Infectious disease traceability early warning method and system based on privacy protection and attack resistance

Abstract

The invention discloses an infectious disease traceability early warning method and system based on privacy protection and attack resistance, and belongs to the field of information protection and attack detection.The method comprises the steps that a contact flow data time sequence of a user is collected; according to the sudden change condition of the contact flow data time sequence at the time switching node, determining a normal contact flow data time sequence, injecting noise into the normal contact flow data time sequence to form a pseudo-marked flow time sequence, and training the comparison model to obtain a pseudo-marked flow time sequence; determining a normal contact flow data time sequence according to the trained comparison model; the method comprises the following steps of: constructing a traceability graph according to a normal contact flow data time sequence, aggregating multi-hop connection among nodes in the traceability graph by adopting an iterative aggregation method to obtain a contact knowledge graph of direct contact and indirect contact, and obtaining contact information of all users as training data according to the contact knowledge graph. And training the prediction model according to the training data, and outputting the infection probability of the user by the trained model.

Description

Technical Field

[0001] The present invention relates to the field of information protection and attack detection, and specifically to an infectious disease source tracing and early warning method and system based on privacy protection and anti-attack. Background Art

[0002] Highly pathogenic infectious diseases refer to those diseases that can cause serious health problems, have highly active viruses that are easily transmitted and endanger public health and safety. Some of these viruses are extremely contagious, targeted and latent, and are currently one of the most serious threats to public health and safety.

[0003] Although all countries have corresponding control measures and infection chain tracking programs for infectious diseases, they are unable to collect sufficiently accurate data for analysis at the beginning of the epidemic. Therefore, there is no sufficient ability to trace the source of infectious viruses and predict and warn to curb the spread of the virus. Highly pathogenic infectious diseases are mainly transmitted through the respiratory tract, and the specific transmission methods are droplet transmission, contact transmission, and aerosol transmission. In order to effectively track the spread of the virus, it is necessary to fully understand the infection chain, that is, to observe and detect whether people who have been in contact with the patient are infected. Identifying and controlling the infection chain is an important means of infectious disease control. It can be used as a core method to trace the transmission path of the virus, and it can also be used as an effective tool to slow down the epidemic under the normal situation of epidemic prevention and control. However, at this stage, these systems can only mark the whereabouts of patients to a certain extent, but cannot fully analyze the outbreak of the virus, nor can they report the development trend of the epidemic that may occur next to users, and the utilization rate of the collected key information is not high.

[0004] It is impossible to fundamentally prevent and control highly pathogenic infectious diseases through contact tracing alone. It is also necessary to construct a traceability map corresponding to the infection contact events generated by specific virus sources, which can conduct in-depth analysis and advance prediction of the virus transmission route to achieve active prevention and control of highly pathogenic infectious diseases. More importantly, it is necessary to protect the personal privacy of users in this process, and to analyze the epidemic infection chain under the premise of sufficient security. In summary, being able to achieve "high security", "strong defense" and "accurate traceability" are the core requirements for realizing a traceability tracking system for highly pathogenic infectious diseases, which is of great significance to protecting life and health safety, public health safety, and personal privacy safety. Summary of the invention

[0005] The purpose of the present invention is to provide an infectious disease tracing and early warning method based on privacy protection and anti-attack, in order to address the problems in the above-mentioned prior art such as complex information collection, possible mixed attacks in uploaded data, low analysis efficiency and difficulty in analyzing the infection chain. The method can effectively collect contact information, actively detect attacks, and efficiently analyze the infection chain.

