Hospital data safety management system and method

Abstract

The invention provides a hospital data security management system and method, and relates to the technical field of data security management, and the method comprises the steps: accessing an Internet hospital system, and collecting threat detection data in the Internet hospital system; inputting the threat detection data into a pre-trained threat detection model to obtain a threat detection result; and selecting a corresponding response strategy from a preset strategy library according to the threat detection result, and configuring the response strategy. The system has the beneficial effects that the system can obtain the latest security information in time, provides time advantages for subsequent analysis and response, and can complete complex data analysis in a short time, so that the delay of data processing and response is remarkably reduced; and automatically selecting and executing a corresponding response strategy from a preset strategy library. According to the automatic response mechanism, the need of manual intervention is greatly reduced, and the response speed and accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data security management, and in particular to a hospital data security management system and method. Background Art

[0002] With the rapid development of digital medicine, the hospital data security management system has become a key infrastructure to ensure patient information security, maintain the stability of medical order and promote the progress of medical research. The system integrates multiple functions such as data collection, storage, processing, analysis and security protection, aiming to ensure the integrity, confidentiality and availability of various sensitive data within the hospital (such as patient medical records, imaging materials, medical research data, etc.). Through automated and intelligent technical means, the hospital data security management system aims to build an efficient and secure information environment to support the daily operation and long-term development of the hospital.

[0003] Although hospital data security management systems play an important role in ensuring the security of medical data, their limitations are becoming increasingly prominent as technology continues to advance and threats become increasingly complex:

[0004] Data processing and response delays: When faced with large-scale data inflows, existing systems often suffer from data processing and response delays due to insufficient processing capacity, making it impossible to detect and respond to security threats in real time, increasing the risk of data leakage or abuse.

[0005] Single detection and defense means: Security detection mainly relies on predefined rules and simple statistical analysis tools, which makes it difficult to effectively identify and respond to complex and changing network attacks and new security threats, such as zero-day vulnerability attacks and advanced persistent threats (APT).

[0006] High degree of manual dependence: In terms of threat response, the existing system relies heavily on manual operations, which not only has a slow response speed, but may also lead to misjudgment or missed judgments due to human factors. It is difficult to prevent the spread of security incidents in a timely and effective manner, posing a potential threat to hospital operations.

[0007] To sum up, although the hospital data security management system has achieved certain results in ensuring the security of medical data, it still needs continuous innovation and optimization to cope with increasingly severe security challenges. Summary of the invention

[0008] In view of the problems existing in the prior art, the present invention provides a hospital data security management system, comprising:

[0009] A data monitoring module, used to access the Internet hospital system and collect threat detection data in the Internet hospital system;

[0010] A threat detection module, connected to the data monitoring module, for inputting the threat detection data into a pre-trained threat detection model to obtain a threat detection result;

[0011] The threat response module is connected to the threat detection module and is used to select and configure a corresponding response strategy from a preset strategy library according to the threat detection result.

[0012] Preferably, a network traffic collector is included for real-time monitoring of the network communication data of the Internet hospital system as threat detection data, and the threat detection module includes:

[0013] A model building unit, used to use multiple graph convolution layers as a graph convolution module, connect an attention module after the graph convolution module, connect a graph pooling layer after the attention module to obtain an initial model and perform training to obtain a final graph neural network model as the threat detection model;

[0014] A network data detection unit is connected to the model building unit and is used to build a network flow graph according to the network communication data, perform feature extraction on the network communication data to obtain feature vectors as node vectors and edge vectors in the network flow graph, and then input the network flow graph into the threat detection model to obtain the threat detection result.

[0015] Preferably, the training process of the initial model in the model building unit includes:

[0016] The initial model is deployed in multiple devices, and then a distributed training data set is configured in each of the devices. The distributed training data set is input into the initial model in each of the devices for training to obtain a trained model. After all devices are trained, the model parameters of all the trained models are collected, and the final model parameters are obtained according to the model parameters. The model parameters of an untrained initial model are configured as the final model parameters to obtain the graph neural network model.

