A pharmaceutical supply chain data security intelligent monitoring system and method

Abstract

The present invention discloses a pharmaceutical supply chain data security intelligent monitoring system and method, and relates to the field of intelligent monitoring technology. The system of the present invention includes: a data collection and processing module, a feature analysis and trend monitoring module, a risk transfer and diffusion analysis module, and a real-time monitoring and early warning response module; the data collection and processing module collects historical data and event logs of each node, and extracts data features; the feature analysis and trend monitoring module analyzes the trend changes of data features, calculates the deviation and early warning indicators between normal and abnormal events; the risk transfer and diffusion analysis module analyzes the risk transfer path and diffusion range of abnormal events; the real-time monitoring and early warning response module monitors data in real time, calculates real-time early warning indicators, predicts risk paths and outputs information; the present invention can achieve comprehensive identification and early warning of potential data security risks in the pharmaceutical supply chain by integrating data analysis and real-time monitoring of each module.

Description

Technical Field

[0001] The present invention relates to the field of intelligent monitoring technology, and in particular to a pharmaceutical supply chain data security intelligent monitoring system and method. Background Art

[0002] With the rapid development of information technology, the pharmaceutical supply chain has continued to expand under the impetus of globalization and digitalization, and its complexity and scale have also grown accordingly. However, as supply chain management becomes increasingly modernized, data security issues have become increasingly prominent. As an important industry related to public health, the sensitive data involved in the pharmaceutical supply chain is directly related to the quality, safety and compliance of drugs. Therefore, ensuring the security, integrity and compliance of data in the supply chain has become a core issue that needs to be addressed urgently.

[0003] At present, existing technologies have significant deficiencies in data security protection and abnormal behavior detection. Many traditional supply chain management systems lack intelligent data security monitoring mechanisms and often rely on static rules and manual intervention for data security protection. These systems have limitations in identifying complex abnormal behaviors and potential risks. They can usually only perform simple rule verification and cannot identify and process complex abnormal patterns in data streams in real time. More importantly, the existing technology lacks analysis of the impact of abnormal behavior of a supply chain node in the pharmaceutical supply chain on other supply chain nodes, resulting in the inability to fully identify and warn potential risks. This detection mechanism lacks a global perspective, which may cause abnormal behavior occurring at a single node in the supply chain to be ignored, thereby affecting the safety, efficiency and compliance of the entire supply chain. For example, abnormal inventory data in a warehouse may directly affect transportation scheduling and drug quality tracking, but existing technologies often fail to associate risks between different nodes in real time, leading to the accumulation and outbreak of problems. Summary of the invention

[0004] The purpose of the present invention is to provide a pharmaceutical supply chain data security intelligent monitoring system and method to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: A method for intelligently monitoring data security in a pharmaceutical supply chain comprises the following steps: Step S100. Collect historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform, and divide the corresponding historical data according to the event log for each supply chain node; based on the division results of the historical data, extract the historical data features of the corresponding events respectively; the events recorded in the event log include normal events and abnormal events; Step S200. According to the historical data characteristics of the events corresponding to each supply chain node, the corresponding historical data characteristic trend curves are constructed respectively; based on the historical data characteristic trend curves of the corresponding events, the deviation relationship between the historical data characteristic trend curves between normal events and abnormal events is analyzed, so as to obtain the abnormal warning indicators of the corresponding supply chain nodes; Step S300. Based on the information transmission path between each supply chain node in the pharmaceutical supply chain, the correlation between the abnormal event warning indicators of each supply chain node in the pharmaceutical supply chain is analyzed, so as to identify the potential risk transmission path corresponding to each abnormal event of the supply chain node, thereby obtaining the corresponding potential risk diffusion range; Step S400. Obtain the real-time data and real-time event record log of each supply chain node, and calculate the real-time abnormal warning index of the corresponding supply chain node according to the real-time event record log; predict the real-time risk transmission path of the corresponding supply chain node according to the real-time abnormal event warning index, and obtain the real-time risk diffusion range according to the real-time risk transmission path, output the real-time risk transmission path and the real-time risk diffusion range to relevant personnel, and have the relevant personnel do further processing.