[0006] The present invention is achieved through the following technical solutions:

[0007] In the first aspect, the present application provides an infectious disease source tracing warning method based on privacy protection and anti-attack, comprising the following steps:

[0008] Step 1: Collect the user's contact flow data time series;

[0009] The contact flow data time series includes contact information of users along the time axis;

[0010] Step 2: The server uses the key transfer key to encrypt and transmit the public key, and the client uses the public key to encrypt the contact flow data time series and send it to the server;

[0011] Step 3: According to the mutation of the contact flow data time series at the time switching node, determine the normal contact flow data time series, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, train the comparison model, and determine the normal contact flow data time series according to the trained comparison model;

[0012] Step 4: Construct a traceability graph based on the normal contact flow data time series, and use the iterative aggregation method to aggregate the multi-hop connections between the nodes in the traceability graph to obtain the contact knowledge graph of direct contact and indirect contact. According to the contact knowledge graph, obtain all users' contact information as training data, train the prediction model based on the training data, and the trained model outputs the user's infection probability.

[0013] Preferably, collecting the user's contact flow data time series in step 1 includes:

[0014] When contact occurs between users, the user's beacon is broadcast, the beacons and distances of the people who have contact with the user are collected, and a fuzzy location is generated for the address where the contact occurred to obtain the contact information of the contact behavior. A contact flow data time series is formed based on the contact information at each time point.

[0015] Preferably, in step 2, a unique beacon is generated for the user to hide the user's identity and prevent the user from being tracked by a link.

[0016] Preferably, in step 3, determining a normal contact flow data time series according to a mutation of the contact flow data time series at a time switching node includes:

[0017] Determine the non-peak and low-peak periods of the contact flow data time series, and use the non-peak and low-peak periods as flow switching nodes. When the contact flow data time series mutates outside the switching node, the contact flow data at that moment is abnormal data.

[0018] Preferably, in step 3, the normal contact flow data time series are grouped according to the set time to obtain multiple contact flow data groups, and noise of different intensities is injected into each contact flow data group by noise injection, so that each contact flow data forms a pseudo-labeled flow time series, which is used as a training data set to train the comparison model.

[0019] Preferably, the nodes in the traceability graph in step 4 represent user information, the edges between the nodes represent the information of contact between users, and the status of the user is labeled as infected user or uninfected user;

[0020] The number of neighbor nodes is dynamically adjusted through sampling strategies, GraphSAGE is used to iteratively aggregate neighbor nodes, and logical relationships are used to mine the contact objects with the greatest contact risk and potential infected persons; the contact knowledge graph of the user's direct and indirect contacts is obtained.

[0021] Preferably, in step 2, the client and the server use a modified DH algorithm to exchange their respective secrets, and generate a key transfer key K based on the secrets of both parties; the server uses the key transfer key to encrypt the public key and sends it to the client, and the client uses the key transfer key K to decrypt and obtain the public key. The public key is used to encrypt data, and the private key is used for decryption.

[0022] In the second aspect, the present application provides an infectious disease source tracing and early warning system based on privacy protection and anti-attack, including:

[0023] A collection module, used to collect the user's contact flow data time series;

[0024] The contact flow data time series includes contact information of users along the time axis;

[0025] An encryption module, which is used for the server to encrypt and transmit the public key using the key transfer key, and the client to encrypt the contact flow data time series using the public key and send it to the server;

[0026] The abnormal data diagnosis module is used to determine the normal contact flow data time series according to the mutation of the contact flow data time series at the time switching node, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, and train the comparison model, and determine the normal contact flow data time series according to the trained comparison model;

[0027] The prediction module is used to construct a traceability graph based on the normal contact flow data time series, and use the iterative aggregation method to aggregate the multi-hop connections between the nodes in the traceability graph to obtain the contact knowledge graph of direct contact and indirect contact. According to the contact knowledge graph, the contact information of all users is obtained as training data, and the prediction model is trained according to the training data. The trained model outputs the user's infection probability.

[0028] In a second aspect, the present application provides an electronic device, including:

[0029] Memory for storing computer programs;

[0030] A processor is used to implement the steps of the infectious disease source tracing and early warning method based on privacy protection and anti-attack when executing the computer program.

[0031] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the infectious disease traceability and early warning method based on privacy protection and anti-attack.

