A method and system for detecting abnormal behavior of package medicine purchase

Abstract

The present invention discloses a method and system for detecting abnormal behavior of package-style drug purchases, comprising the following steps: constructing a drug knowledge graph based on medical data; constructing a prescription graph containing nodes and prescription edges based on medical data, wherein the nodes include drug nodes and patient nodes, and the prescription edges are used to connect the patient nodes and drug nodes; fusing the drug knowledge graph and the prescription graph to obtain a hypergraph; and using at least one of multi-level community detection and clustering based on the hypergraph to detect abnormal behavior of package-style drug purchases. The present invention aims to solve the limitations of the prior art in processing complex medical data and identifying complex abnormal behaviors, and improve the accuracy and efficiency of abnormal behavior of package-style drug purchases by introducing new data analysis technologies based on drug knowledge graphs and prescription graph networks.

Description

Technical Field

[0001] The present invention belongs to the technical field of the combination of data mining and artificial intelligence of medical health big data, and specifically relates to a method and system for detecting abnormal behavior in package drug purchases. Background Art

[0002] When purchasing medicines, there will be abnormal behavior of package purchases, which will not only cause adverse development of the pharmaceutical industry, but also pose a threat to the health and safety of patients. Therefore, it is particularly important to develop effective technical means to detect and prevent this abnormal behavior of package purchases.

[0003] In the field of medical data analysis, traditional data processing methods are no longer sufficient to cope with complex and dynamically changing drug usage patterns. Existing technologies usually rely on simple statistical analysis and rule matching, which are limited in their effectiveness when dealing with nonlinear complex relationships and large-scale data sets. In addition, these methods often fail to effectively utilize the association information between drugs and between drugs and diseases, thus reducing the accuracy and efficiency of anomaly detection.

[0004] As emerging data analysis technologies, knowledge graphs and graph network analysis provide new perspectives and methods for medical data analysis. By constructing a graphical representation of entities and their relationships, knowledge graphs can effectively organize and manage a large amount of drug information, such as drug ingredients, mechanisms of action, indications, side effects, etc. Through knowledge graphs, complex drug information can be structured and semantic, thereby improving the accessibility and usability of data. Graph network analysis further analyzes the complex relationships between entities based on knowledge graphs. By constructing graph network models, such as graph convolutional networks (GCNs) or long short-term memory networks (LSTMs), hidden patterns and abnormal behaviors in drug use can be effectively mined and identified. This method can not only process large-scale data sets, but also capture nonlinear and dynamically changing relationships between drugs, thereby showing superior performance in package drug purchase anomaly detection.

[0005] However, the research on applying knowledge graph and graph network analysis to package drug purchase anomaly detection is relatively limited, especially in the actual medical insurance anti-fraud system. Existing research mainly focuses on basic graph structures and algorithms, but lacks systematic solutions and methods for specific medical application scenarios. Therefore, it is particularly urgent and important to develop a comprehensive package drug purchase anomaly detection system based on drug knowledge graph and prescription graph network. Summary of the invention

[0006] In view of the above, the purpose of the present invention is to provide a method and system for detecting abnormal behavior in package drug purchases, aiming to solve the limitations of the existing technology in processing complex medical data and identifying complex abnormal behaviors, and to improve the accuracy and efficiency of abnormal behavior in package drug purchases by introducing new data analysis technology based on drug knowledge graphs and prescription graph networks.

[0007] To achieve the above-mentioned purpose of the invention, an embodiment provides a method for detecting abnormal behavior of package drug purchase, comprising the following steps:

[0008] Construct a drug knowledge graph based on medical data;

[0009] Constructing a prescription graph including nodes and prescription edges according to the medical data, wherein the nodes include drug nodes and patient nodes, and the prescription edges are used to connect the patient nodes and the drug nodes;

[0010] A hypergraph is obtained by fusing the drug knowledge graph and the prescription graph;

[0011] Based on the hypergraph, at least one of multi-level community detection and clustering is used to detect abnormal behavior of package drug purchase.

[0012] Preferably, constructing a drug knowledge graph based on medical data includes:

[0013] First, entities are extracted from medical data, including: drug name, drug code, drug type, drug dosage form, specification, ingredient, indication, dosage, side effect, contraindication, implementation standard, and expiration date. At the same time, the entities are expanded and refined, including the minimum age limit for drug use, the maximum age limit for drug use, usage and dosage, maximum dosage, minimum dosage, maximum dosage frequency, and minimum dosage frequency;

[0014] Then, nodes and edges of the drug knowledge graph are designed based on entities, where nodes include: drugs, whose attributes include drug name, drug code, drug type, drug dosage form, specification, implementation standard, validity period, manufacturer, approval number, storage condition, and prescription status; ingredients, whose attributes include ingredient name, maximum dose, and minimum dose; indications, whose attributes include indication name; side effects, whose attributes include side effect description; contraindications, whose attributes include contraindication description; usage and dosage, whose attributes include minimum age limit for medication, maximum age limit for medication, detailed description of usage and dosage, maximum frequency of dosage, and minimum frequency of dosage; manufacturers, whose attributes include manufacturer name and manufacturer address; and drug interactions, whose attributes include interaction description;

[0015] The edges of the drug knowledge graph include: containing ingredients, whose attribute is the content of ingredients; treatment, which has no attribute; may cause, whose attribute is the frequency of side effects; contraindications, which has no attribute; recommended usage and dosage, whose attributes include production date and production batch; and interaction, whose attribute is the degree of interaction;

[0016] Finally, a drug knowledge graph is constructed based on the designed nodes and edges, specifically including: creating each entity as a node in the graph according to the designed nodes, and adding attribute values ​​to each node; creating edges between nodes according to the designed edges, and adding attribute values ​​to each edge, thereby constructing a drug knowledge graph and updating the graph regularly.

[0017] Preferably, in the prescription map, the attributes of the drug node include drug name, drug code, drug type, drug dosage form, specification, implementation standard, validity period, manufacturer, approval number, storage condition, and prescription status, and the attributes of the patient node include patient code, patient age, patient gender, and patient medical history;

[0018] The attributes of prescription edges include date, dosage, frequency, and course of medication. The edge weight of the prescription edge represents the strength of the prescription, which is calculated based on the dosage and frequency.

