-time abnormal activity monitoring, conduct real-time analysis and prediction of new drug use data, adverse reaction report data and patient behavior data, discover and warn potential erroneous behaviors and Fraudulent behavior, and graded response and disposal of warning events; also includes: tracking the changing trends of drug use frequency and adverse reactions, establishing a baseline through historical data, and generating a warning and indicating possible abnormal behavior if the new data monitored fluctuates from the baseline by more than a preset threshold; specifically includes: obtaining historical data on drug use frequency and adverse reaction frequency; using time series analysis methods to predict trends and detect anomalies in drug use frequency and adverse reaction frequency; fitting drug use frequency and adverse reaction frequency to obtain a fitting curve as a baseline, and calculating the distribution characteristics of the fitting residuals as a reference indicator for baseline fluctuations; for new Monitor the frequency of drug use and the frequency of adverse reactions; if the predicted residual exceeds the threshold range of the baseline fluctuation, it is determined to be an outlier and an abnormal behavior warning is generated; according to the frequency and severity of abnormal behavior warnings, the warning threshold is dynamically adjusted; if the abnormal warning does not appear for a long time, the warning threshold is increased to reduce the sensitivity of abnormal detection; cluster analysis is performed on the outliers of the frequency of drug use and the frequency of adverse reactions, and the outliers are divided into different abnormal events. The correlation and conductivity between abnormal events are analyzed to construct the causal chain and impact network of abnormal events; for different types of abnormal events, corresponding response strategies and disposal plans are formulated; The tampering behavior identification module uses the isolation forest and the autoencoder to identify data tampering and improve the system protection capability; the use of the isolation forest and the autoencoder to identify data tampering and improve the system protection capability includes: constructing an operation feature vector based on the features extracted from the user operation data; performing anomaly detection on the operated feature vector; reducing the dimension and reconstructing the operation feature vector; weighted fusion of the anomaly scores of the isolation forest algorithm and the autoencoder network to obtain a comprehensive anomaly score of the operation, setting an anomaly threshold, determining the operation exceeding the anomaly threshold as tampering behavior, and evaluating the impact of the tampering behavior according to the comprehensive anomaly score and the degree of harm, and generate a tampering behavior report; for the suspected tampering behaviors detected, a certain proportion of samples are extracted and manually reviewed and confirmed by business experts; false positive samples are annotated, and the causes and contextual information of false positives are collected; the missed negative samples are reviewed, and new patterns and features of tampering behaviors are supplemented to form a tampering behavior knowledge base; according to the false positives and missed negatives reported by experts, the hyperparameters of the isolation forest algorithm and the autoencoder network are optimized; when tampering behaviors are detected, the tampering behaviors are traced and associated, and the behavioral patterns, group characteristics and influencing links of the tampering behaviors are excavated to build a tampering behavior knowledge graph; The blockchain smart contract module is used to monitor data on-chain behavior and optimize the drug safety monitoring process; the monitoring of data on-chain behavior and optimization of drug safety monitoring process include: building a data model and storage structure for drug use information and adverse reaction report data in the hospital blockchain network; developing smart contracts to define trigger conditions and verification rules for data on-chain; for data on-chain requests that do not meet the conditions, the smart contract rejects and logs them; designing a data access control mechanism in the smart contract to set different access rights for users with different roles; for unauthorized access or illegal access, the smart contract blocks and triggers an alarm; setting an early warning threshold for abnormal indicators and notifying the relevant responsible person when an early warning is triggered; embedding security measures in the smart contract The judgment logic is implemented to identify and mark suspicious data on-chain behaviors according to the characteristic patterns of drug use information and adverse reaction report data, triggering the manual verification process; it also includes: whenever new drug use information or adverse reaction report data is submitted to the blockchain network, the potential risks of the data are evaluated and judged, and if there are abnormal or suspicious behaviors, the corresponding security measures are triggered; based on historical drug adverse reaction data and usage records, the reporting frequency and time delay benchmark are determined, and the credibility of the calculation of drug adverse reaction reports is evaluated; when the user operation frequency prediction model marks a report with errors or fraud, the smart contract rejects the request for such data to be on-chain, or marks it as pending review until manual review, confirmation or correction; Whenever new drug use information or adverse reaction report data is submitted to the blockchain network, the potential risks of the data are evaluated and judged; if there is any abnormal or suspicious behavior, the corresponding security measures are triggered; specifically, whenever new drug use information or adverse reaction report data is submitted to the blockchain network, the on-chain drug use information or adverse reaction report data is verified in real time through the smart contract through predefined anomaly detection rules; when suspected abnormal data is identified, the risk score is calculated; the risk score results are divided into three levels, and the corresponding threshold boundaries are set; when the risk score results exceed the preset threshold, the smart contract triggers the corresponding level of security measures; the report is determined based on historical drug adverse reaction data and usage records. Frequency and time delay benchmarks to evaluate the reliability of adverse drug reaction report calculations; when the user's operation frequency prediction model marks a report with errors or fraud, the smart contract rejects the request to upload such data to the chain, or marks it as pending review until manual review, confirmation or correction; specifically, it includes: statistical analysis of historical adverse drug reaction data, calculation of the frequency distribution of adverse reaction reports for each drug in different time periods, and obtaining a report frequency benchmark value that reflects the safety risk level of each drug; analysis of the timestamp information of adverse drug reaction data, analysis of the timeliness of report submission between different drugs and different medical institutions, calculation of the average delay from the occurrence of adverse reactions to report submission, and establishment of a benchmark distribution of report time delays;Combined with the frequency and delay time benchmark characteristics of adverse reaction reports, an evaluation model for the credibility of adverse drug reaction reports is constructed to score and predict the credibility of newly submitted adverse reaction reports; the adverse reaction report data on the chain is calculated and compared with the report frequency benchmark and time delay benchmark to identify abnormal reports; for suspicious reports with a credibility score lower than the set threshold, the smart contract marks them as pending review, and adjusts the synchronization strategy of the report data according to the credibility score and report type. ;

Images