Infectious disease source tracing and early warning method and system based on privacy protection and anti-attack

Abstract

The present invention discloses a method and system for tracing and warning the source of infectious diseases based on privacy protection and anti-attack, which belongs to the field of information protection and attack detection. The method collects a user's contact flow data time series; determines a normal contact flow data time series based on the mutation of the contact flow data time series at a time switching node, injects noise into the normal contact flow data time series to form a pseudo-labeled flow time series, and trains a comparison model. The normal contact flow data time series is determined based on the trained comparison model; constructs a traceability graph based on the normal contact flow data time series, and adopts an iterative aggregation method to aggregate the multi-hop connections between the nodes in the traceability graph to obtain a contact knowledge graph of direct contact and indirect contact. According to the contact knowledge graph, all users' contact information is obtained as training data, and a prediction model is trained based on the training data. The trained model outputs the user's infection probability.

Description

Technical Field

[0001] The present invention relates to the fields of information protection and attack detection, and specifically to an infectious disease source tracing and early warning method and system based on privacy protection and anti-attack. Background Art

[0002] Highly pathogenic infectious diseases refer to those diseases that can cause serious health problems, have highly active viruses that are easily contagious, and endanger public health and safety. Some of these viruses are extremely diffusible, targeted, and latent, and are currently one of the most serious threats to public health and safety.

[0003] While countries have implemented control measures and infection chain tracing programs for infectious diseases, none of them are able to collect sufficiently accurate data for analysis in the early stages of an outbreak. Consequently, they lack the ability to trace the source of infectious viruses and provide predictive warnings to curb their spread. Highly pathogenic infectious diseases are primarily transmitted through the respiratory tract, through droplet, contact, and aerosol transmission. Effectively tracing the spread of a virus requires a thorough understanding of the infection chain—observing and testing individuals who have come into contact with the patient to determine if they are infected. Identifying and controlling infection chains is a crucial infectious disease control measure, serving as both a core method for tracing viral transmission pathways and an effective tool for mitigating the epidemic as epidemic prevention and control measures become more common. However, currently, these systems can only track patient movements to a certain extent, but are unable to fully analyze the outbreak or provide users with information on potential future developments. Consequently, the critical information collected is not widely used.

[0004] Contact tracing alone is not enough to fundamentally prevent and control highly pathogenic infectious diseases. It is also necessary to construct a traceability map corresponding to the infection contact events generated by specific virus sources, which can conduct in-depth analysis and early prediction of the virus transmission path, and realize the proactive prevention and control of highly pathogenic infectious diseases. More importantly, the personal privacy of users must be protected in this process, and the epidemic infection chain must be analyzed under the premise of sufficient security. In summary, the ability to achieve "high security", "strong defense" and "accurate traceability" are the core requirements for realizing a traceability tracking system for highly pathogenic infectious diseases, which is of great significance to protecting life and health, public health and personal privacy. Summary of the Invention

[0005] The purpose of the present invention is to address the problems in the above-mentioned existing technologies such as complex information collection, possible mixed attacks in uploaded data, low analysis efficiency, and difficulty in analyzing the infection chain. It provides an infectious disease traceability and early warning method based on privacy protection and anti-attack, which can effectively collect contact information, actively detect attacks, and efficiently analyze the infection chain.

[0006] The present invention is achieved through the following technical solutions:

[0007] In the first aspect, the present application provides an infectious disease source tracing and early warning method based on privacy protection and anti-attack, comprising the following steps:

[0008] Step 1: Collect the user's contact flow data time series;

[0009] The contact flow data time series includes contact information of users along the time axis;

[0010] Step 2: The server uses the key transfer key to encrypt and transmit the public key. The client uses the public key to encrypt the contact flow data time series and send it to the server.

