Intelligent medical safety management system

Abstract

The invention relates to the technical field of safety management, and discloses an intelligent medical safety management system, which comprises a data acquisition unit, a risk analysis unit and a safety early warning unit, according to the method, factors such as abnormal time and remote login are extracted from login information, related factors such as reading amount and modification amount are calculated from medical data operation records, a behavior abnormality evaluation value is obtained in combination with a weight coefficient, and the user behavior abnormality degree can be accurately judged; early warning is carried out according to comparison of an evaluation value and a threshold value, a signal is generated and basic information and abnormal factors of a user are pushed to a manager when abnormity occurs, the manager is helped to handle abnormal behaviors in time, and the safety of a medical information system is guaranteed; by analyzing login information in an initial observation period, a common login time library and a common IP address library are established by a scientific method. The login frequency and the IP address occurrence frequency are calculated by dividing time periods, and the IP addresses meeting the threshold value are included in a common library, so that the recognition accuracy and the individuation degree are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of safety management, and in particular to a smart medical safety management system. Background Art

[0002] In today's digital age, the informatization process in the medical field is accelerating. Medical information systems store and process a large amount of sensitive and critical data, including patients' medical records, diagnosis results, treatment plans, and medical resource allocation. With the development of smart medicine, the application scope of medical information systems is becoming increasingly wide, but they are also facing many security risks. On the one hand, medical data is extremely valuable, which attracts the covetousness of criminals. They may try to invade the system to obtain data or tamper with data for personal gain. On the other hand, internal personnel's operational errors or illegal operations may also pose a threat to data security.

[0003] Traditional medical safety management methods have gradually revealed their shortcomings in dealing with complex and ever-changing security risks. For example, in terms of user login management, there is a lack of accurate monitoring and analysis mechanisms for login time and login location, making it difficult to identify abnormal login behavior. In terms of medical data operation records, it is impossible to effectively track the reading and modification of data, and it is impossible to promptly discover problems such as improper data modification.

[0004] Therefore, there is an urgent need for a smart medical safety management system that can comprehensively and accurately collect relevant data in the medical information system, evaluate abnormal user behavior through scientific and reasonable analysis methods, and issue timely security warnings to ensure the data security of the medical information system, prevent data leakage, tampering and other adverse events, and provide solid guarantees for the stable and safe development of smart medical care. Summary of the invention

[0005] The purpose of the present invention is to provide a smart medical safety management system that solves the technical problems raised in the background technology.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] A smart medical safety management system, comprising:

[0008] A data collection unit is used to collect various information data from a medical information system; the information data includes: user login information including login timestamp, login IP address, login user name, medical data operation records including data reading timestamp, modification content, and identity of the modifier;

[0009] A risk analysis unit is used to evaluate and analyze the behavior anomaly of the corresponding user based on various information data, and obtain the behavior anomaly evaluation value of the corresponding user according to the analysis result;

[0010] The security warning unit is used to perform security warning processing based on the abnormal behavior assessment value corresponding to each user obtained by the risk analysis unit, determine the user with abnormal behavior based on the processing result, and generate a warning signal based on it.

[0011] As a further solution of the present invention: wherein, the user login information is collected immediately once a user logs into the system by setting a monitoring program in the system background; and the login timestamp is accurate to milliseconds, the login IP address is collected in the form of a string, and the login user name is recorded in the form of text;

[0012] Medical data operation records are collected by setting triggers in the data storage layer. When there is a data reading or modification operation, the data reading timestamp is recorded, and the modified content is determined and recorded by binary difference comparison. The identity of the modifier is obtained through the system user permission database association.

[0013] As a further solution of the present invention: the method for determining the modified content is:

[0014] Extract the original data content and convert it into binary data, extract the current data content and convert it into binary data, then calculate the difference between the two sets of binary data, and record the difference as the content modification determination value. If the content modification determination value is 0, the corresponding data content is not determined as modified content, otherwise, it is determined as modified content;

[0015] When the corresponding data content is determined to be modified content, the identity of the modifier is extracted, otherwise, the identity of the modifier is not extracted.