[0032] Compared with the prior art, the present invention has the following beneficial technical effects:

[0033] The infectious disease source tracing and early warning method based on privacy protection and anti-attack provided in the present application adopts a self-supervised anomaly detection method based on traffic analysis for processing. This method uses traffic characteristics to detect data without the need to decrypt the data, thereby achieving fast and efficient detection of uploaded data. After anomaly detection, the abnormal data information is eliminated; the traceability graph is constructed according to the normal contact traffic data time series, and the multi-hop connections between the nodes in the traceability graph are aggregated using an iterative aggregation method to obtain a contact knowledge graph of direct contact and indirect contact. According to the contact knowledge graph, all users' contact information is obtained as training data, and the prediction model is trained according to the training data. The trained model outputs the user's infection probability, abstracts a reasonable data structure for the contact event, and improves the speed and accuracy of analyzing the infection chain. The present invention uses GraphSAGE to integrate the interactive information of events on the contact graph and to check forward and reverse predictions, and the use effect is significant.

[0034] Furthermore, replay attacks and wormhole attacks are avoided by optimizing the extraction and verification methods of private data. A fast and efficient time series anomaly detection and data verification method based on self-supervision. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a flow chart of the infectious disease source tracing and early warning method based on privacy protection and anti-attack of the present invention;

[0036] Figure 2 This is a structural diagram of the noise module of the abnormal monitoring solution of the present invention;

[0037] Figure 3 It is a schematic diagram of the source tracing prediction method of the present invention. DETAILED DESCRIPTION

[0038] The present invention will be further described in detail below in conjunction with the accompanying drawings, which are intended to explain the present invention rather than to limit it.

[0039] See also Figure 1 , a method for tracing and warning the source of infectious diseases based on privacy protection and anti-attack. The method mainly consists of four stages: generating and collecting contact information, encrypting and protecting the information uploaded to the server, anomaly detection, building a contact map and tracing the source. The specific implementation method is as follows:

[0040] Step 1, collecting the user's contact flow data time series;

[0041] S1.1. The system generates a unique beacon for the customer at regular intervals, which encrypts the user's identity to hide the user's identity and prevent the user from being tracked by links;

[0042] S1.2. When contact occurs between users, the user's beacon is broadcasted using Bluetooth to collect the beacons of the people who have contact with the user;

[0043] S1.3. Generate a fuzzy location for the address where the user makes contact, obtain the distance to the contact person, and obtain contact information of the current contact information.

[0044] The client generates a random ID using a timestamp and a unique UID (identifier) ​​distributed by a government agency, and generates a fuzzy location. The H3 geospatial index system is a discrete global grid system consisting of multi-precision hexagonal spherical tilings with a hierarchical index. A hexagonal grid system is created on the plane of a spherical circumscribed icosahedron, and the grid cells are then projected onto the surface of the sphere using a reverse-centered polyhedron structure projection.

[0045] Here, the message digest value of the geographic location information after H3 is selected to replace the GPS latitude and longitude coordinates to prevent information leakage: Location = SHA256 (H3 (Coordinates).

[0046] S1.4. Form a contact flow data time series based on the contact information at each time point.

[0047] Step 2: The server uses the key transfer key to encrypt and transmit the public key, and the client uses the public key to encrypt the contact flow data time series and send it to the server.

[0048] S2.1. The client and server use the improved DH algorithm to exchange their respective secrets based on the secret K of both parties. A , K B Generate a key delivery key K.

[0049] The client obtains the corresponding secret x A ,calculate Send the following content to the client: K a ,[RPI,args=(a,q,Y A ),n,Hash(args||UID||n)];

[0050] Among them, Hash(args||UID||n) is the hash value of the parameters and random numbers, which is used to verify the hash values ​​of the parameters and random numbers;

[0051] The server generates a secret value x B ,calculate

[0052] The server sends the following to the client: B ,E(K b ,n+1)], where E(K b ,n+1) is the ciphertext encrypted using AES, with the key K b , the content is a random number n+1;

[0053] The client calculates the shared secret The server calculates the shared key

[0054] Generate secondary key K B The server uses the generation function generate to generate the secondary key K based on the RPI and the shared key K b .