[0011] Step 3: According to the mutation of the contact flow data time series at the time switching node, determine the normal contact flow data time series, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, and train the comparison model. Determine the normal contact flow data time series based on the trained comparison model;

[0012] Step 4: Construct a traceability graph based on the normal contact traffic data time series. Use the iterative aggregation method to aggregate the multi-hop connections between the nodes in the traceability graph to obtain a contact knowledge graph of direct and indirect contact. Based on the contact knowledge graph, obtain all users' contact information as training data. Train the prediction model based on the training data, and the trained model outputs the user's infection probability.

[0013] Preferably, collecting the user's contact flow data time series in step 1 includes:

[0014] When contact occurs between users, the user's beacon is broadcast, the beacons and distances of the people who have contact with the user are collected, and a fuzzy location is generated for the address where the contact occurred to obtain the contact information of the contact behavior. A contact flow data time series is formed based on the contact information at each time point.

[0015] Preferably, in step 2, a unique beacon is generated for the user to hide the user's identity and prevent the user from being tracked by links.

[0016] Preferably, in step 3, determining a normal contact flow data time series according to a sudden change of the contact flow data time series at a time switching node includes:

[0017] Determine the off-peak and low-peak periods of the contact flow data time series, and use the off-peak and low-peak periods as flow switching nodes. When the contact flow data time series mutates outside the switching node, the contact flow data at that moment is abnormal data.

[0018] Preferably, in step 3, the normal contact flow data time series are grouped according to the set time to obtain multiple contact flow data groups, and noise of different intensities is injected into each contact flow data group by noise injection, so that each contact flow data forms a pseudo-labeled flow time series, which is used as a training data set to train the comparison model.

[0019] Preferably, the nodes in the traceability graph in step 4 represent user information, the edges between the nodes represent information about contact between users, and the user status is labeled as infected or uninfected.

[0020] The number of neighbor nodes is dynamically adjusted through sampling strategies, and GraphSAGE is used to iteratively aggregate neighbor nodes. Logical relationships are used to mine the contact objects with the greatest contact risk and potential infected persons; a contact knowledge graph of the user's direct and indirect contacts is obtained.

[0021] Preferably, in step 2, the client and the server use a modified DH algorithm to exchange their respective secrets and generate a key transfer key K based on the secrets of both parties; the server uses the key transfer key to encrypt the public key and sends it to the client, and the client uses the key transfer key K to decrypt and obtain the public key. The public key is used to encrypt data and the private key is used for decryption.

[0022] Secondly, this application provides an infectious disease traceability and early warning system based on privacy protection and anti-attack, including:

[0023] The collection module is used to collect the user's contact flow data time series;

[0024] The contact flow data time series includes contact information of users along the time axis;

[0025] The encryption module is used for the server to encrypt and transmit the public key using the key transfer key, and the client to encrypt the contact flow data time series using the public key and send it to the server;

[0026] The abnormal data diagnosis module is used to determine the normal contact flow data time series based on the mutation of the contact flow data time series at the time switching node, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, and train the comparison model to determine the normal contact flow data time series based on the trained comparison model;

[0027] The prediction module is used to construct a traceability graph based on the normal contact flow data time series, and use the iterative aggregation method to aggregate the multi-hop connections between the nodes in the traceability graph to obtain a contact knowledge graph of direct and indirect contact. Based on the contact knowledge graph, the contact information of all users is obtained as training data, and the prediction model is trained based on the training data. The trained model outputs the user's infection probability.

[0028] In a second aspect, the present application provides an electronic device, comprising:

[0029] memory for storing computer programs;

[0030] A processor is used to implement the steps of the infectious disease traceability and early warning method based on privacy protection and anti-attack when executing the computer program.

[0031] In a fourth aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the infectious disease traceability and early warning method based on privacy protection and anti-attack.