[0019] Preferably, the drug knowledge graph and the prescription graph are integrated to obtain a hypergraph, including:

[0020] Create all nodes and edges defined in the drug knowledge graph in the prescription graph, where ingredients, indications, side effects, contraindications, usage and dosage, manufacturers, and drug interactions exist as independent node types;

[0021] An edge is constructed between the drug node and the ingredient node, and the edge weight is the ingredient content. An edge is constructed between the drug node and the indication node to indicate the disease or symptom that the drug is used to treat. An edge is constructed between the drug node and the side effect node to indicate the side effects that the drug may cause. An edge is constructed between the drug node and the contraindication node to indicate the contraindications for the use of the drug. An edge is constructed between the drug node and the usage and dosage node to provide the recommended usage and dosage of the drug. An edge is constructed between the drug node and the manufacturer node to indicate the manufacturer of the drug. If there is an interaction between drugs, an edge is constructed between the drug nodes, and a hypergraph is obtained.

[0022] Preferably, multi-level community detection is used to detect abnormal behavior of package drug purchases, including:

[0023] First, primary community detection is performed based on the hypergraph to obtain multiple primary communities. The algorithms used for initial community detection include the Louvain algorithm.

[0024] Secondly, fine-grained secondary community detection is performed based on the primary community to obtain multiple fine-grained communities. The algorithms used in secondary community detection include the infomap algorithm;

[0025] Next, the fine-grained community is optimized based on label propagation to obtain the final community. The optimization algorithm used includes the LAP algorithm.

[0026] Finally, the average edge weight and modularity of each final community are calculated, and the anomaly score of each final community is calculated based on the average edge weight and modularity. The abnormal community is detected by comparing the anomaly score and the community anomaly threshold, and the abnormal nodes are determined by calculating the feature deviation, centrality score, and similarity deviation of each node in the abnormal community. Based on the abnormal node analysis, the drug combination containing the abnormal node is regarded as an abnormal drug combination, and the corresponding package drug purchase abnormal behavior is detected.

[0027] Preferably, the abnormal nodes are determined by calculating the feature deviation, centrality score, and similarity deviation of each node in the abnormal community, including:

[0028] The attribute value of each node is used as a feature, and the feature deviation between each node and other nodes in the abnormal community is calculated. The feature deviation is obtained by calculating the average difference between the attribute of each node and the attributes of other nodes. The feature deviation measures the degree of deviation between the attribute value of each node in the community and the corresponding attribute value of other nodes in the community.

[0029] Calculate the degree centrality, betweenness centrality, and closeness centrality of each node in the abnormal community, and determine the centrality score of each node based on the degree centrality, betweenness centrality, and closeness centrality;

[0030] Calculate the similarity between each node in the abnormal community and other nodes, and determine the mean and standard deviation of the similarity based on the similarity, where the standard deviation is used as the similarity deviation; the similarity is used to compare the properties of two nodes to help identify which nodes are similar in specific features, and the similarity deviation measures the fluctuation of the similarity of a node in the entire community, reflecting the difference between its behavior and most nodes in the community. If the similarity deviation of a node is large, it means that its similarity with other nodes varies greatly, and there is a significant deviation from the overall similarity of the community;

[0031] Calculate the anomaly score of each node based on the feature standard deviation, centrality score, and similarity deviation;

[0032] When the node's anomaly score is higher than the node anomaly threshold, and the feature deviation, centrality score, and similarity deviation are also higher than their respective set thresholds, the node is considered an abnormal node.

[0033] Preferably, clustering is used to detect abnormal behavior of package drug purchases, including:

[0034] Perform random walks on the hypergraph to generate a node sequence, and learn the node sequence to obtain the low-dimensional embedding vector of the node. Use a clustering algorithm to cluster the low-dimensional embedding vector of the node, and each cluster obtained is regarded as a community.

[0035] Count the community frequency of each drug combination in the prescription in each community, calculate the community frequency of the drug combination in a single community and the overall frequency in the hypergraph;

[0036] Drug combinations with a community frequency below the frequency threshold are considered abnormal drug combinations, and correspond to abnormal package drug purchase behaviors;

[0037] If the community frequency of a drug combination in a single community is significantly higher than the community frequency in other communities, the drug combination is considered to be an abnormal drug combination and corresponds to abnormal package drug purchase behavior, where "significantly higher" means that the difference in community frequency of a drug combination in two communities is greater than the set threshold;

[0038] When the community frequency of a drug combination is higher than the overall frequency, the drug combination is considered to be an abnormal drug combination and corresponds to abnormal package drug purchasing behavior.

[0039] Preferably, the method further comprises: detecting abnormal behavior of package drug purchase based on frequent item set mining, including:

[0040] Identify drug combinations in historical prescription data, sort the drug combinations by frequency for each disease code, identify the top 5% of drug combinations with the lowest frequency as abnormal drug combinations, and correspond to abnormal package drug purchase behaviors;

[0041] At the same time, a time window is set according to the appearance time of the treatment plan in the prescription, and the update frequency of drug combinations for common diseases and chronic diseases is counted and ranked within the time window. The top 5% of drug combinations with the lowest update frequency are identified as abnormal drug combinations, and corresponding abnormal package drug purchasing behavior is used. The time window for chronic diseases is larger than that for common diseases.

[0042] Preferably, when multiple methods are combined to detect abnormal behavior of package drug purchase, the intersection of abnormal drug combinations determined by at least two of the three methods is calculated, and the abnormal drug combination included in the intersection result is considered to correspond to the final abnormal behavior of package drug purchase.

[0043] To achieve the above-mentioned purpose of the invention, the embodiment of the present invention further provides a package-style drug purchase abnormal behavior detection system, including a graph construction module, a prescription graph construction module, a graph fusion module, and an abnormality detection module;

[0044] The graph construction module is used to construct a drug knowledge graph based on medical data;

[0045] The prescription graph construction module is used to construct a prescription graph containing nodes and prescription edges based on medical data, wherein the nodes include drug nodes and patient nodes, and the prescription edges are used to connect the patient nodes and the drug nodes;

[0046] The graph fusion module is used to fuse the drug knowledge graph and the prescription graph to obtain a hypergraph;

[0047] The anomaly detection module is used to detect abnormal behavior of package drug purchases based on a hypergraph by using at least one of multi-level community detection and clustering.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] The scheme of the present invention combines the drug knowledge graph and the prescription graph network, and uses at least one of frequent item analysis, community detection, and cluster analysis to perform anomaly detection, aiming to identify abnormal behavior of package drug purchases. The scheme of the present invention can deeply analyze drug usage patterns, identify unconventional prescriptions and potential drug abuse problems, thereby improving the accuracy and efficiency of drug management. Through this scheme, abnormal package drug purchase behavior can be effectively prevented, drug use can be optimized, patient safety can be ensured, and scientific data support can be provided to medical institutions to help them make more reasonable decisions. In addition, the implementation of the scheme of the present invention helps to improve the rationality and personalization of treatment plans, and further promote the quality and efficiency of medical services. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 is a flow chart of a method for detecting abnormal behavior in package drug purchases provided in an embodiment;

[0052] Figure 2 This is a flowchart of abnormal behavior detection of package drug purchase provided by the embodiment;

[0053] Figure 3 It is a structural diagram of a package medicine purchase abnormal behavior detection system provided in an embodiment. DETAILED DESCRIPTION

[0054] To make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation methods described herein are only used to explain the present invention and do not limit the scope of protection of the present invention.