[0017] Preferably, a data processing module is included, connected to the data monitoring module and the threat detection module, including:

[0018] A data processing unit, used for performing data cleaning on the threat detection data, and then performing format conversion on the threat detection data after data cleaning;

[0019] A distributed storage unit is connected to the data processing unit and is used to divide the threat detection data after format conversion into multiple data packets and store them in multiple network storage nodes respectively. The threat detection module obtains all the data packets from each network storage node and merges them to obtain the threat detection data.

[0020] Preferably, the threat detection model includes a first detection model and a second detection model, and the threat detection module includes:

[0021] a known threat detection unit, configured to input the threat detection data into the first detection model, use the threat type as the threat detection result when it is determined that the detection result of the first detection model includes the threat type, and generate a re-detection signal when it is determined that the detection result of the first detection model does not include the threat type;

[0022] An unknown threat detection unit is connected to the known threat detection unit and is used to input the threat detection data into the second detection model for detection when receiving the re-detection signal, and then use the threat type contained in the detection result of the second detection model as the threat detection result.

[0023] Preferably, the Internet hospital system includes multiple access devices, and multiple threat detection data are collected from each access device, and the response strategy includes a firewall update rule; then the threat response module includes:

[0024] A firewall update unit, configured to match a corresponding response policy from the policy library according to the threat type included in the threat detection result, and then update the current firewall rule to the firewall update rule in the response policy;

[0025] The device isolation unit is used to mark the access device corresponding to the threat detection data corresponding to the threat detection result containing the threat type as an isolated device, and then disconnect each of the isolated devices from the Internet hospital system for isolation.

[0026] The present invention also provides a hospital data security management method, which is applied to the above-mentioned hospital data security management system, comprising:

[0027] Step S1, the hospital data security management system collects threat detection data in the Internet hospital system;

[0028] Step S2, the hospital data security management system inputs the threat detection data into a pre-trained threat detection model to obtain a threat detection result;

[0029] Step S3: the hospital data security management system selects and configures a corresponding response strategy from a preset strategy library according to the threat detection result.

[0030] Preferably, the hospital data security management system includes a network traffic collector for real-time monitoring of network communication data of the Internet hospital system as threat detection data, and step S2 includes:

[0031] Step S21, the hospital data security management system uses multiple graph convolution layers as a graph convolution module, connects an attention module after the graph convolution module, and connects a graph pooling layer after the attention module to obtain an initial model and trains the model to obtain a final graph neural network model as the threat detection model;

[0032] Step S22, the hospital data security management system constructs a network flow graph based on the network communication data, performs feature extraction on the network communication data to obtain feature vectors as node vectors and edge vectors in the network flow graph, and then inputs the network flow graph into the threat detection model to obtain the threat detection result.

[0033] Preferably, the training process of the initial model in step S21 includes:

[0034] The hospital data security management system deploys the initial model in multiple devices, and then configures a distributed training data set in each of the devices. In each of the devices, the distributed training data set is input into the initial model for training to obtain a trained model. After all devices are trained, the model parameters of all the trained models are collected, and the final model parameters are obtained according to the processing of each model parameter. The model parameters of an untrained initial model are configured as the final model parameters to obtain the graph neural network model.

[0035] Preferably, before executing step S2, a data processing process is further performed, including:

[0036] Step A1, the hospital data security management system cleans the threat detection data, and then converts the format of the cleaned threat detection data;

[0037] In step A2, the hospital data security management system divides the threat detection data after format conversion into multiple data packets and stores them in multiple network storage nodes respectively. The threat detection module obtains all the data packets from each network storage node and merges them to obtain the threat detection data.

[0038] The above technical solution has the following advantages or beneficial effects:

[0039] 1) Efficiency of the data monitoring module: This module can access the Internet hospital system in real time and quickly collect threat detection data. This real-time data collection mechanism ensures that the system can instantly obtain the latest security information, providing a time advantage for subsequent analysis and response.

[0040] 2) Optimization of threat detection models: The threat detection module uses pre-trained threat detection models. These models may be based on machine learning or deep learning algorithms, have the ability to process large-scale data sets, and can complete complex data analysis in a short time, thereby significantly reducing data processing and response delays.