[0032] Compared with the prior art, the present invention has the following beneficial technical effects:

[0033] The infectious disease source tracing and early warning method based on privacy protection and anti-attack provided in this application adopts a self-supervised anomaly detection method based on traffic analysis for processing. This method uses traffic characteristics to detect data, and does not require decryption of the data, thereby achieving fast and efficient detection of uploaded data. After anomaly detection, the abnormal data information is eliminated; the traceability graph is constructed according to the normal contact traffic data time series, and the multi-hop connections between the nodes in the traceability graph are aggregated using an iterative aggregation method to obtain a contact knowledge graph of direct and indirect contact. According to the contact knowledge graph, the contact information of all users is obtained as training data, and the prediction model is trained according to the training data. The trained model outputs the infection probability of the user, abstracts a reasonable data structure for the contact event, and improves the speed and accuracy of analyzing the infection chain. The present invention uses GraphSAGE to integrate the interactive information of events on the contact graph and perform forward and reverse prediction checks, and the use effect is significant.

[0034] Furthermore, by optimizing the extraction and verification methods of private data, we can avoid replay attacks and wormhole attacks. A fast and efficient time series anomaly detection and data verification method based on self-supervision. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a flow chart of the infectious disease source tracing and early warning method based on privacy protection and anti-attack of the present invention;

[0036] Figure 2 This is a structural diagram of the noise module of the abnormality monitoring solution of the present invention;

[0037] Figure 3 Schematic diagram of the source tracing prediction method of the present invention. DETAILED DESCRIPTION

[0038] The present invention will be further described in detail below with reference to the accompanying drawings, which are intended to explain rather than limit the present invention.

[0039] See Figure 1 A privacy-preserving and anti-attack infectious disease source tracing and early warning method is proposed. The method consists of four stages: generating and collecting contact information, encrypting and protecting the information uploaded to the server, anomaly detection, building a contact map, and tracing the source. The specific implementation method is as follows:

[0040] Step 1: Collect the user's contact flow data time series;

[0041] S1.1. The system periodically generates a unique beacon for each customer, which encrypts the user's identity to hide the user's identity and prevent the user from being tracked by links.

[0042] S1.2. When a user comes into contact with another user, the user's beacon is broadcast via Bluetooth, and the beacons of the people who have come into contact with the user are collected;

[0043] S1.3. Generate a fuzzy location for the address where the user makes contact, obtain the distance to the contact person, and obtain contact information of the current contact information.

[0044] The client generates a random ID using a timestamp and a unique UID (identifier) ​​issued by a government agency, and generates a fuzzy location. The H3 geospatial index system is a discrete global grid system consisting of multi-precision hexagonal spherical tilings with a hierarchical index. A hexagonal grid system is created on the plane of a spherical circumscribed icosahedron, and the grid cells are then projected onto the surface of the sphere using a polyhedron structure projection centered on the opposite surface.

[0045] Here, the message digest value of the geographic location information after H3 is selected to replace the GPS latitude and longitude coordinates to prevent information leakage: Location = SHA256 (H3 (Coordinates)).

[0046] S1.4. Form a contact flow data time series based on the contact information at each time point.

[0047] Step 2: The server uses the key transfer key to encrypt the public key for transmission, and the client uses the public key to encrypt the contact flow data time series and send it to the server.

[0048] S2.1, the client and server use the improved DH algorithm to exchange their respective secrets, based on the secret K of both parties A , K B Generate the key delivery key K.

[0049] The client obtains the corresponding secret x A ,calculate Send the following content to the client: K a ,[RPI,args=(a,q,Y A ),n,Hash(args||UID||n)];

[0050] Among them, Hash(args||UID||n) is the hash value of the parameters and random numbers, which is used to verify the hash values ​​of the parameters and random numbers;

[0051] The server generates a secret value x B ,calculate

[0052] The server sends the following to the client: B ,E(K b ,n+1)], where E(K b ,n+1) is the ciphertext encrypted using AES, with the key K b , the content is random number n+1;

[0053] The client calculates the shared secret key The server calculates the shared secret key

[0054] Generate secondary key K B The server uses the generation function generate to generate the secondary key K based on RPI and shared key K b .

[0055] S2.2. The server unilaterally generates public and private key information and elliptic curve parameters. The server encrypts the public key using the key transfer key and sends it to the client. The client decrypts the public key using the key transfer key K. All subsequent communications between the two parties are as follows: the client encrypts using the public key and sends it to the server, and the server decrypts using the private key to obtain the information.