[0055] The inventive concept of the present invention is to provide a package drug purchase anomaly detection system and method to improve the efficiency and accuracy of monitoring drug purchase and use. Through this innovative data analysis technology, abnormal medical insurance drug purchase behavior can be effectively identified, especially for abnormal patterns of package drug purchases, providing strong technical support for medical insurance companies and regulatory agencies, while ensuring the safety and rational use of patients' drugs.

[0056] like Figure 1 and Figure 2 As shown, the embodiment provides a method for detecting abnormal behavior of package drug purchase, comprising the following steps:

[0057] S1, construct a drug knowledge graph based on medical data.

[0058] In the embodiment, medical insurance settlement related data are extracted from the medical insurance database, including the medical insurance settlement table, the prescription diagnosis information table, the drug information table and the patient information table. The sensitive original data in the medical insurance settlement related data is desensitized, and all sensitive information is removed. The desensitized data is transferred to the local database.

[0059] Preprocess and feature engineer the desensitized data in the local database. Specifically, clean the data, including deleting duplicate records, correcting incorrect data formats, filling missing values, or deleting irreparable records; merge the data, associate multiple data tables according to primary keys and foreign keys, form a master table for subsequent graph construction; feature extraction: perform feature screening from the data, refer to the opinions of medical insurance experts, and select key features, including drug purchase information, amount, drug purchase time, medical insurance designated institution name and code, etc.; data format standardization: ensure that all dates and values ​​follow the same standard format for subsequent processing.

[0060] In the embodiment, based on the results of preprocessing and feature engineering, a drug knowledge graph is constructed, specifically including: first, entities including drug name, drug code, drug type, drug dosage form, specification, ingredient, indication, dosage, side effect, contraindication, implementation standard, validity period, etc. are extracted from the drug information table, and the entities are expanded and refined according to medical needs. Minimum age limit for medication, maximum age limit for medication, usage and dosage, maximum dosage, minimum dosage, maximum frequency of dosage, and minimum frequency of dosage, etc. Finally, the following entity categories are determined:

[0061] Drug Name - Generic or brand name of each drug;

[0062] Drug code - such as international code, local code, etc.;

[0063] Drug type - the classification of the drug, such as prescription drugs, over-the-counter drugs;

[0064] Drug dosage form - the form of the drug, such as tablets, capsules, injections, etc.;

[0065] Strength - the dosage strength of the drug, such as 500 mg / tablet;

[0066] Ingredients - the active ingredients in the drug and their amounts;

[0067] Indications - the conditions that a drug is indicated for treating;

[0068] Dosage - recommended dosage;

[0069] Side effects - possible adverse reactions to the drug;

[0070] Contraindications - conditions under which the drug should not be used;

[0071] Implementation standards - standards related to drug production and quality;

[0072] Expiration date - the effective use period of the drug;

[0073] Minimum age limit for medication use - the recommended minimum age for medication use;

[0074] Maximum age limit for medication - the maximum recommended age for medication;

[0075] Dosage and Administration - detailed instructions and dosage of the drug;

[0076] Maximum dose - the maximum safe dose in a single dose or day;

[0077] Minimum dose - minimum effective dose;

[0078] Maximum frequency of use - the recommended maximum frequency of use;

[0079] Minimum frequency of use - recommended minimum frequency of use;

[0080] Manufacturer - the company that produces the drug;

[0081] Approval number - the official number of the drug's market approval;

[0082] Drug interactions - possible interactions when used with other drugs;

[0083] Storage conditions - storage requirements for the drug;

[0084] Prescription Status - Indicates whether the drug requires a prescription from a physician.

[0085] Then, the nodes and edges of the drug knowledge graph are designed based on the entities, where the designed nodes include:

[0086] Drug: represents a specific drug product, and its attributes include drug name, drug code, drug type, drug dosage form, specification, implementation standard, expiration date, manufacturer, approval number, storage conditions, and prescription status;

[0087] Ingredients: Represents the active ingredients in the drug, and its attributes include ingredient name, maximum dose, and minimum dose;

[0088] Indications: represents the diseases or symptoms that the drug can treat, and its attributes include the name of the indication;

[0089] Side effects: represents the adverse reactions that may be caused by the use of drugs, and its attributes include side effect descriptions;

[0090] Contraindications: represents the contraindications for drug use, and its attributes include contraindication descriptions;

[0091] Usage and dosage: describes the usage and dosage limit of the drug. Its attributes include the minimum age limit for medication, the maximum age limit for medication, detailed instructions for usage and dosage, the maximum frequency of dosage, and the minimum frequency of dosage;

[0092] Manufacturer: The company that manufactures the drug. Its attributes include the manufacturer's name and address.

[0093] Drug interactions: describe possible interactions between drugs, and its attributes include interaction descriptions;

[0094] The designed edges include:

[0095] Contains ingredients: The edge from drug to ingredient indicates which ingredients the drug contains, and its attributes include the ingredient content;

[0096] Treatment: The edge from drug to indication represents the disease or condition that the drug is used to treat. It does not contain any attributes.

[0097] May cause: The edge from drug to side effect indicates the side effect that the drug may cause, and its attributes include the frequency of occurrence of side effects;

[0098] Taboo: The edge from a drug to a taboo indicates the taboo condition for drug use, which does not contain any attributes;

[0099] Recommended Usage and Dosage: The edge from drug to usage and dosage provides the recommended usage and dosage of the drug, which does not contain any attributes;

[0100] Production: The edge from drug to manufacturer indicates which company produced the drug. Its attributes include production date and production batch.

[0101] Interaction: An edge from one drug to another represents a possible interaction between the two drugs, and its attributes include the degree of interaction (mild, moderate, severe).