[0041] 3) Automated response mechanism: The threat response module automatically selects and executes the corresponding response strategy from the preset strategy library based on the threat detection results. This automated response mechanism greatly reduces the need for manual intervention and improves the response speed and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a schematic diagram of the structure of a hospital data security management system in a preferred embodiment of the present invention;

[0043] Figure 2 A schematic diagram of a process flow of a hospital data security management method in a preferred embodiment of the present invention;

[0044] Figure 3 Schematic diagram of the process of step S2 in a preferred embodiment of the present invention;

[0045] Figure 4 The figure is a flowchart of the data processing process in a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0046] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. The present invention is not limited to this embodiment, and other embodiments may also fall within the scope of the present invention as long as they conform to the gist of the present invention.

[0047] In a preferred embodiment of the present invention, based on the above problems existing in the prior art, a hospital data security management system is provided. Figure 1 As shown, including:

[0048] Data monitoring module 1, used to access the Internet hospital system and collect threat detection data in the Internet hospital system;

[0049] Threat detection module 2, connected to data monitoring module 1, is used to input threat detection data into a pre-trained threat detection model to obtain threat detection results;

[0050] The threat response module 3 is connected to the threat detection module 2 and is used to select and configure a corresponding response strategy from a preset strategy library according to the threat detection result.

[0051] Specifically, in this embodiment, it is assumed that a certain Internet hospital system has recently been frequently attacked by DDoS and SQL injection attacks, which seriously affects the normal operation of the hospital. After adopting the data security management system, the implementation process is as follows:

[0052] Data collection: The data monitoring module is connected to the Internet hospital system in real time to collect threat detection data such as network traffic, log data, and user operation data.

[0053] Threat detection: The threat detection module inputs the collected data into a pre-trained threat detection model, which quickly identifies DDoS attack and SQL injection attack attempts and generates threat detection results.

[0054] Response strategy selection: The threat response module selects response strategies for DDoS attacks and SQL injection attacks from the preset strategy library based on threat detection results, such as enabling traffic cleaning devices, adjusting firewall rules, blocking malicious IPs, etc.

[0055] Policy configuration and execution: The system automatically configures and executes the selected response strategy, effectively blocking DDoS attacks and SQL injection attacks, and protecting the normal operation of the hospital system.

[0056] It can be seen from the above embodiments that the hospital data security management system performs well in data processing and response speed, diversity of detection and defense methods, and reduction of manual dependence, and can effectively respond to complex network security threats.

[0057] The proposed hospital data security management system aims to effectively solve the shortcomings of the current hospital data security management system, such as data processing and response delays, single detection and defense methods, and high manual dependence, through a series of innovative designs.

[0058] In a preferred embodiment of the present invention, a network traffic collector is included for real-time monitoring of network communication data of the Internet hospital system as threat detection data, and the threat detection module 2 includes:

[0059] A model building unit 21 is used to use multiple graph convolution layers as a graph convolution module, connect an attention module after the graph convolution module, and connect a graph pooling layer after the attention module to obtain an initial model and train it to obtain a final graph neural network model as a threat detection model;

[0060] The network data detection unit 22 is connected to the model building unit 21, and is used to build a network flow graph based on the network communication data, extract features from the network communication data to obtain feature vectors as node vectors and edge vectors in the network flow graph, and then input the network flow graph into the threat detection model to obtain threat detection results.

[0061] Specifically, in this embodiment, a large tertiary hospital adopts the hospital data security management system in this embodiment in order to improve its network security protection capabilities, especially against increasingly complex network attacks and threats. The system integrates components such as network traffic collectors and graph neural network threat detection models to achieve real-time monitoring and threat detection of network communication data of the Internet hospital system.

[0062] Deploy network traffic collectors on key nodes of the hospital network (such as core switches, firewalls, etc.) to ensure that all network communication data entering and leaving the hospital system can be captured.

[0063] Install and configure the data security management system server, including key components such as database, processing engine and threat detection module.

[0064] Then the model is built and trained, the process is as follows:

[0065] 1. Data scientists and network security experts work together to collect and annotate historical network traffic data and build a training data set.

[0066] 2. Use multiple graph convolutional layers to build the graph convolution module of the graph neural network model to learn the complex relationships between nodes and edges in the network flow graph.

[0067] 3. An attention module is connected after the graph convolution module to enhance the model's attention to key nodes and connections.

[0068] 4. Downsample the graph through the graph pooling layer to extract high-level features and reduce computational complexity.