[0056] S2.3, RPI generation: Using the customer UID and the current time as a random number, the Mersenne algorithm is used to generate K1 and K2. The two are concatenated to obtain K for AES encryption, which is then combined with the user UID to generate the RPI;

[0057] S2.4. RPI verification verifies the validity of the RPIs generated by the random numbers at 10 consecutive moments. The verification rule is to match the RPIs with the UID table in the database. A successful match indicates verification. (The UID table has no mapping relationship with the data, so there is no risk of privacy leakage if it is stolen.) UID verification is used throughout the encryption process.

[0058] Step 3: Determine the normal contact flow data time series based on the mutation of the contact flow data time series at the time switching node, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, and train the comparison model. Determine the normal contact flow data time series based on the trained comparison model.

[0059] The contact flow data time series rarely changes suddenly outside of the off-peak and low-peak switching process. Whenever the contact flow data time series changes suddenly outside of the switching process, it indicates that an abnormal phenomenon may have occurred. Therefore, the following information is extracted from the collected contact flow data time series to verify whether the above contact flow data time series is abnormal:

[0060] S3.1. Grouping the contact flow data at a specified time in the contact flow data time series according to user habits to obtain multiple contact flow data groups.

[0061] 1. X I represents the time series of contact flow data for weekdays, and T is the period of the contact flow data time series; that is, T is the minimum interval for a general pattern to repeat. In this embodiment, T is set to 24 hours. The present invention uses {X[t1+1-δ,t1+ω-δ]|δ∈Δ}, where ω is the inspection window size and Δ encompasses a set of time intervals, including 1T, 2T, 7T, 14T, and so on.

[0062] For example, if the contact flow data time series collected is Wednesday, the data collected on Monday and Tuesday (1T, 2T) show the latest pattern, and the data collected from the past Wednesday (7T, 14T, ...) reflects the weekly pattern that may be caused by personal habits every week; in the exception case, such as Tuesday, the 2T in Δ will be discarded because then {X[t1+1-2T,t1+ω-2T]} represents the time series of Sunday. Collect these time series of contact flow data and represent them as X I .

[0063] 2. X OIt is represented as the weekend contact flow data time series. We still use {X[t1+1-δ,t1+ω-δ]|δ∈Δ′}, but the difference is that Δ′ includes 1T, 7T, 14T, etc., because there are only two days on the weekend. Collect these contact flow data time series and represent them as X O .

[0064] 3. X H It is represented as the time series of contact traffic data during the long holiday. It still uses {X[t1+1-δ,t1+ω-δ]|δ∈Δ″}, but the difference is that Δ″ includes 1T, 2T, θT, etc., the same processing method is used, where θ and It is decided by the administrator and is retroactive to the last short holiday of the same length.

[0065] S3.2. Use noise injection to inject noise of different intensities into each contact flow data group, so that each contact flow data forms a pseudo-labeled flow time series.

[0066] Training a contrastive learning model first requires collecting a labeled training set containing time series pairs of similar and dissimilar contact flow data. Manually labeling large amounts of training data is costly and time-consuming, making it impractical. Self-supervision is a suitable tool for addressing this problem, creating custom pseudo-labels as supervision and learning data representations. Therefore, this paper employs a novel data augmentation method, using pre-modified time series of contact flow data to generate sufficient data with dissimilar and similar labels for training the contrastive learning model.

[0067] The noise intensity N is defined as the difference between the data at a specific time point and the data at the same time points in other periods. The overall noise intensity of a time series is the average noise intensity at each specific time point, as shown in the following formula.

[0068] N X,i =std(X i ,X i+T ,X i+2T ,...)

[0069]

[0070] In the formula, std(·) represents the standard deviation function, N X Represents the noise intensity of the time series X of the contact flow data. For each X, we get an N X The time series of contact flow data are divided into k categories according to their N. The noise intensity of the time series of contact flow data means the judgment threshold of its anomaly detection. The present invention establishes a data set and trains a contrastive learning model for each noise intensity category. Figure 2.