[0102] Finally, after completing the design of nodes and edges, a graph database is used to store nodes and edges. In the present invention, a Neo4j graph database is used to store nodes and edges. The necessary information is extracted from the data table, that is, the data information involved in the node and edge attributes. The data is imported into the graph database. When constructing a drug knowledge graph based on the designed nodes and edges, each entity is created as a node in the graph according to the designed nodes, and attribute values ​​are added to each node, for example: a node is created for each drug, and the drug name, drug code, drug type, drug dosage form, specification, implementation standard, validity period, manufacturer, approval number, storage conditions, and prescription status attributes are added. After completing the entity construction, edges are created between nodes according to the designed edges. For example, when a certain drug contains a specific ingredient, a "contains" relationship is created between the drug node and the ingredient node. After creating the edge, attribute values ​​are added to each edge, for example, the drug node and the ingredient node are connected to indicate the ingredient content. In this way, a drug knowledge graph is constructed.

[0103] After completing the construction of the drug knowledge graph, the drug knowledge graph needs to be updated regularly because as new drug information and medical research are released, the graph data needs to be updated regularly, including adding new nodes and edges and updating existing attributes.

[0104] S2, constructing a prescription graph including nodes and prescription edges based on medical data, wherein the nodes include drug nodes and patient nodes, and the prescription edges are used to connect the patient nodes and the drug nodes.

[0105] In the embodiment, when constructing a prescription graph, the graph elements are first defined, specifically two types of nodes are defined, namely, drug nodes and patient nodes, and then prescription edges are defined.

[0106] For drug nodes, its attributes include drug name, drug code, drug type, drug dosage form, specification, implementation standard, validity period, manufacturer, approval number, storage conditions, and prescription status;

[0107] For the patient node, its attributes include patient code, patient age, patient gender, and patient medical history;

[0108] For prescription edges, their attributes include date, dosage, frequency, and course of treatment. The edge weight of a prescription edge represents the strength of the prescription, which is calculated based on the dosage and frequency. The formula is: prescription edge weight = dosage × frequency. For example, the dosage of a prescription for a patient is 500 mg, and the frequency is 2 times / day. The edge weight calculation of the prescription edge is edge weight = 500mg × 2 times / day = 1000mg / day.

[0109] Based on the nodes and prescription edges defined above, the corresponding drug information, patient information, and prescription information are extracted from the patient information table and the prescription diagnosis information table to construct drug nodes and patient nodes, and prescription edges, i.e., corresponding attribute information, are added to the patient nodes and drug nodes, and the prescription edge weights are calculated at the same time.

[0110] S3, integrates the drug knowledge graph and the prescription graph to obtain a hypergraph.

[0111] In the embodiment, after the drug nodes, patient nodes and prescription edges are defined, the drug knowledge graph is merged with the prescription graph. Specifically, all nodes and edges defined in the drug knowledge graph are created in the prescription graph, wherein ingredients, indications, side effects, contraindications, usage and dosage, manufacturers, and drug interactions all exist as independent node types; edges are constructed between drug nodes and ingredient nodes, and the edge weight is the ingredient content; edges are constructed between drug nodes and indication nodes to indicate the disease or symptom that the drug is used to treat; edges are constructed between drug nodes and side effect nodes to indicate the side effects that the drug may cause; edges are constructed between drug nodes and contraindication nodes to indicate contraindications for drug use; edges are constructed between drug nodes and usage and dosage nodes to provide recommended usage and dosage of the drug; edges are constructed between drug nodes and manufacturer nodes to indicate the manufacturer of the drug; if there is an interaction between drugs, edges are constructed between drug nodes, and a hypergraph is obtained.

[0112] The graph structure and various attributes of the hypergraph are stored in the Neo4j graph database. By combining the drug knowledge graph with prescription data, a complex and feature-rich graph network is formed. This combination can significantly improve the analysis ability of drug use and patient prescription behavior. In this graph network, not only the basic attributes and production information of the drug are included, but also the key information such as the drug's ingredients, indications, side effects, contraindications, and usage and dosage are refined, so that each drug is described in detail. In addition, by defining specific edges to represent the relationship between drugs and ingredients, the therapeutic effect of drugs on diseases, the possible side effects of drugs, and the interaction between drugs, these edges not only reflect the complex relationship between drugs, but also reveal the direct connection between drugs and therapeutic effects. The construction of this hypergraph enhances the query efficiency and analysis depth of medical data, especially in identifying non-standard prescription patterns and potential drug abuse. Overall, this combination not only provides a multi-dimensional drug and prescription analysis platform, but also makes the relationship between data more intuitive and easy to explore in the form of a graph network, thereby greatly improving the accuracy of medical decision-making and the rationality of treatment plans.

[0113] S4, based on the hypergraph, at least one of multi-level community detection and clustering is used to detect abnormal behavior of package drug purchase.

[0114] In the embodiment, considering that the drug knowledge graph and the prescription graph network are integrated with each other, the graph becomes extremely complex and huge, and the basic community detection cannot achieve good results. Therefore, multi-level community detection is proposed to ensure the identification of communities at different granularities. Specifically, it includes:

[0115] (1) First, primary community detection is performed based on the hypergraph to obtain multiple primary communities. The algorithm used for initial community detection includes the Louvain algorithm. The specific steps are as follows:

[0116] Initialization: Treat each node in the hypergraph as an independent community; Local movement: Randomly select a node and move it to the community to which the neighboring node belongs, calculate the change in modularity before and after the move, and keep the move if the modularity increases, otherwise cancel it; Merge communities: Merge all nodes according to their communities to form a new supernode and rebuild the graph; Repeat the above steps until the modularity no longer increases significantly;

[0117] Among them, modularity formula: , is the edge weight between nodes i and j, and is the degree of nodes i and j, m is the total number of edges in the hypergraph, and is the community to which nodes i and j belong, is the Kroneckerdelta function;

[0118] Use the Louvain algorithm to detect communities on the hypergraph and obtain multiple primary communities. Examples include:

[0119] Community 1: {patient 1, patient 2, patient 7, drug A, drug B, drug C};

[0120] Community 2: {patient 3, patient 4, patient 8, drug D, drug E, drug F};

[0121] Community 3: {patient 5, patient 6, drug G, drug H}.

[0122] (2) Secondly, fine-grained secondary community detection is performed based on the primary community to obtain multiple fine-grained communities. The algorithms used in secondary community detection include the infomap algorithm, which is a community detection algorithm based on information theory and identifies communities by minimizing the length of information compression during random walks. The specific steps are:

[0123] Determined by the module description length and the secondary description length : , , where M represents a specific community division scheme, and in this invention, represents a secondary community. represents the possibility of entering a specific community from the random walk of the entire network, is the average coding length required to describe the entire community division. The lower this value is, the less information is required for random walks across communities, and the more natural and reasonable the community division is. , which represents the probability of reaching node i by random walk within the community. It is the secondary description length, which is the average coding length required to describe the internal information of the community under the condition of a given community division M. The lower the value, the simpler and more compact the structure within the community.