[0055] S2.2, the server unilaterally generates public and private key information and elliptic curve parameters, the server uses the key transfer key to encrypt the public key and send it to the client, and the client uses the key transfer key K to decrypt and obtain the public key. After that, the communication between the two parties is: the client uses the public key to encrypt and send it to the server, and the server uses the private key to decrypt and obtain information.

[0056] S2.3, RPI generation: Use the customer UID and the current time as the random number, use the Mersenne algorithm to generate K1 and K2, concatenate the two to get the K used for AES encryption, and combine the user UID to generate RPI;

[0057] S2.4, perform RPI verification, verify whether the RPI generated by the random number of 10 adjacent moments is valid, and the verification rule is to match it with the uid table in the database, and the verification is successful if the match is successful. (For the uid table, there is no mapping relationship between the uid and its data, and there is no risk of privacy leakage after being stolen). The UID verification method has been used throughout the entire encryption process.

[0058] Step 3: According to the mutation of the contact flow data time series at the time switching node, determine the normal contact flow data time series, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, train the comparison model, and determine the normal contact flow data time series based on the trained comparison model.

[0059] The contact flow data time series rarely changes suddenly outside the off-peak and low-peak switching process. Whenever the contact flow data time series changes suddenly outside the switching process, it indicates that an abnormal phenomenon may have occurred. Therefore, the following information is extracted from the collected contact flow data time series to verify whether the above contact flow data time series is abnormal:

[0060] S3.1. Grouping the contact flow data at a specified time in the contact flow data time series according to user habits to obtain a plurality of contact flow data groups.

[0061] 1. X I represents the time series of contact flow data on weekdays, and T is the period of the time series of contact flow data; that is, T is the minimum interval for the general pattern to repeat. In this embodiment, T is set to 24 hours. The present invention uses {X[t1+1-δ,t1+ω-δ]|δ∈Δ}, where ω is the inspection window size and Δ contains a set of time intervals, including 1T, 2T, 7T, 14T, etc.

[0062] For example, if the contact flow data time series collected is Wednesday, the data collected on Monday and Tuesday (1T, 2T) show the latest pattern, and the data collected from the past Wednesday (7T, 14T, ...) reflects the weekly pattern that may be caused by weekly personal habits; in the case of an exception, such as Tuesday, the 2T in Δ will be discarded because then {X[t1+1-2T,t1+ω-2T]} represents the time series of Sunday. Collect these contact flow data time series and represent them as X I .

[0063] 2. X OIt is represented as the weekend contact flow data time series. We still use {X[t1+1-δ,t1+ω-δ]|δ∈Δ′}, but the difference is that Δ′ includes 1T, 7T, 14T, etc., because there are only two days on the weekend. Collect these contact flow data time series and represent them as X O .

[0064] 3. X H It is represented as the time series of contact flow data during the short holiday. It still uses {X[t1+1-δ,t1+ω-δ]|δ∈Δ″}, but the difference is that Δ″ includes 1T, 2T, θT, etc., the processing method is the same, where θ and To be determined by the administrator, retroactive to the last short holiday of the same length.

[0065] S3.2. Use noise injection to inject noise of different intensities into each contact flow data group, so that each contact flow data forms a pseudo-labeled flow time series.

[0066] To train the contrastive learning model, it is first necessary to collect a labeled training set containing time series pairs of similar and dissimilar contact flow data. Manually labeling a large amount of training data is costly and time-consuming, and is not practical. Self-supervision is a suitable tool to solve this problem by creating customized pseudo-labels as supervision and learning data representation. Therefore, the present invention uses a novel data augmentation method to use pre-modified time series of contact flow data and generate sufficient data with dissimilar and similar labels for training the contrastive learning model.

[0067] The noise intensity N is defined as the difference between the data at a specific time point and the data at the same time point in other periods. The overall noise intensity of a time series is the average noise intensity at each specific time point, as shown in the following formula.

[0068] N X,i =std(X i ,X i+T ,X i+2T ,...)