[0071] The noise pattern injection method includes several modules, each of which injects a fault mode. The present invention summarizes five modules of noise pattern injection, namely, level transition noise, Gaussian noise, transient noise, ramp change noise and steady-state change noise. Their pattern examples can be found in Figure 2 These modules are not mutually exclusive, and the present invention utilizes multiple of them on a time series of contact flow data. The intensity of the noise pattern injection is randomly generated, aiming to cover the range from the mildest to the strongest noise intensity.

[0072] S3.3. Use the pseudo-labeled traffic time series as a training set, and adopt a self-supervised method to train the comparative learning model to obtain a comparison model. Use the traffic data uploaded by the user to generate a contact traffic data time series, which is input into the comparison model. The comparison model outputs the anomaly detection result of the contact traffic data time series.

[0073] Training the comparison model, as described above, given the time series of processed contact flow data, the next step is to check X and X I 、X O or X H If X does not follow from X I 、X O or X H Based on the inferred pattern, the time series X of the contact flow data is judged to be abnormal.

[0074] A contrastive learning model is constructed using long short-term memory (LSTM) as the feature extractor and a Siamese network architecture as the comparator.

[0075] In the above contrastive learning model design, for a single LSTM network, it converts the previous hidden state Passed to the next step in the sequence. The hidden state acts as the memory of the neural network, holding information about previous data that the network has seen before. Information is passed to the cell state through the gate These gates transmit relative information along the chain of sequences. Gates are different neural networks that learn what information to retain or forget in the cell state during training. There are three types of gates: input gate, forget gate, and output gate (input gate is usually represented by the symbol "i"; forget gate is usually represented by the symbol "f"; output gate is usually represented by the symbol "o").

[0076] The recursive memory array formula for the three gates is as follows:

[0077] f t =σ(W f *[Ht-1 , x t ]+b f )

[0078] i t =σ(W i *[H t-1 , x t ]+b i )

[0079] C′ t =tanh(W C *[H t-1 , x t ]+b C )

[0080] C t =f t *C t-1 +i t *C′ t

[0081] o t =σ(W o *[H t-1 , x t ]+b o )

[0082] H t =o t *tanh(C t )

[0083] Among them, the mathematical definition of tanh function is as follows:

[0084]

[0085] Generate a contrast function:

[0086]

[0087] The output of the feature extractor is fed into a fully connected module, encoded, and converted into an expression for comparable distances. During the training phase, the output of the fully connected layer is sent to (*); while during the testing phase, the distance between the two input samples is obtained by simple subtraction, i.e.:

[0088]

[0089] where ψ(F,·,·) is the distance function with the neural network setting F.

[0090] Perform anomaly detection:

[0091] The contact flow data time series is generated based on the contact flow data and input into the comparison model for anomaly detection.

[0092] Each input contact flow data time series is classified into a specific noise intensity category according to its historical characteristics, and X and X are generated using previous data. I 、X O or X H In this paper, we use the pre-trained C model of noise intensity category to obtain their distance prediction. I 、X O or X H , the present invention will obtain a series of (by For example), the present invention uses the following to obtain the final result of the example function:

[0093]

[0094] The present invention uses the minimum function based on the following observation: some historical data may contain anomalies; therefore, if X' is similar to one of its current time series segments, it is considered normal. If pred is greater than a pre-set threshold, the contact flow data time series is anomaly.

[0095] Step 4: Construct a traceability graph based on the normal contact traffic data time series. The nodes represent user information, and the edges between nodes represent the contact information between users. Use the iterative aggregation method to aggregate the multi-hop connections between nodes to obtain a contact knowledge graph of direct and indirect contact. Based on the contact knowledge graph, obtain the contact information of all users as training data. Train the prediction model based on the training data, and the trained model outputs the user's infection probability.