[0124] minimize After obtaining the optimal community division, a more fine-grained community detection is performed based on the preliminary community discovery. Examples of the multiple fine-grained communities obtained include:

[0125] Fine-grained community 1.1: {patient 1, patient 2, drug A, drug B};

[0126] Fine-grained community 1.2: {patient 2, patient 7, drug C};

[0127] Fine-grained community 2.1: {patient 3, patient 4, drug D};

[0128] Fine-grained community 2.2: {patient 3, patient 8, drug E, drug F};

[0129] Fine-grained community 3.1: {patient 5, patient 6, drug G};

[0130] Fine-grained community 3.2: {patient 6, drug A, drug H}.

[0131] (3) Next, the fine-grained community is optimized based on label propagation to obtain the final community. The optimization algorithm used includes the LAP algorithm, which performs detection based on label propagation. The specific steps are as follows:

[0132] Initialization: assign a unique label to each node for marking the node, which is represented by sign_1, sign_2..sign_i in the present invention; label propagation: during the iteration process, each node is updated according to the label of its neighboring nodes, and the node will select the label with the highest frequency in the neighboring nodes as its new label; termination condition: when the labels of all nodes no longer change or the maximum number of iterations is reached, the algorithm terminates; examples of the final community obtained by the LPA algorithm include:

[0133] Optimized community 1.1 {Members: Patient 1, Patient 2, Drug A, Drug B; Description: Common drug combinations for Patient 1 and Patient 2, Drug A and Drug B are often prescribed together};

[0134] Optimized community 1.2 {Members: Patient 2, Patient 7, Drug C; Description: Common drug combinations for Patient 2 and Patient 7, Drug C is their commonly used drug};

[0135] Optimized community 2.1 {Members: Patient 3, Patient 4, Drug D; Description: Common drug combinations of Patient 3 and Patient 4, Drug D is their commonly used drug};

[0136] Optimized community 2.2 {Members: Patient 3, Patient 8, Drug E, Drug F; Description: Common drug combinations for Patient 3 and Patient 8, Drug E and Drug F are often prescribed together};

[0137] Optimize community 3.1 {Members: Patient 5, Patient 6, Drug G; Description: Common drug combinations for Patient 5 and Patient 6, Drug G is their commonly used drug};

[0138] Optimize community 3.2 members: {Patient 6, Drug A, Drug H; Description: Common drug combinations for Patient 6, Drug A and Drug H are often prescribed together}.

[0139] (4) Finally, the average edge weight and modularity of each final community are calculated, and the anomaly score of each final community is calculated based on the average edge weight and modularity. The abnormal community is detected by comparing the anomaly score and the community anomaly threshold. The abnormal nodes are determined by calculating the feature deviation, centrality score, and similarity deviation of each node in the abnormal community. Based on the abnormal node analysis, the drug combination containing the abnormal node is identified as an abnormal drug combination, and the corresponding package drug purchase abnormal behavior is detected.

[0140] Calculate the average edge weight within a community ,in, is the edge set in the final community C, It is the edge The weight of is an edge set The number of edges in ;

[0141] Calculating community modularity ,in, is the adjacency matrix, and is the degree of nodes i and j, and m is the total number of edges in the graph;

[0142] According to the average edge weight and modularity Calculate the anomaly score for each final community ,in and is the weight parameter.

[0143] The communities are comprehensively evaluated based on the anomaly score of each final community. The final communities with high anomaly scores are marked as abnormal communities. Specifically, the average anomaly score is calculated. and standard deviation , community anomaly threshold Threshold = +2 When the abnormal score of a community is higher than the Threshold, the final community can be considered an abnormal community.

[0144] After determining the abnormal community, the feature standard deviation Feature ( v ), and compared with the characteristic standard deviation Feature( v ) are compared, and if there is a large difference, it can be determined that an abnormality exists.

[0145] The degree centrality of each node within the outlier community is also calculated , betweenness centrality and closeness centrality , based on degree centrality , betweenness centrality and closeness centrality Calculating centrality scores , based on the centrality score Find important nodes within the anomalous community.

[0146] ,in Representation Node The degree of, N represents the total number of nodes in the graph;

[0147] ,in Representation Node To Node The number of shortest paths, Indicates passing through node The number of shortest paths;

[0148] in Representation Node To Node The shortest path distance.

[0149] Use cosine similarity to calculate the feature similarity of nodes within anomaly communities , identifying nodes that are significantly different from other nodes in the community.

[0150] After determining various abnormal calculations, the results of feature statistical analysis, node centrality analysis, and feature similarity analysis are combined to calculate the abnormal score for each node. :

[0151]

[0152] in, , , is the weight.

[0153] When the abnormal score of a node is higher than the node abnormal threshold, and the feature deviation, centrality score, and similarity deviation are also higher than their respective set thresholds, the node is considered an abnormal node, and the drug combination containing the abnormal node is considered as an abnormal drug combination, and corresponds to the abnormal package drug purchase behavior.

[0154] In the embodiment, clustering is used to detect abnormal behavior of package drug purchase, including:

[0155] (a) First, we can use Node2Vec or other methods to perform random walks on the hypergraph to generate node sequences. Set the walk length l and the number of walks r. Perform r walks, each of which generates a node sequence of length l.

[0156] Select Node The first neighbor node The probability is ,in Is a node The set of neighbor nodes of

[0157] Then from the node Move to the next node The probability is ,in Representation Node and nodes The shortest path distance between and is a parameter that controls the walking strategy.

[0158] (b) The node sequence is learned to obtain the low-dimensional embedding vector of the node. Specifically, Skip-gram is used to train the node sequence to obtain the low-dimensional embedding vector of the node.

[0159] When training, the goal is to maximize the conditional probability of the context node appearing: ,in is a collection of nodes, is the context window size, j is the value from − arrive The index of the word (but not including 0, because 0 is the position of the central word itself) indicates the position extending from the central word to the left and right. In short, is the position offset relative to the center word in a fixed window. The conditional probability is calculated using the softmax function: ,in Representation Node The embedding vector of is the center node, the node of current focus, Represents the context node, located at the center node In the neighborhood of the graph, the relative position is given by specified. Represents the central node The embedding vector of Represents the context node The embedding vector of . It is used to indicate the connection strength between two nodes. is a normalization factor that ensures that for all possible context nodes The probability sums to 1. This summation process involves every node in the graph by calculating their embedding vectors and the central node The exponential of the dot product of the embedding vector .