[0069] 5. Use the training data set to train the initial model by adjusting model parameters and optimizing the algorithm until the model achieves satisfactory performance on the validation set.

[0070] Furthermore, the training process of the initial model in the model building unit includes:

[0071] The initial model is deployed in multiple devices, and then a distributed training data set is configured in each device. The distributed training data set is input into the initial model in each device for training to obtain a trained model. After all devices are trained, the model parameters of all trained models are collected, and the final model parameters are obtained according to the model parameters. The model parameters of an untrained initial model are configured as the final model parameters to obtain a graph neural network model.

[0072] Specifically, this embodiment adopts a distributed training graph neural network model:

[0073] When building a hospital data security management system, in order to improve the accuracy and generalization of the threat detection model and shorten the training time, we decided to use a distributed training method to train the graph neural network model. This method can utilize the parallel computing power of multiple computing devices to accelerate the model training process.

[0074] First, prepare the environment:

[0075] Prepare multiple computing devices (such as GPU servers) and ensure that they can be connected through a high-speed network (such as Infiniband or high-speed Ethernet).

[0076] Install a deep learning framework (such as TensorFlow or PyTorch) and necessary libraries on each device to support the building and training of graph neural network models.

[0077] Then, the model is deployed

[0078] Deploy the pre-designed graph neural network initial model (including graph convolution layer, attention module and graph pooling layer) to all computing devices.

[0079] Ensure that the model structure on each device is completely consistent to facilitate subsequent parameter synchronization and aggregation.

[0080] Next, data preparation and distribution:

[0081] Collect and annotate large amounts of network traffic data and build distributed training datasets.

[0082] The training data set is divided into multiple subsets, each of which contains a certain amount of data samples.

[0083] Distribute these subsets to different computing devices to ensure that each device can independently access its corresponding training data.

[0084] Then, perform distributed training

[0085] Start the training process on each device, feeding the local subset of training data into the initial model.

[0086] During training, the model on each device performs forward propagation and back propagation independently to calculate gradients and update the parameters of the local model.

[0087] Use a parameter server (or a communication mechanism built into the distributed training framework) to synchronize model parameters across devices. This typically involves sending the gradients on each device to the parameter server for aggregation, and then distributing the aggregated gradients back to each device to update the local model.

[0088] Repeat the above steps until the predetermined number of training rounds is reached or other stopping conditions are met (such as the performance on the validation set no longer improves).

[0089] Finally, complete the model parameter aggregation and final model generation

[0090] After all devices have finished training, collect the model parameters of the trained model on each device.

[0091] A certain aggregation strategy (average aggregation is preferably used in this embodiment) is used to process these model parameters to obtain final model parameters.

[0092] The model parameters of an untrained initial model are configured as these final model parameters to obtain a trained graph neural network model.

[0093] In addition, we can also evaluate the model:

[0094] The trained model is evaluated using an independent test dataset to verify its accuracy and generalization ability.

[0095] If the model performance meets the requirements, it will be deployed in the hospital data security management system for real-time monitoring and threat detection.

[0096] Through distributed training, we can make full use of the parallel computing power of multiple computing devices to accelerate the training process of the graph neural network model, while improving the accuracy and generalization ability of the model. This is of great significance for building an efficient and reliable hospital data security management system.

[0097] In a preferred embodiment of the present invention, a data processing module 4 is included, connected to the data monitoring module 1 and the threat detection module 2, including:

[0098] A data processing unit 41 is used to clean the threat detection data and then convert the format of the cleaned threat detection data;

[0099] The distributed storage unit 42 is connected to the data processing unit 41 and is used to divide the threat detection data after format conversion into multiple data packets and store them in multiple network storage nodes respectively. The threat detection module obtains all data packets from each network storage node and merges them to obtain the threat detection data.

[0100] Specifically, in this embodiment, the data processing module, as a key part connecting the data monitoring module and the threat detection module, has several significant advantages:

[0101] Improve data quality: Through the data cleaning step, noise, errors and redundant information in the threat detection data can be removed to ensure the quality of data used in subsequent analysis. This helps to improve the accuracy and reliability of threat detection.