[0096] There are two types of users: infected users and uninfected users or recovered users. The following is a detailed description of the process of building the contact knowledge graph, which includes the following steps:

[0097] S4.1. Construct a traceability diagram based on the normal contact flow data time series.

[0098] A traceability diagram was constructed based on the normal time series of contact traffic data. The purpose was to fully represent the virus transmission chain and the user contact in this process on the traceability diagram. The diagram was screened and constructed based on the temporal behavior of the contact events, and the new positive patients in the time window were used as the core to trace back and extend. Suspicious transmission chains were successfully screened out from a large amount of complex information.

[0099] S4.2. Users are used to represent nodes in the traceability graph. The edges between two nodes represent the distance between users. We sample neighboring nodes and dynamically adjust the number of neighboring nodes using a sampling strategy. We use GraphSAGE to iteratively aggregate neighboring nodes, construct hidden links between nodes, and reversely trace the source of contact to obtain a contact knowledge graph of the user's direct and indirect contacts.

[0100] Nodes are divided into two categories: positive patients, recovered patients, or uninfected patients. The number of positive days a and recovered days b are processed by a function as the weights of this dimension, while uninfected patients are assigned a sufficiently large value in this dimension. This work then labels each node:

[0101]

[0102] The graph is represented as G = {V, E}, where E = {t, p, b}, where t is the contact duration, p is the interaction intensity, and b is the Bluetooth power. GraphSAGE is used to perform tensor decomposition on the edge information contained in entities such as a, b, and c.

[0103] Node feature aggregation: After neighbor nodes are sampled, GraphSAGE is used to aggregate the single-hop features of these neighbor nodes. Aggregation methods are defined here as simple operations such as averaging and maximizing the features of neighbor nodes. More complex aggregation functions can also be used, such as using neural networks for feature aggregation.

[0104] Node representation learning: By sampling neighboring nodes and aggregating features, GraphSAGE can learn the representation of each node. These node representations can be used for tasks such as node classification, link prediction, and graph representation.

[0105] The iterative aggregation process is as follows:

[0106] For user h, GNN is used to integrate multi-hop paths into the representation and recursively model high-order information by propagating and aggregating information from neighbors:

[0107]

[0108] Use GraphSAGE to update the representation, where A||B represents the connection operator between two vectors, W (l) is the transformation matrix of layer l.

[0109]

[0110] S4.3. Obtain all user contact information as training data based on the contact knowledge graph, train the prediction model based on the training data, and the trained model outputs the user's infection probability.

[0111] First, we obtain contact information for all users, including both healthy and infected users, from the contact knowledge graph. This information is used as the training set, and 40% of the infected users are hidden as the test set. We maximize the target probability prediction function to train the model to identify hidden infected users given the interaction information between users.

[0112] Then, the information used for training was input, and the probability prediction threshold was set to 0.85. When the prediction success probability was higher than 95%, the model training was considered to be complete.

[0113] The user's contact traffic data time series is input into the trained prediction model to obtain the user's infection probability.

[0114] Correspondingly, this application also provides an infectious disease source tracing and early warning method based on privacy protection and anti-attack, including:

[0115] The collection module is used to collect the user's contact flow data time series;

[0116] The contact flow data time series includes contact information of users along the time axis;

[0117] The encryption module is used for the server to encrypt and transmit the public key using the key transfer key, and the client to encrypt the contact flow data time series using the public key and send it to the server;

[0118] The abnormal data diagnosis module is used to determine the normal contact flow data time series based on the mutation of the contact flow data time series at the time switching node, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, and train the comparison model to determine the normal contact flow data time series based on the trained comparison model;

[0119] The prediction module is used to construct a traceability graph based on the normal contact flow data time series, and use the iterative aggregation method to aggregate the multi-hop connections between the nodes in the traceability graph to obtain a contact knowledge graph of direct and indirect contact. Based on the contact knowledge graph, the contact information of all users is obtained as training data, and the prediction model is trained based on the training data. The trained model outputs the user's infection probability.