[0160] (c) A clustering algorithm is used to cluster the low-dimensional embedding vectors of the nodes, and each cluster obtained is regarded as a community.

[0161] K-means can be used to cluster the low-dimensional embedding vectors of these nodes to identify the community structure. Set the number of clusters K and initialize K cluster centers. Iterate and update the node assignment and cluster centers until the cluster centers no longer change. After clustering the low-dimensional embedding vectors of the nodes, each node (drug or patient) is assigned to a cluster. Get the cluster label to which each node belongs. The same cluster label can be regarded as a community.

[0162] (d) Count the community frequency of each drug combination in the prescription in each community, and calculate the community frequency of the drug combination in a single community and the overall frequency in the hypergraph.

[0163] (e) Drug combinations with a community frequency below the frequency threshold are considered abnormal drug combinations and correspond to abnormal package drug purchasing behaviors.

[0164] Determine regular drug combinations and abnormal drug combinations: set a frequency threshold, for example the top 5%, and mark drug combinations with higher frequencies in all communities, that is, drug combinations with community frequencies higher than the frequency threshold, as regular drug combinations; and drug combinations with lower frequencies, that is, drug combinations with community frequencies lower than the frequency threshold, as abnormal drug combinations, and correspond to abnormal package drug purchasing behaviors.

[0165] (f) If the community frequency of a drug combination in a single community is significantly higher than the community frequency in other communities, the drug combination is considered an abnormal drug combination and corresponds to abnormal package drug purchasing behavior.

[0166] Specifically, "significantly higher" here means that the difference in community frequency of a drug combination in two communities is greater than a set threshold, where the threshold is set according to the actual situation. For example, through data analysis, it is found that the average community frequency of the drug combination is 0.05, and the standard deviation is 0.02. The threshold is set That is, 0.05+2×0.02=0.09, which means that if the frequency of a drug combination in a community is greater than 9%, and the frequency in other communities is significantly lower than this value, then this drug combination may be abnormal.

[0167] (g) When the community frequency of a drug combination is higher than the overall frequency, the drug combination is considered to be an abnormal drug combination and corresponds to abnormal package drug purchasing behavior.

[0168] Calculate the community frequency and the overall frequency The ratio R = When the R value is significantly greater than 1, the drug combination is considered to be an abnormal drug combination and corresponds to abnormal package drug purchasing behavior.

[0169] In the embodiment, when performing abnormal behavior detection of package-style drug purchase, detection can also be performed based on frequent item set mining, specifically including: identifying drug combinations in historical prescription data, ranking drug combinations by frequency according to the disease code of each disease, identifying the top 5% of drug combinations with the lowest frequency as abnormal drug combinations, and corresponding to abnormal package-style drug purchase behavior;

[0170] At the same time, a time window is set according to the appearance time of the treatment plan in the prescription, and the update frequency of drug combinations for common diseases and chronic diseases is counted and ranked within the time window. The top 5% of drug combinations with the lowest update frequency are identified as abnormal drug combinations, and corresponding abnormal package drug purchasing behavior is used. The time window for chronic diseases is larger than that for common diseases.

[0171] Based on the above three methods of detecting abnormal behavior of package drug purchase, during comprehensive detection, the intersection of abnormal drug combinations determined by at least two of the three methods is calculated, and it is considered that the abnormal drug combination included in the intersection result corresponds to the final abnormal behavior of package drug purchase.

[0172] Based on the same inventive concept, Figure 3 As shown, the embodiment also provides a package drug purchase abnormal behavior detection system 30, including a graph construction module 31, a prescription graph construction module 32, a graph fusion module 33, and anomaly detection module 34, wherein the graph construction module 31 is used to construct a drug knowledge graph based on medical data; the prescription graph construction module 32 is used to construct a prescription graph containing nodes and prescription edges based on medical data, wherein the nodes include drug nodes and patient nodes, and the prescription edges are used to connect patient nodes and drug nodes; the graph fusion module 33 is used to fuse the drug knowledge graph and the prescription graph to obtain a hypergraph; the anomaly detection module 34 is used to detect abnormal behavior in package drug purchases based on the hypergraph by using at least one of multi-level community detection and clustering.

[0173] It should be noted that the package-style drug purchase abnormal behavior detection system provided in the above embodiment should be illustrated by the division of the above functional modules when performing package-style drug purchase abnormal behavior detection. The above functional allocation can be completed by different functional modules as needed, that is, the internal structure of the terminal or server is divided into different functional modules to complete all or part of the functions described above. In addition, the package-style drug purchase abnormal behavior detection system provided in the above embodiment and the package-style drug purchase abnormal behavior detection method embodiment belong to the same concept. The specific implementation process is detailed in the package-style drug purchase abnormal behavior detection method embodiment, which will not be repeated here.

[0174] The above-mentioned package-style drug purchase abnormal behavior detection method and system have the following technical effects:

[0175] Improve detection accuracy: By integrating the drug knowledge graph and prescription graph, abnormal drug purchase patterns can be analyzed and identified more accurately. The drug knowledge graph provides in-depth information on the interactions between drugs, while the prescription graph analysis can mine the implicit relationships and abnormal patterns in prescription data. This synthesized information will greatly enhance the system's judgment ability in complex data environments.

[0176] Improve processing efficiency: Traditional data processing methods often rely on manually set rules and simple statistical analysis, which is not only inefficient but also difficult to deal with large-scale data sets. The present invention uses an automated graph data analysis method to effectively process large amounts of data and quickly identify abnormal behaviors, thereby significantly improving the efficiency of the entire detection process.

[0177] Enhance the scalability of the system: With the increase in data volume and changes in medical insurance policies, the detection of abnormal behavior in medical insurance package drug purchases needs to have good scalability. By using a flexible graph network structure and a modular data processing method, the present invention can easily adapt to data processing needs and policy adjustments of different scales, ensuring the long-term and effective operation of the system.

[0178] Promote multi-faceted applications: In addition to package drug purchase anomaly detection, the present invention can also be applied to other medical data analysis fields, such as patient treatment pathway analysis, drug adverse reaction monitoring, etc. The versatility and adaptability of this technology make it a powerful tool in the field of medical insurance and health management.

[0179] In general, the present invention provides a new type of package-based abnormal drug purchasing behavior detection tool, which improves the medical insurance system's monitoring ability of abnormal drug purchasing behavior by comprehensively utilizing the drug knowledge graph and prescription graph network, ensures the rational use of public resources and the medical safety of patients, and thus promotes the medical insurance industry to develop in a more efficient and transparent direction.