[0006] Furthermore, step S100 includes: S101. Collect historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform. The historical data refers to the operational data of each supply chain node in the pharmaceutical supply chain, including but not limited to inventory data, transaction data, transportation data, etc.; for each supply chain node, analyze the event log in chronological order, and divide the historical data into different time periods according to the start time and end time of the event in the event log, and each time period corresponds to an event; according to the normal events and abnormal events in the event log, construct a normal event data set A and an abnormal event data set B respectively, where A={a1,a2,...,an}, B= {b1, b2, ..., bm}, where a1 represents the historical data corresponding to the first normal event in the event log, a2 represents the historical data corresponding to the second normal event in the event log, and so on, an represents the historical data corresponding to the nth normal event in the event log, and n represents the number of normal events in the event log; similarly, b1 represents the historical data corresponding to the first abnormal event in the event log, b2 represents the historical data corresponding to the second abnormal event in the event log, bm represents the historical data corresponding to the mth abnormal event in the event log, and m represents the number of abnormal events in the event log; S102. For each normal event in the normal event data set A, the historical data corresponding to each normal event is divided into several data segments according to the set time window. For each data segment, feature extraction is performed from the same dimension to obtain the historical data features corresponding to the normal event, and normalization is performed to construct the corresponding historical data feature vector Va. Each normal event corresponds to several historical data feature vectors Va, where Va=[va1,va2,...,vac], va1 represents the first dimension historical data feature value corresponding to the normal event, va2 represents the second dimension historical data feature value corresponding to the normal event. dimensional historical data feature value, and so on, vac represents the c-th dimension historical data feature value corresponding to the normal event, and c represents the number of dimensions of the historical data feature vector; similarly, for the historical data corresponding to each abnormal event in the abnormal event data set B, the analysis is performed according to the analysis method of the historical data of normal events in the normal event data set A, so as to construct the corresponding historical data feature vector Vb, and vb1 represents the 1st dimension historical data feature value corresponding to the abnormal event, vb2 represents the 2nd dimension historical data feature value corresponding to the abnormal event, and vbc represents the c-th dimension historical data feature value corresponding to the abnormal event.

[0007] Further, step S200 includes: S201. For each normal event in the normal event data set A, the corresponding several historical data feature vectors Va are summarized; for each dimension in the historical data feature vector Va, the corresponding historical data feature trend curve La is drawn respectively, and the horizontal axis of the historical data feature trend curve La is the time window, and the vertical axis is the historical data feature of the corresponding dimension; several historical data feature trend curves La corresponding to the same dimension of the same normal event are represented in the same plane rectangular coordinate system, and several historical data feature trend curves La are fitted into a trend curve, and this trend curve is used as the trend curve Qa of the corresponding normal event dimension; similarly, the same analysis is performed on each abnormal event in the abnormal event data set B, so as to obtain the trend curve Qb of the corresponding abnormal event dimension, wherein the trend curve corresponding to each normal event and abnormal event is equal to the dimension of the corresponding historical data feature vector; S202. For each supply chain node, the trend curve Qa of each dimension corresponding to the normal event and the trend curve Qb of the same dimension of the abnormal event are sequentially subjected to deviation analysis, and the dynamic time warping distance DTW between the two trend curves is calculated, and the specific calculation formula is: , Among them, min f∈Frepresents the minimum value of all possible time window alignment modes f, and F represents the set of all possible time window alignment modes; Qa(tr) and Qb(tr) represent the historical data feature values ​​of the trend curve Qa of normal events and the trend curve Qb of abnormal events in the time window tr, respectively, and k represents the number of time windows; referring to the deviation analysis process of the trend curve Qa of each dimension corresponding to the normal event and the trend curve Qb of the same dimension of the abnormal event, the dynamic time warping distance between the trend curves Qa of each dimension corresponding to different normal events of the corresponding supply chain node is calculated in turn, and the average value μ and standard deviation σ are calculated, so as to obtain the deviation threshold E of the corresponding supply chain node, and E=μ+g×σ, where g represents the coefficient, which is used to adjust the sensitivity of the threshold, and g is usually selected as 2 or 3; S203. According to the deviation between the trend curves of the same dimension between the normal event and the abnormal event, the corresponding abnormal event warning index P is calculated, and the specific calculation formula is: , Among them, α is the adjustment factor, which is used to control the response speed of the early warning indicator to the deviation change; the abnormal event early warning indicators P of all dimensions are summarized, and the average value is calculated as the abnormal warning indicator P0 of the abnormal event corresponding to the supply chain node.