[0016] As a further solution of the present invention: the abnormal evaluation and analysis method is as follows:

[0017] Step 1: Extract abnormal factors from user login information

[0018] Step 1.1, extract the login timestamp, login IP address, and login user name of each user who logs into the system within the specified period;

[0019] Step 1.2, then obtain the commonly used login time database and commonly used IP address database pre-established for the user according to the login user name;

[0020] Step 1.3, then compare the login timestamp and login IP address of each login within the specified period with the commonly used login time database and commonly used IP address database respectively:

[0021] Step 1.4, extract the total number of logins of the relevant users in the specified period, then add the number of abnormal time logins and the number of remote logins of the relevant users in the specified period, divide the sum by the total number of logins, and then mark the result as the login abnormality factor;

[0022] Step 2: Extracting abnormal factors from medical data operation records

[0023] Step 2.1, extract the data reading timestamp and modification content in all medical data operation records of relevant users within a specified period based on the identity of the modifier;

[0024] Step 2.2, determine the amount of medical data read by the relevant user within the specified period based on the number of data reading timestamps, and record it as the data reading amount;

[0025] At the same time, the amount of content modified by the relevant user within the specified period is determined based on the content modification judgment value, and recorded as the modified content amount;

[0026] Step 2.3, divide the amount of content modified in the specified period by the amount of data read, and multiply the quotient by the corresponding preset weight coefficient;

[0027] Step 2.4, add up the content modification judgment values ​​corresponding to all modified contents within the specified period, and multiply the sum by the corresponding preset weight coefficient;

[0028] Step 2.5, add the results obtained in Step 2.3 and Step 2.4, and then mark the result as the operation abnormality factor;

[0029] Step 3: Multi-factor risk assessment

[0030] By R=F1×γ1+F2×γ2, the behavior abnormality evaluation value R of the corresponding user in the medical information system is calculated;

[0031] Wherein, F1 is the login abnormality factor of the corresponding user, F2 is the operation abnormality factor of the corresponding user, and γ1 and γ2 are the corresponding preset weight coefficients respectively.

[0032] As a further solution of the present invention: the comparison method of Step 1.3 is as follows: select any user login information of logging into the system once;

[0033] Step 1.31. If the login timestamp is not in the common login time database, the user's login is determined to be an abnormal time login, and the number of abnormal time logins is increased by one; otherwise, the number of abnormal time logins remains unchanged;

[0034] Step 1.32. If the login IP address is not in the common IP address database, the user's login is determined to be a remote login, and the number of remote logins is increased by one; otherwise, the number of remote logins remains unchanged;

[0035] As a further solution of the present invention: the security warning processing method is as follows:

[0036] Select a user;

[0037] Extract the user's behavior anomaly assessment value and then compare it with the preset behavior anomaly threshold:

[0038] If the behavior anomaly assessment value is greater than or equal to the behavior anomaly threshold, a warning signal is generated;

[0039] And so on, security warnings are issued to all users;

[0040] Among them, the early warning signal is used to trigger a security warning, which indicates that the user has abnormal behavior in the medical information system. The basic information of the user when registering in the medical information system is then obtained, and the user's basic information as well as the abnormal factors in the user login information and medical data operation records are pushed to relevant managers.

[0041] As a further solution of the present invention: wherein, the commonly used login time database and the commonly used IP address database are established as follows:

[0042] StepA1. After the user registers and logs into the system for the first time, the login information is recorded. During a relatively long initial observation period, each time the user logs into the system, the login timestamp and login IP address are recorded in detail.