[0120] The infectious disease source tracing and early warning method based on privacy protection and anti-attack has the following advantages:

[0121] In the collection module, clients do not need to register their personal privacy information to obtain the beacon (RPI) used. The system will periodically generate a unique contact beacon for the client to hide the user's identity and prevent the user from being linked and tracked. When there is contact between users, the system will use Bluetooth to broadcast the user's beacon and collect the beacons of close contacts, and save important information and additional data locally. At the same time, the client will use the timestamp and the unique UID issued by the government agency to generate a random ID, and generate a fuzzy location based on UberH3 and sha256.

[0122] A hybrid encryption module based on Diff-Hellman key exchange - AES+SM2. In this module, the client and server first use the modified DH algorithm to exchange the AES encryption key K; then the server generates elliptic curve parameters and generates public and private keys based on the SM2 algorithm. The server uses K as the encryption key and AES as the encryption algorithm, and passes the SM2 parameters and public key information to the client; finally, the client uses the SM2 algorithm to encrypt the data information and upload it to the server.

[0123] The abnormal data diagnosis module processes client-uploaded data using a self-supervised anomaly detection method based on traffic analysis. This method utilizes traffic characteristics for data detection without requiring data decryption, enabling fast and efficient detection of uploaded data. After anomaly detection, abnormal data is removed.

[0124] The prediction module first decrypts the UID of the screened infected person. Then the server builds a contact event graph with the infected person as the core based on the UID of the infected person, and traces the UID of the possible infected person to predict the location where a large-scale infection may occur.

[0125] It should be noted that in the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of each module is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules can be combined or integrated into another device, or some features can be ignored or not executed. The modules described as separate components may or may not be physically separated. The components displayed as modules may be one physical unit or multiple physical units, that is, they may be located in one place, or they may be distributed in multiple different places. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0126] In addition, the modules in the various embodiments of the present invention may be integrated into a single processing unit, each module may exist physically separately, or two or more modules may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0127] An electronic device provided in an embodiment of the present application includes a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, the steps of the infectious disease tracing and early warning method based on privacy protection and anti-attack are implemented as described in any of the above embodiments.

[0128] Another electronic device provided in an embodiment of the present application may further include: an input port connected to the processor for transmitting multimodal data collected by an external acquisition device to the processor; a display unit connected to the processor for displaying the processing results of the processor to the outside world; and a communication module connected to the processor for enabling communication between the electronic device and the outside world. The display unit may be a display panel, a laser scanning display, etc.; the communication method used by the communication module includes but is not limited to mobile high-definition link technology (HML), universal serial bus (USB), high-definition multimedia interface (HDMI), wireless connection (including wireless fidelity technology (WiFi), Bluetooth communication technology, low-power Bluetooth communication technology, and communication technology based on IEEE802.11s).

[0129] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the infectious disease traceability and early warning method based on privacy protection and anti-attack are implemented as described in any of the above embodiments.

[0130] The computer-readable storage medium involved in this application includes random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the technical field.

[0131] For the description of the relevant parts of the privacy protection and anti-attack infectious disease source tracing and early warning system, electronic device, and computer-readable storage medium provided in the embodiments of the present application, please refer to the detailed description of the corresponding parts of the privacy protection and anti-attack infectious disease source tracing and early warning method provided in the embodiments of the present application, which will not be repeated here. In addition, the parts of the above-mentioned technical solutions provided in the embodiments of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive elaboration.

[0132] The above content is only for explaining the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A privacy protection and anti-attack infectious disease source tracing and early warning method, characterized in that: The following steps are involved: Step 1: Collect the user's contact flow data time series; The contact flow data time series includes contact information of users along the time axis; Step 2: The server uses the key transfer key to encrypt and transmit the public key. The client uses the public key to encrypt the contact flow data time series and send it to the server. Step 3: According to the mutation of the contact flow data time series at the time switching node, determine the normal contact flow data time series, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, and train the comparison model. Determine the normal contact flow data time series based on the trained comparison model; Step 4: Construct a traceability graph based on the normal contact traffic data time series. Use the iterative aggregation method to aggregate the multi-hop connections between the nodes in the traceability graph to obtain a contact knowledge graph of direct and indirect contact. Based on the contact knowledge graph, obtain all users' contact information as training data. Train the prediction model based on the training data, and the trained model outputs the user's infection probability.