[0008] Furthermore, step S300 includes: S301. Based on the information transmission path between each supply chain node in the pharmaceutical supply chain, combined with the corresponding historical data, the time interval T between each completed information transmission between two adjacent supply chain nodes in the pharmaceutical supply chain is obtained; for the abnormal event corresponding to each supply chain node Gu, according to the time interval T between each completed information transmission between two adjacent supply chain nodes in the pharmaceutical supply chain, the timestamp ty of the abnormal event related information corresponding to the supply chain node Gu transmitted to the next supply chain node Gu+1 is calculated, and the timestamp ty is equal to the sum of the start time of the abnormal event corresponding to the supply chain node Gu and the time interval T; S302. Summarize all abnormal event related information of the supply chain node Gu and pass it to the timestamp ty of the next supply chain node Gu+1, and search for the event including the timestamp ty in the event log of the next supply chain node Gu+1 according to the timestamp ty, retain the found event including the timestamp ty as the abnormal event, and associate the abnormal event of the supply chain node Gu with the abnormal event including the timestamp ty in the event log of the next supply chain node Gu+1; traverse all supply chain nodes in the pharmaceutical supply chain in turn, so as to obtain the abnormal event association sequence corresponding to the supply chain node Gu; S303. According to the abnormal event association sequence corresponding to the supply chain node Gu, the potential risk transmission path of the abnormal event corresponding to the supply chain node Gu is obtained, the number of abnormal events in the abnormal event association sequence is used as the potential risk diffusion range of the abnormal event corresponding to the supply chain node Gu, and the abnormal warning indicator P0, potential risk transmission path and potential risk diffusion range of the abnormal event corresponding to the supply chain node Gu are matched one-to-one.

[0009] Furthermore, step S400 includes: S401. Obtain the real-time data and real-time event log of each supply chain node, refer to the analysis process of historical data, perform the same analysis on the real-time data, and calculate the real-time abnormal warning index P1 of the corresponding supply chain node according to the real-time event log; compare the real-time abnormal warning index P1 with the abnormal warning index P0 of the corresponding supply chain node, and select the one with the smallest |P1-P0| result as the final matching result; S402. Obtain the abnormal warning indicator P0 corresponding to the matching result, and search in the corresponding supply chain node according to the abnormal warning indicator P0 to determine whether there is an abnormal event association sequence for the abnormal warning indicator P0; if not, notify the relevant personnel to handle the abnormal event of the current supply chain node; if so, obtain the abnormal warning indicator P0, potential risk transmission path and potential risk diffusion range of the abnormal event according to the abnormal event association sequence, and output the potential risk transmission path and potential risk diffusion range to the relevant personnel for further processing.

[0010] A pharmaceutical supply chain data security intelligent monitoring system, comprising: a data collection and processing module, a feature analysis and trend monitoring module, a risk transfer and diffusion analysis module, and a real-time monitoring and early warning response module; The data collection and processing module collects historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform. For each supply chain node, the corresponding historical data is divided according to the event log; based on the division results of the historical data, the historical data features of the corresponding events are extracted respectively; The feature analysis and trend monitoring module constructs the corresponding historical data feature trend curves according to the historical data features of the corresponding events of each supply chain node; based on the historical data feature trend curves of the corresponding events, the deviation relationship between the historical data feature trend curves of normal events and abnormal events is analyzed to obtain the abnormal warning indicators of the corresponding supply chain nodes; The risk transmission and diffusion analysis module analyzes the correlation between the abnormal event warning indicators of each supply chain node in the pharmaceutical supply chain based on the information transmission path between each supply chain node in the pharmaceutical supply chain, thereby identifying the potential risk transmission path corresponding to each abnormal event in the supply chain node, and thus obtaining the corresponding potential risk diffusion range; The real-time monitoring and early warning response module obtains the real-time data and real-time event record logs of each supply chain node, and calculates the real-time abnormal early warning indicators of the corresponding supply chain nodes based on the real-time event record logs; based on the real-time abnormal event early warning indicators, the real-time risk transmission path of the corresponding supply chain node is predicted, and the real-time risk diffusion range is obtained based on the real-time risk transmission path, and the real-time risk transmission path and real-time risk diffusion range are output to relevant personnel for further processing.