[0069]

[0070] In the formula, std(·) represents the standard deviation function, N X represents the noise intensity of the time series X of the contact flow data. For each X, we get an N X . The time series of contact flow data are divided into k categories according to their N. The noise intensity of the time series of contact flow data means the judgment threshold of its anomaly detection. The present invention establishes a data set and trains a contrastive learning model for each noise intensity category. See Appendix Figure 2.

[0071] The noise pattern injection method includes several modules, each of which injects a fault mode. The present invention summarizes five modules of noise pattern injection, namely, level transition noise, Gaussian noise, transient noise, ramp change noise and steady-state change noise. Their pattern examples can be found in Figure 2 These modules are not mutually exclusive, and the present invention utilizes multiple of them on a time series of contact flow data. The intensity of the noise pattern injection is randomly generated, aiming to cover the range from the mildest to the strongest noise intensity.

[0072] S3.3. Use the pseudo-labeled traffic time series as a training set, and adopt a self-supervised method to train the training comparison learning model to obtain a comparison model. Use the traffic data uploaded by the user to generate a contact traffic data time series, which is input into the comparison model. The comparison model outputs the anomaly detection result of the contact traffic data time series.

[0073] Training the comparison model, as described above, given the time series of processed contact flow data, the next step is to check X and X I , X O or X H If X does not follow from X I , X O or X H The inferred pattern determines that the time series X of the contact flow data is abnormal.

[0074] A contrastive learning model is constructed using long short-term memory (LSTM) as a feature extractor and a twin network architecture as a comparator.

[0075] In the above contrastive learning model design, for a single LSTM network, it converts the previous hidden state Passed to the next step in the sequence. The hidden state acts as the memory of the neural network, holding information about previous data that the network has seen before. Information is passed through the gates to the cell state Relative information is transmitted along the sequence chain through these gates. Gates are different neural networks that learn what information will be retained or forgotten on the cell state during training. There are three types of gates: input gate, forget gate and output gate (input gate is usually represented by the symbol "i"; forget gate is usually represented by the symbol "f"; output gate is usually represented by the symbol "o").

[0076] The recursive memory array formula for the three gates is as follows:

[0077] f t =σ(W f *[Ht-1 , x t ]+b f )

[0078] i t =σ(W i *[H t-1 , x t ]+b i )

[0079] C′ t =tanh(W C *[H t-1 , x t ]+b C )

[0080] C t =f t *C t-1 +i t *C′ t

[0081] o t =σ(W o *[H t-1 , x t ]+b o )

[0082] H t =o t *ttanh(C t )

[0083] Among them, the mathematical definition of tanh function is as follows:

[0084]

[0085] Generate a contrast function:

[0086]

[0087] The output of the feature extractor is fed into a fully connected module, encoded, and converted into an expression for comparable distances. During the training phase, the output of the fully connected layer is sent to (*); while during the test phase, the distance between two input samples is obtained by simple subtraction, i.e.:

[0088]

[0089] where ψ(F,·,·) is the distance function with the neural network setting F.

[0090] Perform anomaly detection:

[0091] The contact flow data time series is generated based on the contact flow data and input into the comparison model for anomaly detection.

[0092] Each input contact flow data time series is classified into a specific noise intensity category according to its historical characteristics, and X and X are generated using previous data. I , X O or X H In this paper, the pre-trained C model of the noise intensity category is used to obtain their distance prediction. I , X O or X H The present invention will obtain a series of (by For example), the present invention uses the following to obtain the final result of the example function:

[0093]

[0094] The present invention uses the minimum function based on the following observation: some historical data may contain anomalies; therefore, if X' is similar to one of its current time series segments, it is considered normal. If pred is greater than a pre-set threshold, the contact flow data time series is anomaly.

[0095] Step 4: Construct a traceability graph based on the normal contact traffic data time series. The nodes represent user information, and the edges between nodes represent the contact information between users. The multi-hop connections between nodes are aggregated using an iterative aggregation method to obtain a contact knowledge graph of direct and indirect contact. Based on the contact knowledge graph, all users' contact information is obtained as training data. The prediction model is trained based on the training data, and the trained model outputs the user's infection probability.