2. The infectious disease source tracing and early warning method based on privacy protection and anti-attack according to claim 1 is characterized in that: The time series of user contact flow data collected in step 1 includes: When contact occurs between users, the user's beacon is broadcast, the beacons and distances of the people who have contact with the user are collected, and a fuzzy location is generated for the address where the contact occurred to obtain the contact information of the contact behavior. A contact flow data time series is formed based on the contact information at each time point.

3. The infectious disease source tracing and early warning method based on privacy protection and anti-attack according to claim 1 is characterized in that: In step 2, a unique beacon is generated for the user to hide the user's identity and prevent the user from being tracked by links.

4. The infectious disease source tracing and early warning method based on privacy protection and anti-attack according to claim 1 is characterized in that: In step 3, according to the mutation of the contact flow data time series at the time switching node, it is determined that the normal contact flow data time series includes: Determine the off-peak and low-peak periods of the contact flow data time series, and use the off-peak and low-peak periods as flow switching nodes. When the contact flow data time series mutates outside the switching node, the contact flow data at that moment is abnormal data.

5. The infectious disease source tracing and early warning method based on privacy protection and anti-attack according to claim 4 is characterized in that: In step 3, the normal contact flow data time series are grouped according to the set time to obtain multiple contact flow data groups. Noise injection is used to inject noise of different intensities into each contact flow data group, so that each contact flow data forms a pseudo-labeled flow time series, which is used as a training data set to train the comparison model.

6. The infectious disease source tracing and early warning method based on privacy protection and anti-attack according to claim 1 is characterized in that: In step 4, the nodes in the traceability graph represent user information, and the edges between the nodes represent the contact information between users. The user status is also labeled as infected or uninfected. The number of neighbor nodes is dynamically adjusted through sampling strategies, and GraphSAGE is used to iteratively aggregate neighbor nodes. Logical relationships are used to mine the contact objects with the greatest risk and potential infected persons. Obtain the contact knowledge graph of the user's direct and indirect contacts.

7. The infectious disease source tracing and early warning method based on privacy protection and anti-attack according to claim 1 is characterized in that: In step 2, the client and server use a modified DH algorithm to exchange their respective secrets and generate a key transfer key K based on the secrets of both parties; the server uses the key transfer key to encrypt the public key and sends it to the client, and the client uses the key transfer key K to decrypt and obtain the public key. The public key is used to encrypt data, and the private key is used for decryption.

8. An infectious disease source tracing and early warning system based on privacy protection and anti-attack, characterized by: include: The collection module is used to collect the user's contact flow data time series; The contact flow data time series includes contact information of users along the time axis; The encryption module is used for the server to encrypt and transmit the public key using the key transfer key, and the client to encrypt the contact flow data time series using the public key and send it to the server; The abnormal data diagnosis module is used to determine the normal contact flow data time series based on the mutation of the contact flow data time series at the time switching node, inject noise into the normal contact flow data time series to form a pseudo-labeled flow time series, and train the comparison model to determine the normal contact flow data time series based on the trained comparison model; The prediction module is used to construct a traceability graph based on the normal contact flow data time series, and use the iterative aggregation method to aggregate the multi-hop connections between the nodes in the traceability graph to obtain a contact knowledge graph of direct and indirect contact. Based on the contact knowledge graph, the contact information of all users is obtained as training data, and the prediction model is trained based on the training data. The trained model outputs the user's infection probability.

9. An electronic device, characterized in that: include: memory for storing computer programs; A processor is used to implement the steps of the infectious disease tracing and early warning method based on privacy protection and anti-attack as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the infectious disease traceability and early warning method based on privacy protection and anti-attack as described in any one of claims 1 to 7.

Images