[0102] Optimize data processing efficiency: Format conversion converts cleaned data into a format suitable for subsequent analysis and storage, reducing the overhead of data transmission and processing. At the same time, the design of distributed storage units enables data to be processed in parallel, further improving the speed and efficiency of data processing.

[0103] Enhanced system scalability and fault tolerance: By distributing threat detection data across multiple network storage nodes, the system can easily expand storage capacity as needed to meet growing data storage needs. In addition, distributed storage also improves the system's fault tolerance. Even if some nodes fail, other nodes can still provide data services, ensuring system continuity and stability.

[0104] Further, an embodiment is used to further illustrate:

[0105] With the development of medical information technology, hospitals have accumulated a large amount of sensitive data. The security and privacy protection of this data are of vital importance. As an important part of the hospital data security system, the data processing module is responsible for cleaning, format conversion and distributed storage of the monitored threat detection data to ensure the quality and availability of the data and provide support for subsequent threat analysis.

[0106] The hospital has deployed a comprehensive data monitoring system to collect various logs and data streams generated by the hospital's internal network, business systems, and medical equipment in real time. These data may contain potential threat information, such as unauthorized access, data leakage, etc.

[0107] The data processing unit first receives the raw threat detection data from the data monitoring system. These data may contain noise, redundancy or inconsistent formats. Through the data cleaning step, invalid data, duplicate data, and format errors are removed to ensure the data quality of subsequent analysis.

[0108] The cleaned data is converted into a unified format, such as JSON or XML, to facilitate subsequent data processing and storage. At the same time, the data is appropriately compressed and encrypted as required to improve storage efficiency and security.

[0109] The threat detection data after format conversion is divided into multiple data packets according to certain strategies (such as timestamp, data type, etc.). These data packets are dispersed and stored in multiple network storage nodes, which can be server clusters within the hospital or external cloud storage services. Each storage node has independent storage and data processing capabilities, and can process data requests in parallel, improving the overall performance and scalability of the system.

[0110] The distributed storage mechanism also provides data redundancy and backup functions to ensure that data will not be lost and the system can still operate normally when some nodes fail.

[0111] When the threat detection module needs to analyze data, it can obtain data packets from various network storage nodes in parallel and merge them to restore complete threat detection data.

[0112] Use advanced threat detection algorithms and models to conduct in-depth analysis of the merged data to identify potential cybersecurity threats and sensitive data leakage risks.

[0113] Finally, based on the analysis results, appropriate security measures are taken in a timely manner, such as blocking attacks, isolating infected devices, notifying relevant personnel, etc., to ensure the security and privacy protection of hospital data.

[0114] In a preferred embodiment of the present invention, the threat detection model includes a first detection model and a second detection model, and the threat detection module 2 includes:

[0115] A known threat detection unit 23, configured to input threat detection data into the first detection model, use the threat type as the threat detection result when it is determined that the detection result of the first detection model contains the threat type, and generate a re-detection signal when it is determined that the detection result of the first detection model does not contain the threat type;

[0116] The unknown threat detection unit 24 is connected to the known threat detection unit and is used to input the threat detection data into the second detection model for detection when receiving a re-detection signal, and then use the threat type contained in the detection result of the second detection model as the threat detection result.

[0117] Specifically, in the scenario of hospital data security, the threat detection module including the first detection model and the second detection model has the following significant advantages:

[0118] The first detection model is usually optimized for known threat types and can quickly and accurately identify common security threats. This reduces the possibility of false positives and false negatives and improves the overall detection accuracy of the system.

[0119] When the first detection model fails to identify a threat, the second detection model can further analyze the data to detect unknown threat types as a supplement. This dual detection mechanism significantly enhances the system's ability to identify new or mutated threats.

[0120] Furthermore, the two detection models can be run in parallel or serially, and the system can complete threat detection in a short period of time and respond quickly. This helps hospitals take timely measures to prevent potential data leaks or security incidents.

[0121] The following is further described using an embodiment of actual application:

[0122] In order to protect its data security and patient privacy, a large hospital deployed an advanced threat detection system. The system includes a threat detection module that integrates the first detection model (for known threats) and the second detection model (for unknown threats).