[0043] StepA2: Establishment of frequently used login time database

[0044] StepA2.1, divide the observation period into multiple standard time periods, and then divide each standard time period into several interval time periods;

[0045] StepA2.2, obtain the number of logins corresponding to each standard time period, and record it as the number of logins during the time period;

[0046] Then, the number of logins in each interval time period within the standard time period is obtained and recorded as the interval login number;

[0047] StepA2.3, select a standard time period;

[0048] Divide the number of logins in each interval time period by the number of logins in the standard time period, and obtain the login frequency of each interval time period in the standard time period;

[0049] And so on, the login frequency of each interval time period in each standard time period is obtained;

[0050] StepA2.4, in each standard time period, select the login frequency of the same interval time period, and calculate its mean, and record it as the frequency analysis value;

[0051] StepA2.5. Compare the frequency analysis value with the preset login frequency threshold:

[0052] If the frequency analysis value is greater than or equal to the login frequency threshold, the interval time period is included in the common login time library, otherwise the interval time period is not included in the common login time library;

[0053] StepA3: Establishment of common IP address database

[0054] StepA3.1, obtain the number of occurrences of each IP address during the observation period;

[0055] StepA3.2, by adding up the number of occurrences of each IP address, the total number of occurrences of all IP addresses is obtained;

[0056] StepA3.3, divide the number of login occurrences of each IP address by the total number of occurrences of all IP addresses, and obtain the occurrence frequency of each IP address;

[0057] StepA3.4, then compare the occurrence frequency with the preset occurrence frequency:

[0058] Select an IP address;

[0059] If the occurrence frequency is greater than or equal to the occurrence frequency threshold, the IP address is included in the common IP address database, otherwise the IP address is not included in the common IP address database.

[0060] Beneficial effects of the present invention:

[0061] The present invention collects a variety of information data from the medical information system, including the login timestamp, login IP address, login user name in the user login information, and medical data operation records containing data reading timestamp, modification content, and modifier identity, etc., providing a rich data foundation for subsequent risk analysis and security warnings, and being able to comprehensively monitor user behavior in the medical information system.

[0062] The present invention extracts abnormal factors from user login information and medical data operation records, calculates login abnormality factors and operation abnormality factors respectively, and then calculates behavior abnormality evaluation values ​​in combination with preset weight coefficients, thereby being able to accurately evaluate the abnormal degree of user behavior.

[0063] The present invention compares the login timestamp and login IP address with the common login time library and the common IP address library for the user login information, accurately determines the abnormal time login and remote login situation, and improves the accuracy of risk analysis.

[0064] The present invention, in the analysis of medical data operation records, can effectively measure the abnormal operation of users on medical data by calculating the ratio of the modified content amount to the data read amount and the sum of the modified content judgment values ​​and multiplying them by the corresponding weight coefficient.

[0065] The present invention performs security warning processing based on the behavior anomaly evaluation value. When the user's behavior anomaly evaluation value is greater than or equal to a preset behavior anomaly threshold, a warning signal is generated to promptly remind relevant management personnel to pay attention to abnormal behavior.

[0066] The present invention, after the early warning signal is triggered, can obtain the basic information of the user during registration, as well as the abnormal factors in the user login information and medical data operation records, and push them to the relevant management personnel, so that the management personnel can quickly understand the problem and take corresponding measures to deal with it.

[0067] The present invention adopts a scientific method for establishing a common login time library and a common IP address library. After a user registers and logs into the system for the first time, by recording the login information during the initial observation period, dividing the standard time period and the interval time period, calculating the login frequency, and adding the interval time period that meets the frequency analysis value requirements into the common login time library, a personalized common login time library is established to better adapt to the login habits of different users.

[0068] The present invention calculates the occurrence frequency of each IP address in the observation period and compares it with a preset occurrence frequency threshold, and then adds the IP addresses meeting the requirements into the common IP address database, thereby improving the recognition accuracy of the user's common IP addresses.

[0069] In summary, the intelligent medical safety management system of the present invention can effectively improve the security of the medical information system, timely discover and warn users of abnormal behavior, and provide a strong guarantee for the safe management of medical information. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] The present invention will be further described below in conjunction with the accompanying drawings.

[0071] Figure 1 It is a system block diagram of a smart medical safety management system of the present invention.

[0072] Figure 2 It is a module flow diagram of a risk analysis unit in a smart medical safety management system of the present invention. DETAILED DESCRIPTION

[0073] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0074] Embodiment 1

[0075] See also Figure 1 and Figure 2 As shown, the present invention is a smart medical safety management system, comprising:

[0076] A data collection unit, used to collect various information data from a medical information system;

[0077] Information data includes: user login information including login timestamp, login IP address, login username, medical data operation records including data reading timestamp, modification content, and identity of the modifier;

[0078] The user login information is collected by setting a monitoring program in the system background. Once a user logs into the system, the relevant information is collected immediately. The login timestamp is accurate to milliseconds, the login IP address is collected in the form of a string, and the login user name is recorded in the form of text.