[0180] The specific implementation methods described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above is only the most preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal behavior in package drug purchase, characterized in that: The following steps are involved: Constructing a drug knowledge graph based on medical data includes: first, extracting entities from the medical data, wherein the entities include: drug name, drug code, drug type, drug dosage form, specification, ingredient, indication, dosage, side effect, contraindication, implementation standard, and validity period, and expanding and refining the entities, including the minimum age limit for drug use, the maximum age limit for drug use, usage and dosage, maximum dosage, minimum dosage, maximum frequency of use, and minimum frequency of use; then, designing nodes and edges of the drug knowledge graph based on the entities, wherein the nodes include: drug, whose attributes include drug name, drug code, drug type, drug dosage form, specification, implementation standard, validity period, manufacturer, approval number, storage condition, and prescription status; ingredient, whose attributes include ingredient name, maximum dosage, and minimum dosage; indication, whose attributes include indication name; side effect, whose attributes include side effect description; contraindication, whose attributes include drug ... Contains description of contraindications; usage and dosage, whose attributes include the minimum age limit for medication, the maximum age limit for medication, detailed description of usage and dosage, the maximum frequency of dosage, and the minimum frequency of dosage; manufacturer, whose attributes include manufacturer name and manufacturer address; and drug interaction, whose attributes include interaction description; the edges of the drug knowledge graph include: ingredients, whose attributes are ingredient content; treatment, which has no attributes; possible causes, whose attributes are the frequency of side effects; contraindications, which have no attributes; recommended usage and dosage, whose attributes include production date and production batch; and interaction, whose attributes are the degree of interaction; finally, construct the drug knowledge graph based on the designed nodes and edges, specifically including: creating each entity as a node in the graph according to the designed nodes, and adding attribute values ​​to each node, creating edges between nodes according to the designed edges, and adding attribute values ​​to each edge, thereby constructing the drug knowledge graph and updating the graph regularly; A prescription graph including nodes and prescription edges is constructed based on medical data, wherein the nodes include drug nodes and patient nodes, and the prescription edges are used to connect the patient nodes and drug nodes, wherein the attributes of the drug nodes include drug name, drug code, drug type, drug dosage form, specification, implementation standard, validity period, manufacturer, approval number, storage condition, and prescription status, and the attributes of the patient nodes include patient code, patient age, patient gender, and patient medical history; the attributes of the prescription edges include date, dosage, frequency, and course of medication, and the edge weight of the prescription edge represents the strength of the prescription, which is calculated based on the dosage and frequency; The drug knowledge graph and the prescription graph are integrated to obtain a hypergraph, including: creating all nodes and edges defined in the drug knowledge graph in the prescription graph, wherein ingredients, indications, side effects, contraindications, usage and dosage, manufacturers, and drug interactions all exist as independent node types; constructing edges between drug nodes and ingredient nodes, where the edge weight is the ingredient content; constructing edges between drug nodes and indication nodes to indicate the disease or symptom that the drug is used to treat; constructing edges between drug nodes and side effect nodes to indicate possible side effects caused by the drug; constructing edges between drug nodes and contraindication nodes to indicate contraindications for drug use; constructing edges between drug nodes and usage and dosage nodes to provide recommended usage and dosage of the drug; constructing edges between drug nodes and manufacturer nodes to indicate the manufacturer of the drug; if there is an interaction between drugs, constructing edges between drug nodes, thus obtaining a hypergraph; At least one of multi-level community detection and clustering is used based on a hypergraph to detect abnormal behavior of package drug purchases, wherein multi-level community detection is used to detect abnormal behavior of package drug purchases, including: first, primary community detection is performed based on a hypergraph to obtain multiple primary communities, and the algorithm used for primary community detection includes the Louvain algorithm; second, fine-grained secondary community detection is performed based on the primary community to obtain multiple fine-grained communities, and the algorithm used for secondary community detection includes the infomap algorithm; next, the fine-grained community is optimized based on label propagation to obtain a final community, and the algorithm used for optimization includes the LAP algorithm; finally, the average edge weight and modularity of each final community are calculated, and the abnormal score of each final community is calculated based on the average edge weight and modularity, and the abnormal community is detected by comparing the abnormal score and the community abnormal threshold, and the abnormal node is determined by calculating the feature deviation, centrality score, and similarity deviation of each node in the abnormal community, and the drug combination containing the abnormal node is analyzed as an abnormal drug combination based on the abnormal node, and corresponds to the abnormal behavior of package drug purchases; Clustering is used to detect abnormal behavior of package drug purchases, including: randomly walking a hypergraph to generate a node sequence, learning the node sequence to obtain a low-dimensional embedding vector of the node, clustering the low-dimensional embedding vector of the node using a clustering algorithm, and each obtained cluster is regarded as a community; counting the community frequency of each drug combination in the prescription in each community, calculating the community frequency of the drug combination in a single community and the overall frequency in the hypergraph; considering the drug combination whose community frequency is lower than the frequency threshold as an abnormal drug combination, and corresponding to the abnormal behavior of package drug purchases; if the community frequency of the drug combination in a single community is significantly higher than the community frequency in other communities, the drug combination is considered to be an abnormal drug combination, and corresponds to the abnormal behavior of package drug purchases, wherein significantly higher means that the difference in community frequency of a drug combination in two communities is greater than a set threshold; when the community frequency of the drug combination is higher than the overall frequency, the drug combination is considered to be an abnormal drug combination, and corresponds to the abnormal behavior of package drug purchases.

2. The method for detecting abnormal behavior of meal-style drug purchase according to claim 1, characterized in that: Abnormal nodes are determined by calculating the feature deviation, centrality score, and similarity deviation of each node in the abnormal community, including: The attribute value of each node is used as a feature, and the feature deviation between each node and other nodes in the abnormal community is calculated. The feature deviation is obtained by calculating the average difference between the attribute of each node and the attributes of other nodes. Calculate the degree centrality, betweenness centrality, and closeness centrality of each node in the abnormal community, and determine the centrality score of each node based on the degree centrality, betweenness centrality, and closeness centrality; Calculate the similarity between each node and other nodes in the abnormal community, and calculate the average and standard deviation of the similarity based on the similarity, where the standard deviation is used as the similarity deviation; Calculate the anomaly score of each node based on the feature standard deviation, centrality score, and similarity deviation; When the node's anomaly score is higher than the node anomaly threshold, and the feature deviation, centrality score, and similarity deviation are also higher than their respective set thresholds, the node is considered an abnormal node.