[0123] Implementation process: The hospital’s data monitoring system collects key information such as network traffic, system logs, and application data in real time, and passes this information to the threat detection module for preprocessing. The preprocessing steps include data cleaning, format conversion, and feature extraction to ensure data quality and availability.

[0124] The known threat detection unit receives the pre-processed threat detection data and inputs it into the first detection model for detection. The first detection model quickly analyzes the data based on the existing threat intelligence and feature library to determine whether there is a known threat type.

[0125] If the first detection model identifies the threat type, a threat detection result is immediately generated and a corresponding security response mechanism is triggered (such as blocking the attack source, notifying the security team, etc.).

[0126] If the first detection model fails to identify the threat type, a re-detection signal is generated and the threat detection data is passed to the unknown threat detection unit.

[0127] The unknown threat detection unit inputs the data into the second detection model for in-depth analysis. The second detection model uses more complex algorithms and models (such as deep learning, unsupervised learning, etc.) to identify unknown threat types.

[0128] Once the second detection model identifies a potential threat, it will also generate a threat detection result and trigger a corresponding security response mechanism.

[0129] Advantages:

[0130] Double protection: By combining known threat detection and unknown threat detection, the system provides double protection to ensure the safety of hospital data.

[0131] Efficient response: The system can complete threat detection in a short time and respond quickly, effectively preventing potential security incidents.

[0132] Flexible expansion: As new threats continue to emerge, hospitals can easily update or add detection models to respond to changing security threats.

[0133] Through the above embodiments, hospitals can build an efficient and accurate threat detection module to provide strong protection for their data security and patient privacy.

[0134] In a preferred embodiment of the present invention, the Internet hospital system includes multiple access devices, and multiple threat detection data are collected from each access device. The response strategy includes a firewall update rule; the threat response module 3 includes:

[0135] A firewall update unit 31, configured to match a corresponding response policy from a policy library according to a threat type included in the threat detection result, and then update the current firewall rule to a firewall update rule in the response policy;

[0136] The device isolation unit 32 is used to mark the access device corresponding to the threat detection data corresponding to the threat detection result containing the threat type as an isolated device, and then disconnect each isolated device from the Internet hospital system for isolation.

[0137] Specifically, in this embodiment, in the Internet hospital system for hospital data security, the threat response module has the following significant advantages:

[0138] Immediacy: The threat response module can immediately take corresponding response measures based on the threat detection results, such as updating firewall rules, isolating infected devices, etc., thereby quickly blocking the further spread of security threats.

[0139] Automation: The threat response module implements an automated process from threat detection to response strategy execution, reducing the need for manual intervention and improving the efficiency and accuracy of response.

[0140] Precision: By matching with the policy library, the threat response module can formulate and execute corresponding response strategies for different types of threats to achieve precise defense.

[0141] Flexibility: The design of the threat response module allows the response strategy to be adjusted according to actual needs, including updating firewall rules, isolating access devices, etc., to adapt to the ever-changing security threat environment.

[0142] Protecting data integrity: By isolating infected devices in a timely manner, the threat response module can protect hospital data from malicious access or tampering, ensuring data integrity and availability.

[0143] The following is further described using an embodiment of actual application:

[0144] In order to ensure the security of its data, an Internet hospital system has deployed a comprehensive threat detection and response mechanism. The system includes multiple access devices (such as doctor workstations, patient self-service terminals, etc.). The threat detection data collected from each access device is transmitted to the threat detection module for analysis. Based on the analysis results, the threat response module will execute the corresponding response strategy.

[0145] Threat detection: The threat detection module receives threat detection data from each access device, uses advanced detection algorithms to analyze the data, and identifies potential threat types.

[0146] Response strategy matching: The firewall update unit in the threat response module matches the corresponding response strategy from the policy library according to the threat type in the threat detection result. The policy library contains detailed response measures for different types of threats, such as firewall update rules, device isolation strategies, etc.

[0147] Firewall rule update: Based on the matched response policy, the firewall update unit updates the current firewall rules to the firewall update rules specified in the response policy. These rules include blocking access to specific IP addresses, ports or protocols to enhance the system's defense capabilities.

[0148] Device isolation: At the same time, the device isolation unit will mark the access devices corresponding to the threat detection results containing the threat type as isolated devices. These devices will then be disconnected from the Internet hospital system to prevent further spread of the threat.