[0096] There are two types of users: infected users, uninfected users, or recovered users. The following is a detailed description of the construction process of the contact knowledge graph, including the following processes:

[0097] S4.1. Construct a traceability diagram based on the normal contact flow data time series.

[0098] A traceability graph was constructed based on the normal time series of contact traffic data. The purpose was to fully represent the virus transmission link and the user contact situation in this process on the traceability graph. The graph was screened and composed based on the temporal behavior of contact events, and the new positive patients in the time window were used as the core to trace back and extend, successfully screening out suspicious transmission chains from a large amount of complex information.

[0099] S4.2. Users are used to represent nodes in the traceability graph. The edges between two nodes represent the distance between users. Samples are taken from neighbor nodes. The number of neighbor nodes is dynamically adjusted through sampling strategies. GraphSAGE is used to iteratively aggregate neighbor nodes, construct hidden links between nodes, and trace the contact source in reverse order to obtain the user's direct and indirect contact knowledge graph.

[0100] The nodes are divided into two categories, namely positive patients, recovered patients or uninfected people. The number of positive days a and the number of recovered days b are processed by the function as the weight of this dimension, and the uninfected people will be given a sufficiently large value in this dimension. Then this work labels each node:

[0101]

[0102] The graph is represented as G = {V, E}, where E = {t, p, b}, where t is the contact duration, p is the interaction strength, and b is the Bluetooth power. GraphSAGE is used to perform tensor decomposition on the edge information contained in entities such as a, b, and c.

[0103] Node feature aggregation: After the neighbor nodes are sampled, GraphSAGE is used to aggregate the single-hop features of these neighbor nodes. The aggregation method is defined here as simple averaging, maximization, etc. of the features of the neighbor nodes, and more complex aggregation functions are used, such as using neural networks for feature aggregation.

[0104] Node representation learning: By sampling neighbor nodes and aggregating features, GraphSAGE can learn the representation of each node. These node representations can be used for tasks such as node classification, link prediction, and graph representation.

[0105] The iterative aggregation process is as follows:

[0106] For user h, GNN is used to integrate multi-hop paths into the representation and recursively model high-order information by propagating and aggregating information from neighbors:

[0107]

[0108] Update the representation using GraphSAGE, where A||B represents the join operator between two vectors, and W (l) is the transformation matrix of layer l.

[0109]

[0110] S4.3. According to the contact knowledge graph, all users' contact information is obtained as training data, and the prediction model is trained according to the training data. The trained model outputs the user's infection probability.

[0111] First, we obtain the contact information of all users, including normal users and infected users, based on the contact knowledge graph and use it as the training set. We hide 40% of the infected users as the test set and maximize the target probability prediction function. The purpose is to train the model to identify the hidden infected users given the interaction information between users.

[0112] Then, the information used for training was input, and the probability prediction threshold was set to 0.85. When the probability of successful prediction was higher than 95%, the model training was considered to be completed.

[0113] The user's contact flow data time series is input into the trained prediction model to obtain the user's infection probability.

[0114] Correspondingly, this application also provides an infectious disease source tracing warning method based on privacy protection and anti-attack, including:

[0115] A collection module, used to collect the user's contact flow data time series;

[0116] The contact flow data time series includes contact information of users along the time axis;

[0117] An encryption module, which is used for the server to encrypt and transmit the public key using the key transfer key, and the client to encrypt the contact flow data time series using the public key and send it to the server;

[0118] The abnormal data diagnosis module is used to determine the normal contact flow data time series according to the mutation of the contact flow data time series at the time switching node, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, and train the comparison model, and determine the normal contact flow data time series according to the trained comparison model;

[0119] The prediction module is used to construct a traceability graph based on the normal contact flow data time series, and use the iterative aggregation method to aggregate the multi-hop connections between the nodes in the traceability graph to obtain the contact knowledge graph of direct contact and indirect contact. According to the contact knowledge graph, the contact information of all users is obtained as training data, and the prediction model is trained according to the training data. The trained model outputs the user's infection probability.