[0079] Medical data operation records are collected by setting triggers in the data storage layer. When there is a data reading or modification operation, the data reading timestamp is recorded, and the modified content is determined and recorded by binary difference comparison. The value obtained by binary difference comparison of the modified content is recorded as the content modification judgment value, and the identity of the modifier is obtained by association with the system user authority database;

[0080] This embodiment comprehensively collects various information data in the medical information system through the data acquisition unit, providing a rich data foundation for smart medical safety management.

[0081] The risk analysis unit is used to evaluate and analyze the abnormal behavior of the corresponding users based on various information data;

[0082] The specific method is as follows:

[0083] Step 1: Extract abnormal factors from user login information

[0084] Step 1.1, extract the login timestamp, login IP address, and login user name of each user who logs into the system within the specified period;

[0085] Step 1.2, then obtain the commonly used login time database and commonly used IP address database pre-established for the user according to the login user name;

[0086] Step 1.3, then compare the login timestamp and login IP address of each login within the specified period with the commonly used login time database and commonly used IP address database respectively:

[0087] Select any user login information for logging into the system;

[0088] Step 1.31. If the login timestamp is not in the common login time database, the user's login is determined to be an abnormal time login, and the number of abnormal time logins is increased by one; otherwise, the number of abnormal time logins remains unchanged;

[0089] Step 1.32. If the login IP address is not in the common IP address database, the user's login is determined to be a remote login, and the number of remote logins is increased by one; otherwise, the number of remote logins remains unchanged;

[0090] Step 1.4, extract the total number of logins of the relevant users in the specified period, then add the number of abnormal time logins and the number of remote logins of the relevant users in the specified period, divide the sum by the total number of logins, and then mark the result as the login abnormality factor;

[0091] Step 2: Extracting abnormal factors from medical data operation records

[0092] Step 2.1, extract the data reading timestamp and modification content in all medical data operation records of relevant users within a specified period based on the identity of the modifier;

[0093] Step 2.2, determine the amount of medical data read by the relevant user within the specified period based on the number of data reading timestamps, and record it as the data reading amount;

[0094] At the same time, the amount of content modified by the relevant user within the specified period is determined based on the content modification judgment value, and recorded as the modified content amount;

[0095] Step 2.3, divide the amount of content modified in the specified period by the amount of data read, and multiply the quotient by the corresponding preset weight coefficient;

[0096] Step 2.4, add up the content modification judgment values ​​corresponding to all modified contents within the specified period, and multiply the sum by the corresponding preset weight coefficient;

[0097] Step 2.5, add the results obtained in Step 2.3 and Step 2.4, and then mark the result as the operation abnormality factor;

[0098] Step 3: Multi-factor risk assessment

[0099] By R=F1×γ1+F2×γ2, the behavior abnormality evaluation value R of the corresponding user in the medical information system is calculated;

[0100] In the formula, F1 is the login abnormality factor of the corresponding user, F2 is the operation abnormality factor of the corresponding user, γ1 and γ2 are the corresponding preset weight coefficients respectively;

[0101] This embodiment uses the risk analysis unit to extract abnormal factors from two aspects: user login information and medical data operation records, and can comprehensively evaluate the abnormal situation of user behavior. For login information, the login abnormality factor is analyzed; for medical data operation records, the behavior abnormality assessment value is analyzed, which improves the accuracy and scientificity of risk assessment.

[0102] A security warning unit is used to perform security warning processing according to the behavior abnormality assessment value corresponding to each user obtained by the risk analysis unit;

[0103] The specific method is as follows:

[0104] Select a user;

[0105] Extract the user's behavior anomaly assessment value and then compare it with the preset behavior anomaly threshold:

[0106] If the behavior anomaly assessment value is greater than or equal to the behavior anomaly threshold, a warning signal is generated;

[0107] The early warning signal is used to trigger a security warning, which indicates that the user has abnormal behavior in the medical information system. The basic information of the user when registering in the medical information system is then obtained, and the user's basic information as well as the abnormal factors in the user login information and medical data operation records are pushed to the relevant managers so that the relevant managers can quickly check the abnormalities of the relevant users, effectively ensuring the security of the medical information system.