[0149] Follow-up: The isolated device will undergo further investigation and cleanup to confirm whether it is truly infected by the threat. Once the infection is confirmed, appropriate recovery measures will be taken; if it is a false positive, it will be reconnected to the system.

[0150] Advantages:

[0151] 1. Immediately block threats: Through automated and immediate response measures, further spread of security threats is effectively blocked.

[0152] 2. Protect data security: By isolating infected devices, hospital data is protected from malicious access or tampering.

[0153] 3. Improve defense capabilities: The overall defense capabilities of the system have been enhanced by updating firewall rules and other measures.

[0154] 4. Reduced manual intervention: Automated processes reduce the need for manual intervention and improve the efficiency and accuracy of responses.

[0155] Through the above embodiments, it can be seen that the threat response module plays an important role in ensuring the security of hospital data.

[0156] The present invention also provides a hospital data security management method, which is applied to the above hospital data security management system. Figure 2 Said, including:

[0157] Step S1, the hospital data security management system collects threat detection data in the Internet hospital system;

[0158] Step S2, the hospital data security management system inputs the threat detection data into a pre-trained threat detection model to obtain a threat detection result;

[0159] Step S3: The hospital data security management system selects and configures a corresponding response strategy from a preset strategy library according to the threat detection result.

[0160] In a preferred embodiment of the present invention, the hospital data security management system includes a network traffic collector for real-time monitoring of network communication data of the Internet hospital system as threat detection data, such as Figure 3 As shown, step S2 includes:

[0161] Step S21, the hospital data security management system uses multiple graph convolution layers as a graph convolution module, connects an attention module after the graph convolution module, and connects a graph pooling layer after the attention module to obtain an initial model and trains it to obtain a final graph neural network model as a threat detection model;

[0162] In step S22, the hospital data security management system constructs a network flow graph based on the network communication data, extracts features from the network communication data to obtain feature vectors as node vectors and edge vectors in the network flow graph, and then inputs the network flow graph into a threat detection model to obtain threat detection results.

[0163] In a preferred embodiment of the present invention, the training process of the initial model in step S21 includes:

[0164] The hospital data security management system deploys the initial model in multiple devices, then configures a distributed training data set in each device, inputs the distributed training data set into the initial model in each device for training to obtain a trained model, and after all devices are trained, collects the model parameters of all trained models, processes each model parameter to obtain the final model parameters, and configures the model parameters of an untrained initial model as the final model parameters to obtain a graph neural network model.

[0165] In a preferred embodiment of the present invention, a data processing process is further performed before executing step S2, such as Figure 4 As shown. Includes:

[0166] Step A1, the hospital data security management system cleans the threat detection data, and then converts the format of the cleaned threat detection data;

[0167] In step A2, the hospital data security management system divides the threat detection data after format conversion into multiple data packets and stores them in multiple network storage nodes respectively. The threat detection module obtains all data packets from each network storage node and merges them to obtain threat detection data.

[0168] The above are only preferred embodiments of the present invention, and are not intended to limit the implementation methods and protection scope of the present invention. Those skilled in the art should be aware that all solutions obtained by equivalent substitutions and obvious changes made using the contents of this specification and illustrations should be included in the protection scope of the present invention.

Claims

1. A hospital data security management system, characterized in that: include: A data monitoring module, used to access the Internet hospital system and collect threat detection data in the Internet hospital system; A threat detection module, connected to the data monitoring module, for inputting the threat detection data into a pre-trained threat detection model to obtain a threat detection result; The threat response module is connected to the threat detection module and is used to select and configure a corresponding response strategy from a preset strategy library according to the threat detection result.

2. The hospital data security management system according to claim 1, characterized in that: Including a network traffic collector for real-time monitoring of the network communication data of the Internet hospital system as threat detection data, the threat detection module includes: A model building unit, used to use multiple graph convolution layers as a graph convolution module, connect an attention module after the graph convolution module, connect a graph pooling layer after the attention module to obtain an initial model and perform training to obtain a final graph neural network model as the threat detection model; A network data detection unit is connected to the model building unit and is used to build a network flow graph according to the network communication data, perform feature extraction on the network communication data to obtain feature vectors as node vectors and edge vectors in the network flow graph, and then input the network flow graph into the threat detection model to obtain the threat detection result.