[0120] The infectious disease source tracing and early warning method based on privacy protection and anti-attack has the following advantages:

[0121] In the collection module, the client does not need to register its own personal privacy information to obtain the beacon (RPI) used. The system will periodically generate a unique contact beacon for the client to hide the user's identity and prevent the user from being linked and tracked. When there is contact between users, the system will use Bluetooth to broadcast the user's beacon and collect the beacons of close contacts, and save important information and additional data locally. At the same time, the client will use the timestamp and the unique UID distributed by the government agency to generate a random ID, and generate a fuzzy location based on UberH3 and sha256.

[0122] A hybrid encryption module based on Diff-Hellman key exchange-AES+SM2. In this module, the client and server first use the improved DH algorithm to exchange the AES encryption key K; then the server generates elliptic curve parameters and generates public and private keys according to the SM2 algorithm. The server uses K as the encryption key and AES as the encryption algorithm, and passes the SM2 parameters and public key information to the client; finally, the client uses the SM2 algorithm to encrypt the data information and upload it to the server.

[0123] Abnormal data diagnosis module, in this module, the data uploaded by the client is processed by a self-supervised anomaly detection method based on traffic analysis. This method uses traffic characteristics to detect data without decrypting the data, thereby achieving fast and efficient detection of uploaded data. After anomaly detection, the abnormal data information is eliminated.

[0124] Prediction module,First, decrypt the uid of the screened infected person, then the server builds a contact event graph with the infected person as the core according to the uid of the infected person, and traces the uid of the possible infected person to predict the location where a large-scale infection may occur.

[0125] It should be noted that in the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each module is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules can be combined or integrated into another device, or some features can be ignored or not executed. The module described as a separate component may or may not be physically separated. The component displayed as a module may be a physical unit or multiple physical units, that is, it may be located in one place, or it may be distributed in multiple different places. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0126] In addition, each module in each embodiment of the present invention may be integrated into a processing unit, each module may exist physically separately, or two or more modules may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit.

[0127] An electronic device provided in an embodiment of the present application includes a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, the steps of the infectious disease tracing and early warning method based on privacy protection and anti-attack are implemented as described in any of the above embodiments.

[0128] Another electronic device provided in the embodiment of the present application may also include: an input port connected to the processor, used to transmit multimodal data collected by an external acquisition device to the processor; and a display unit connected to the processor, used to display the processing results of the processor to the outside world; a communication module connected to the processor, used to realize communication between the electronic device and the outside world. The display unit can be a display panel, a laser scanning display, etc.; the communication mode adopted by the communication module includes but is not limited to mobile high-definition link technology (HML), universal serial bus (USB), high-definition multimedia interface (HDMI), wireless connection (including wireless fidelity technology (WiFi), Bluetooth communication technology, low-power Bluetooth communication technology, and communication technology based on IEEE802.11s).

[0129] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the infectious disease tracing and early warning method based on privacy protection and anti-attack are implemented as described in any of the above embodiments.

[0130] The computer-readable storage medium involved in the present application includes random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the technical field.

[0131] For the description of the relevant parts of the infectious disease source tracing warning system based on privacy protection and anti-attack, the electronic device, and the computer-readable storage medium provided in the embodiments of the present application, please refer to the detailed description of the corresponding parts of the infectious disease source tracing warning method based on privacy protection and anti-attack provided in the embodiments of the present application, which will not be repeated here. In addition, the parts of the above-mentioned technical solutions provided in the embodiments of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive elaboration.