[0108] Embodiment 2

[0109] As the second embodiment of the present invention, when the present application is implemented, compared with the first embodiment, the technical solution of the present embodiment is different from that of the first embodiment only in that:

[0110] This embodiment also proposes a method for determining the modification content, which is as follows:

[0111] Extract the original data content and convert it into binary data, extract the current data content and convert it into binary data, then calculate the difference between the two sets of binary data, and record the difference as the content modification determination value. If the content modification determination value is 0, the corresponding data content is not determined as modified content, otherwise, it is determined as modified content;

[0112] When the corresponding data content is determined to be modified content, the identity of the modifier is extracted, otherwise, the identity of the modifier is not extracted;

[0113] This embodiment proposes a more accurate method for determining modified content. It determines the content modification judgment value by converting the original data content and the current data content into binary data and calculating the difference, and then determines whether it is a modified content and whether to extract the identity of the modifier, thereby improving the accuracy of the judgment on the modification of medical data.

[0114] Embodiment 3

[0115] As the third embodiment of the present invention, when the present application is implemented, compared with the first and second embodiments, the technical solution of this embodiment is to combine the solutions of the first and second embodiments, and the difference between the technical solution of this embodiment and the first and second embodiments is only in this embodiment;

[0116] This embodiment also proposes a method for establishing a common login time database and a common IP address database, which is as follows:

[0117] StepA1. After the user registers and logs into the system for the first time, the login information is recorded. During a relatively long initial observation period, such as one month, each time the user logs into the system, the login timestamp and login IP address are recorded in detail.

[0118] StepA2: Establishment of frequently used login time database

[0119] StepA2.1, divide the observation period into multiple standard time periods, and then divide each standard time period into several interval time periods;

[0120] StepA2.2, obtain the number of logins corresponding to each standard time period, and record it as the number of logins during the time period;

[0121] Then, the number of logins in each interval time period within the standard time period is obtained and recorded as the interval login number;

[0122] StepA2.3, then select a standard time period;

[0123] Divide the number of logins in each interval time period by the number of logins in the standard time period, and obtain the login frequency of each interval time period in the standard time period;

[0124] And so on, the login frequency of each interval time period in each standard time period is obtained;

[0125] StepA2.4, then in each standard time period, select the login frequency of the same interval time period, and calculate its average value, which is recorded as the frequency analysis value;

[0126] StepA2.5, then compare the frequency analysis value with the preset login frequency threshold:

[0127] If the frequency analysis value is greater than or equal to the login frequency threshold, the interval time period is included in the common login time library, otherwise the interval time period is not included in the common login time library;

[0128] For example: during a one-month observation period, 24 hours a day is used as the standard time period, and every 2 hours is used as an interval time period;

[0129] Calculate the proportion of login times in each interval to the total number of login times, i.e. login frequency;

[0130] Then calculate the average value of the corresponding login frequency in the same time period within this month;

[0131] For example, if the frequency analysis value of the time period between 15:00 and 17:00 is above 30%, and the frequency threshold is set to 25%, this time period is included in the common login time library.

[0132] At the same time, in this embodiment, the daily behavior patterns of users are also considered;

[0133] If there is a significant difference in the user's login time on weekdays and weekends, you can create corresponding common login time library sub-modules for each, so that you can compare the time more accurately; for example, users mainly log in during lunch breaks and after get off work on weekdays, and mainly log in during the day on weekends. Record these patterns separately and include them in the library.