3. The method for detecting abnormal behavior of meal-style drug purchase according to claim 1, characterized in that: It also includes: detecting abnormal behavior of package drug purchase based on frequent item set mining, including: Identify drug combinations in historical prescription data, sort the drug combinations by frequency for each disease code, identify the top 5% of drug combinations with the lowest frequency as abnormal drug combinations, and correspond to abnormal package drug purchase behaviors; At the same time, a time window is set according to the appearance time of the treatment plan in the prescription, and the update frequency of drug combinations for common diseases and chronic diseases is counted and ranked within the time window. The top 5% of drug combinations with the lowest update frequency are identified as abnormal drug combinations, and corresponding abnormal package drug purchasing behavior is used. The time window for chronic diseases is larger than that for common diseases.

4. The method for detecting abnormal behavior of meal-style drug purchase according to claim 1 or 3, characterized in that: When multiple methods are combined to detect abnormal behavior of package drug purchase, the intersection of abnormal drug combinations determined by at least two of the three methods is calculated, and it is considered that the abnormal drug combination included in the intersection result corresponds to the final abnormal behavior of package drug purchase.

5. A set meal drug purchase abnormal behavior detection system, characterized in that: It includes graph construction module, prescription graph construction module, graph fusion module and anomaly detection module; The graph construction module is used to construct a drug knowledge graph based on medical data, including: first, extracting entities from the medical data, wherein the entities include: drug name, drug code, drug type, drug dosage form, specification, ingredient, indication, dosage, side effect, contraindication, implementation standard, and validity period, and expanding and refining the entities, including the minimum age limit for drug use, the maximum age limit for drug use, usage and dosage, maximum dose, minimum dose, maximum frequency of use, and minimum frequency of use; then, designing nodes and edges of the drug knowledge graph based on the entities, wherein the nodes include: drugs, whose attributes include drug name, drug code, drug type, drug dosage form, specification, implementation standard, validity period, manufacturer, approval number, storage conditions, and prescription status; ingredients, whose attributes include ingredient name, maximum dose, and minimum dose; indications, whose attributes include indication name; side effects, whose attributes include side effect description; contraindications Taboo, whose attributes include contraindication description; usage and dosage, whose attributes include the minimum age limit for medication, the maximum age limit for medication, detailed instructions for usage and dosage, the maximum frequency of dosage, and the minimum frequency of dosage; manufacturer, whose attributes include the manufacturer name and manufacturer address; and drug interaction, whose attributes include interaction description; the edges of the drug knowledge graph include: ingredients, whose attributes are ingredient content; treatment, which has no attributes; may cause, whose attributes are the frequency of side effects; contraindications, which have no attributes; recommended usage and dosage, whose attributes include production date and production batch; and interaction, whose attributes are the degree of interaction; finally, constructing a drug knowledge graph based on the designed nodes and edges, specifically including: creating each entity as a node in the graph according to the designed nodes, and adding attribute values ​​to each node, creating edges between nodes according to the designed edges, and adding attribute values ​​to each edge, thereby constructing a drug knowledge graph and updating the graph regularly; The prescription graph construction module is used to construct a prescription graph containing nodes and prescription edges based on medical data, wherein the nodes include drug nodes and patient nodes, and the prescription edges are used to connect the patient nodes and the drug nodes, wherein the attributes of the drug nodes include drug name, drug code, drug type, drug dosage form, specification, implementation standard, validity period, manufacturer, approval number, storage condition, and prescription status, and the attributes of the patient nodes include patient code, patient age, patient gender, and patient medical history; the attributes of the prescription edges include date, medication dosage, medication frequency, and medication course, and the edge weight of the prescription edge represents the strength of the prescription, which is calculated based on the medication dosage and medication frequency; The graph fusion module is used to fuse the drug knowledge graph and the prescription graph to obtain a hypergraph, including: creating all nodes and edges defined in the drug knowledge graph in the prescription graph, wherein ingredients, indications, side effects, contraindications, usage and dosage, manufacturers, and drug interactions all exist as independent node types; constructing edges between drug nodes and ingredient nodes, where the edge weight is the ingredient content, constructing edges between drug nodes and indication nodes to indicate the disease or symptom that the drug is used to treat, constructing edges between drug nodes and side effect nodes to indicate the side effects that may be caused by the drug, constructing edges between drug nodes and contraindication nodes to indicate contraindications for drug use, constructing edges between drug nodes and usage and dosage nodes to provide recommended usage and dosage of the drug, constructing edges between drug nodes and manufacturer nodes to indicate the manufacturer of the drug, and if there is an interaction between drugs, constructing edges between drug nodes, thereby obtaining a hypergraph; The anomaly detection module is used to detect abnormal behavior of package drug purchase by using at least one of multi-level community detection and clustering based on a hypergraph, wherein the multi-level community detection is used to detect abnormal behavior of package drug purchase, including: first, primary community detection is performed based on the hypergraph to obtain multiple primary communities, and the algorithm used for primary community detection includes the Louvain algorithm; second, fine-grained secondary community detection is performed based on the primary community to obtain multiple fine-grained communities, and the algorithm used for secondary community detection includes the infomap algorithm; next, the fine-grained community is optimized based on label propagation to obtain the final community, and the algorithm used for optimization includes the LAP algorithm; finally, the average edge weight and modularity of each final community are calculated, and the abnormal score of each final community is calculated based on the average edge weight and modularity, and the abnormal community is detected by comparing the abnormal score and the community abnormal threshold, and the abnormal node is determined by calculating the feature deviation, centrality score, and similarity deviation of each node in the abnormal community, and the drug combination containing the abnormal node is analyzed as an abnormal drug combination based on the abnormal node, and corresponds to the abnormal behavior of package drug purchase; Clustering is used to detect abnormal behavior of package drug purchases, including: randomly walking a hypergraph to generate a node sequence, learning the node sequence to obtain a low-dimensional embedding vector of the node, clustering the low-dimensional embedding vector of the node using a clustering algorithm, and each obtained cluster is regarded as a community; counting the community frequency of each drug combination in the prescription in each community, calculating the community frequency of the drug combination in a single community and the overall frequency in the hypergraph; considering the drug combination whose community frequency is lower than the frequency threshold as an abnormal drug combination, and corresponding to the abnormal behavior of package drug purchases; if the community frequency of the drug combination in a single community is significantly higher than the community frequency in other communities, the drug combination is considered to be an abnormal drug combination, and corresponds to the abnormal behavior of package drug purchases, wherein significantly higher means that the difference in community frequency of a drug combination in two communities is greater than a set threshold; when the community frequency of the drug combination is higher than the overall frequency, the drug combination is considered to be an abnormal drug combination, and corresponds to the abnormal behavior of package drug purchases.

Images