[0132] The above contents are only for explaining the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A method for tracing and warning the source of infectious diseases based on privacy protection and anti-attack, characterized in that: The following steps are involved: Step 1: Collect the user's contact flow data time series; The contact flow data time series includes contact information of users along the time axis; Step 2: The server uses the key transfer key to encrypt and transmit the public key, and the client uses the public key to encrypt the contact flow data time series and send it to the server; Step 3: According to the mutation of the contact flow data time series at the time switching node, determine the normal contact flow data time series, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, train the comparison model, and determine the normal contact flow data time series according to the trained comparison model; Step 4: Construct a traceability graph based on the normal contact flow data time series, and use the iterative aggregation method to aggregate the multi-hop connections between the nodes in the traceability graph to obtain the contact knowledge graph of direct contact and indirect contact. According to the contact knowledge graph, obtain all users' contact information as training data, train the prediction model based on the training data, and the trained model outputs the user's infection probability.

2. According to claim 1, a privacy protection and anti-attack infectious disease source tracing early warning method is characterized in that: The time series of user contact flow data collected in step 1 includes: When contact occurs between users, the user's beacon is broadcast, the beacons and distances of the people who have contact with the user are collected, and a fuzzy location is generated for the address where the contact occurred to obtain the contact information of the contact behavior. A contact flow data time series is formed based on the contact information at each time point.

3. According to claim 1, a privacy protection and anti-attack infectious disease source tracing early warning method is characterized in that: In step 2, a unique beacon is generated for the user to hide the user's identity and prevent the user from being tracked by the link.

4. According to claim 1, a privacy protection and anti-attack infectious disease source tracing early warning method is characterized in that: In step 3, according to the mutation of the contact flow data time series at the time switching node, it is determined that the normal contact flow data time series includes: Determine the non-peak and low-peak periods of the contact flow data time series, and use the non-peak and low-peak periods as flow switching nodes. When the contact flow data time series mutates outside the switching node, the contact flow data at that moment is abnormal data.

5. According to claim 4, a privacy protection and anti-attack infectious disease source tracing early warning method is characterized in that: In step 3, the normal contact flow data time series are grouped according to the set time to obtain multiple contact flow data groups. Noise of different intensities is injected into each contact flow data group by noise injection, so that each contact flow data forms a pseudo-labeled flow time series, which is used as a training data set to train the comparison model.

6. According to claim 1, a privacy protection and anti-attack infectious disease source tracing early warning method is characterized in that: In step 4, the nodes in the traceability graph represent user information, and the edges between the nodes represent the information of contact between users, and the status of the user is labeled as infected user or uninfected user; The number of neighbor nodes is dynamically adjusted through sampling strategies, and GraphSAGE is used to iteratively aggregate neighbor nodes, and logical relationships are used to mine the contact objects with the greatest contact risk and potential infected persons; Get the contact knowledge graph of the user's direct and indirect contacts.

7. According to claim 1, a privacy protection and anti-attack infectious disease source tracing early warning method is characterized in that: In step 2, the client and server use the improved DH algorithm to exchange their respective secrets and generate a key transfer key K based on the secrets of both parties; the server uses the key transfer key to encrypt the public key and sends it to the client, and the client uses the key transfer key K to decrypt and obtain the public key. The public key is used to encrypt data, and the private key is used for decryption.

8. An infectious disease source tracing and early warning system based on privacy protection and anti-attack, characterized in that: include: A collection module, used to collect the user's contact flow data time series; The contact flow data time series includes contact information of users along the time axis; An encryption module, which is used for the server to encrypt and transmit the public key using the key transfer key, and the client to encrypt the contact flow data time series using the public key and send it to the server; The abnormal data diagnosis module is used to determine the normal contact flow data time series according to the mutation of the contact flow data time series at the time switching node, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, and train the comparison model, and determine the normal contact flow data time series according to the trained comparison model; The prediction module is used to construct a traceability graph based on the normal contact flow data time series, and use the iterative aggregation method to aggregate the multi-hop connections between the nodes in the traceability graph to obtain the contact knowledge graph of direct contact and indirect contact. According to the contact knowledge graph, the contact information of all users is obtained as training data, and the prediction model is trained according to the training data. The trained model outputs the user's infection probability.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor is used to implement the steps of the infectious disease source tracing and early warning method based on privacy protection and anti-attack as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the infectious disease source tracing and early warning method based on privacy protection and anti-attack as described in any one of claims 1 to 7.

Images