[0134] StepA3: Establishment of common IP address database

[0135] StepA3.1, obtain the number of occurrences of each IP address during the observation period;

[0136] StepA3.2, by adding up the number of occurrences of each IP address, the total number of occurrences of all IP addresses is obtained;

[0137] StepA3.3, divide the number of login occurrences of each IP address by the total number of occurrences of all IP addresses, and obtain the occurrence frequency of each IP address;

[0138] StepA3.4, then compare the occurrence frequency with the preset occurrence frequency:

[0139] Select an IP address;

[0140] If the occurrence frequency is greater than or equal to the occurrence frequency threshold, the IP address is included in the common IP address database, otherwise the IP address is not included in the common IP address database.

[0141] This embodiment provides in detail the establishment method of the commonly used login time library and the commonly used IP address library, so that the establishment of these two libraries is more scientific and reasonable. After the user registers and logs in to the system for the first time, the login information is recorded through a relatively long initial observation period, the time during the observation period is divided into standard time periods and interval time periods, the login frequency is calculated and compared with the preset threshold to determine the commonly used login time library, and at the same time, considering the user's daily behavior patterns, the commonly used login time library sub-modules for weekdays and weekends are established respectively, which improves the accuracy of time comparison. For the establishment of the commonly used IP address library, the IP addresses included in the library are determined by calculating the frequency of occurrence of each IP address and comparing it with the preset frequency threshold, so that the commonly used IP address library more accurately reflects the user's commonly used login locations.

[0142] Embodiment 4

[0143] As the fourth embodiment of the present invention, when the present application is specifically implemented, compared with the first, second and third embodiments, the technical solution of this embodiment is to combine and implement the solutions of the above-mentioned first, second, third and fourth embodiments.

[0144] Since the fourth embodiment of the present embodiment combines the solutions of the first, second and third embodiments, it integrates all the beneficial effects of the above three embodiments, can perform smart medical security management more comprehensively and accurately, and provide stronger protection for the security of the medical information system.

[0145] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0146] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A smart medical safety management system, characterized in that: include: A data collection unit, used to collect various information data from a medical information system; Information data includes: user login information including login timestamp, login IP address, login username, medical data operation records including data reading timestamp, modification content, and identity of the modifier; The risk analysis unit is used to evaluate and analyze the behavior anomaly of the corresponding user based on various information data, and obtain the behavior anomaly evaluation value of the corresponding user according to the analysis result; The security warning unit is used to perform security warning processing based on the abnormal behavior assessment value corresponding to each user obtained by the risk analysis unit, determine the user with abnormal behavior based on the processing result, and generate a warning signal based on it.

2. According to claim 1, a smart medical safety management system is characterized in that: The abnormal assessment analysis method is as follows: Step 1: Extract abnormal factors from user login information Step 1.1, extract the login timestamp, login IP address, and login user name of each user who logs into the system within the specified period; Step 1.2, then obtain the commonly used login time database and commonly used IP address database pre-established for the user according to the login user name; Step 1.3, then compare the login timestamp and login IP address of each login within the specified period with the commonly used login time database and commonly used IP address database respectively: Step 1.4, extract the total number of logins of the relevant users in the specified period, then add the number of abnormal time logins and the number of remote logins of the relevant users in the specified period, divide the sum by the total number of logins, and then mark the result as the login abnormality factor; Step 2: Extracting abnormal factors from medical data operation records Step 2.1, extract the data reading timestamp and modification content in all medical data operation records of relevant users within a specified period based on the identity of the modifier; The modified content corresponds to a predetermined content modification determination value, which refers to the difference calculated by extracting the original data content and the current data content and converting them into binary data, and is used to determine whether the relevant data content is modified content; Step 2.2, determine the amount of medical data read by the relevant user within the specified period based on the number of data reading timestamps, and record it as the data reading amount; At the same time, the amount of content modified by the relevant user within the specified period is determined based on the content modification judgment value, and recorded as the modified content amount; Step 2.3, divide the amount of content modified in the specified period by the amount of data read, and multiply the quotient by the corresponding preset weight coefficient; Step 2.4, add up the content modification judgment values ​​corresponding to all modified contents within the specified period, and multiply the sum by the corresponding preset weight coefficient; Step 2.5, add the results obtained in Step 2.3 and Step 2.4, and then mark the result as the operation abnormality factor; Step 3: Multi-factor risk assessment By R=F1×γ1+F2×γ2, the behavior abnormality evaluation value R of the corresponding user in the medical information system is calculated; Wherein, F1 is the login abnormality factor of the corresponding user, F2 is the operation abnormality factor of the corresponding user, and γ1 and γ2 are the corresponding preset weight coefficients respectively.