3. The hospital data security management system according to claim 2, characterized in that: The training process of the initial model in the model building unit includes: The initial model is deployed in multiple devices, and then a distributed training data set is configured in each of the devices. The distributed training data set is input into the initial model in each of the devices for training to obtain a trained model. After all devices are trained, the model parameters of all the trained models are collected, and the final model parameters are obtained according to the model parameters. The model parameters of an untrained initial model are configured as the final model parameters to obtain the graph neural network model.

4. The hospital data security management system according to claim 1, characterized in that: A data processing module is included, connected to the data monitoring module and the threat detection module, including: A data processing unit, used for performing data cleaning on the threat detection data, and then performing format conversion on the threat detection data after data cleaning; A distributed storage unit is connected to the data processing unit and is used to divide the threat detection data after format conversion into multiple data packets and store them in multiple network storage nodes respectively. The threat detection module obtains all the data packets from each network storage node and merges them to obtain the threat detection data.

5. The hospital data security management system according to claim 1, characterized in that: The threat detection model includes a first detection model and a second detection model, and the threat detection module includes: a known threat detection unit, configured to input the threat detection data into the first detection model, use the threat type as the threat detection result when it is determined that the detection result of the first detection model includes the threat type, and generate a re-detection signal when it is determined that the detection result of the first detection model does not include the threat type; An unknown threat detection unit is connected to the known threat detection unit and is used to input the threat detection data into the second detection model for detection when receiving the re-detection signal, and then use the threat type contained in the detection result of the second detection model as the threat detection result.

6. The hospital data security management system according to claim 5, characterized in that: The Internet hospital system includes multiple access devices, and multiple threat detection data are collected from each of the access devices. The response strategy includes a firewall update rule; the threat response module includes: A firewall updating unit, configured to match a corresponding response policy from the policy library according to the threat type included in the threat detection result, and then update the current firewall rule to the firewall update rule in the response policy; The device isolation unit is used to mark the access device corresponding to the threat detection data corresponding to the threat detection result containing the threat type as an isolated device, and then disconnect each of the isolated devices from the Internet hospital system for isolation.

7. A hospital data security management method, characterized in that: The hospital data security management system as claimed in any one of claims 1 to 6 comprises: Step S1, the hospital data security management system collects threat detection data in the Internet hospital system; Step S2, the hospital data security management system inputs the threat detection data into a pre-trained threat detection model to obtain a threat detection result; Step S3: the hospital data security management system selects and configures a corresponding response strategy from a preset strategy library according to the threat detection result.

8. The hospital data security management method according to claim 7, characterized in that: The hospital data security management system includes a network traffic collector for real-time monitoring of network communication data of the Internet hospital system as threat detection data, and step S2 includes: Step S21, the hospital data security management system uses multiple graph convolution layers as a graph convolution module, connects an attention module after the graph convolution module, and connects a graph pooling layer after the attention module to obtain an initial model and trains the model to obtain a final graph neural network model as the threat detection model; Step S22, the hospital data security management system constructs a network flow graph based on the network communication data, performs feature extraction on the network communication data to obtain feature vectors as node vectors and edge vectors in the network flow graph, and then inputs the network flow graph into the threat detection model to obtain the threat detection result.

9. The hospital data security management method according to claim 8, characterized in that: The training process of the initial model in step S21 includes: The hospital data security management system deploys the initial model in multiple devices, and then configures a distributed training data set in each of the devices. In each of the devices, the distributed training data set is input into the initial model for training to obtain a trained model. After all devices are trained, the model parameters of all the trained models are collected, and the final model parameters are obtained according to the processing of each model parameter. The model parameters of an untrained initial model are configured as the final model parameters to obtain the graph neural network model.

10. The hospital data security management method according to claim 7, characterized in that: Before executing step S2, a data processing process is further performed, including: Step A1, the hospital data security management system cleans the threat detection data, and then converts the format of the threat detection data after data cleaning; In step A2, the hospital data security management system divides the threat detection data after format conversion into multiple data packets and stores them in multiple network storage nodes respectively. The threat detection module obtains all the data packets from each network storage node and merges them to obtain the threat detection data.

Images