3. The intelligent medical safety management system according to claim 2, characterized in that: The comparison method of Step 1.3 is as follows: select the user login information of any one login to the system; Step 1.

31. If the login timestamp is not in the common login time database, the user's login is determined to be an abnormal time login, and the number of abnormal time logins is increased by one; otherwise, the number of abnormal time logins remains unchanged; Step 1.

32. If the login IP address is not in the commonly used IP address database, the user's login is determined to be a remote login, and the number of remote logins is increased by one; otherwise, the number of remote logins remains unchanged.

4. The intelligent medical safety management system according to claim 1, characterized in that: The security warning processing method is as follows: Select a user; Extract the user's behavior anomaly assessment value and then compare it with the preset behavior anomaly threshold: If the behavior anomaly assessment value is greater than or equal to the behavior anomaly threshold, a warning signal is generated; And so on, security warnings are issued to all users.

5. The intelligent medical safety management system according to claim 4, characterized in that: in, The warning signal is used to trigger a security warning, which indicates that the user has abnormal behavior in the medical information system. The basic information of the user when registering in the medical information system is then obtained, and the user's basic information, user login information, and abnormal factors in the medical data operation records are pushed to relevant managers.

6. The intelligent medical safety management system according to claim 1, characterized in that: in, In the user login information, the login timestamp is accurate to milliseconds, the login IP address is collected in the form of a string, and the login user name is recorded in text form.

7. The intelligent medical safety management system according to claim 1, characterized in that: For medical data operation records: when there is a data read or modification operation, the data read timestamp is recorded, and the modified content is determined and recorded by binary difference comparison.

8. The intelligent medical safety management system according to claim 7, characterized in that: The content of the modification is determined as follows: Extract the original data content and convert it into binary data, extract the current data content and convert it into binary data, then calculate the difference between the two sets of binary data, and record the difference as the content modification judgment value. If the content modification judgment value is 0, the corresponding data content is not judged as modified content. Otherwise, it is judged as modified content.

9. The intelligent medical safety management system according to claim 3, characterized in that: in, The common login time database is established as follows: First, after the user registers and logs into the system for the first time, the login information is recorded, which is to record the login timestamp of each time the user logs into the system in detail during the specified initial observation period; then the observation period is divided into multiple standard time periods, and each standard time period is further divided into several interval time periods; then the number of logins corresponding to each standard time period is obtained, and it is recorded as the number of time period logins; at the same time, the number of logins in each interval time period within the standard time period is obtained, and it is recorded as the number of interval logins; Select a standard time period; Divide the number of logins in each interval time period by the number of logins in the standard time period, and obtain the login frequency of each interval time period in the standard time period; And so on, the login frequency of each interval time period in each standard time period is obtained; Afterwards, in each standard time period, the login frequency of the same interval time period is selected and its mean is calculated and recorded as the frequency analysis value; The frequency analysis value is then compared with the preset login frequency threshold: If the frequency analysis value is greater than or equal to the login frequency threshold, the interval time period is included in the common login time library, otherwise the interval time period is not included in the common login time library.

10. The intelligent medical safety management system according to claim 3, characterized in that: in, The common IP address database is established as follows: First, after the user registers and logs into the system for the first time, the login information is recorded, which is to record in detail the login IP address of the user each time he logs into the system during the specified initial observation period; then the number of occurrences of each IP address during the observation period is obtained; then the total number of occurrences of all IP addresses is obtained by adding up the number of occurrences of each IP address; Divide the number of login occurrences of each IP address by the total number of occurrences of all IP addresses, and obtain the occurrence frequency of each IP address; then compare the occurrence frequency with the preset occurrence frequency: An IP address is selected. If the occurrence frequency is greater than or equal to the occurrence frequency threshold, the IP address is included in the common IP address database. Otherwise, the IP address is not included in the common IP address database.

Images