[0011] Further, the data collection and processing module includes a data collection unit, a data partitioning and feature extraction unit, and a data normalization and feature vector construction unit; The data collection unit collects historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform; the data partitioning and feature extraction unit divides the historical data into time according to the event log, extracts data features from each event, and constructs normal event data sets and abnormal event data sets; the data normalization and feature vector construction unit partitions and extracts features from the historical data of normal events and abnormal events, and constructs normalized historical data feature vectors respectively.

[0012] Furthermore, the feature analysis and trend monitoring module includes a trend curve construction unit, a deviation analysis unit and an early warning indicator calculation unit; The trend curve construction unit constructs the historical data characteristic trend curves of normal events and abnormal events based on the historical data characteristics of each supply chain node; the deviation analysis unit calculates the dynamic time regularization distance between the trend curves of normal events and abnormal events, and obtains the deviation value; the warning indicator calculation unit calculates the warning indicators of abnormal events based on deviation analysis, summarizes the abnormal warning indicators of each dimension, and thus obtains a comprehensive abnormal warning indicator.

[0013] Further, the risk transfer and diffusion analysis module includes an information transfer path analysis unit, a risk path identification unit, and a risk diffusion range calculation unit; The information transmission path analysis unit calculates the information transmission time interval of abnormal events at each supply chain node based on the information transmission path of each node in the pharmaceutical supply chain, and infers the transmission timestamp of the abnormal event; the risk path identification unit analyzes the association between abnormal events at each supply chain node based on the timestamp of the abnormal event, and identifies potential risk transmission paths; the risk diffusion range calculation unit calculates the potential risk diffusion range of abnormal events based on the association sequence of abnormal events, and corresponds it with the corresponding early warning indicators and risk transmission paths.

[0014] Furthermore, the real-time monitoring and early warning response module includes a real-time data collection and analysis unit, a real-time early warning matching unit, and a real-time risk response unit; The real-time data collection and analysis unit obtains the real-time data and event record logs of each supply chain node, and calculates the real-time abnormal warning indicators by referring to the analysis process of historical data; the real-time warning matching unit compares the real-time abnormal warning indicators with the historical abnormal warning indicators to obtain the matching results; the real-time risk response unit determines whether there is a sequence of abnormal event associations based on the matching results, and outputs the potential risk transmission path and diffusion range, and notifies relevant personnel to handle it.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention intelligently collects and analyzes the historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform, and can effectively identify complex abnormal behaviors and potential risks based on data feature extraction and trend analysis; compared with traditional static rules and manual intervention, it has higher flexibility and accuracy, can identify and process abnormal patterns in data streams in real time, and reduce the occurrence of human errors. The prior art is often limited to the abnormal detection of a single node, ignoring the mutual influence and risk propagation between supply chain nodes; the present invention realizes the detection and early warning of abnormal events from a global perspective by analyzing the deviation relationship between the historical data feature trends and abnormal behaviors of each node in the supply chain, and can comprehensively identify the propagation path of potential risks, effectively avoiding the occurrence of global risks caused by local problems. By calculating the deviation between the characteristic trend curves of historical data, the present invention introduces the dynamic time warping distance (DTW) to quantify the deviation between normal events and abnormal events, and further optimizes the detection accuracy of abnormal events; this method can overcome the limitations of fixed thresholds in traditional detection methods and ensure stronger adaptability to different types of abnormal behaviors. On the basis of traditional anomaly detection, the present invention further considers the information transmission path between each node in the pharmaceutical supply chain, and can identify the potential spread range and risk transmission path of abnormal events in the supply chain; this full-chain, systematic risk identification capability can prevent abnormal problems at a single node from causing greater risks in other nodes or supply chain links. The present invention can not only perform intelligent analysis of historical data, but also obtain real-time data and event logs of each supply chain node in real time, and calculate abnormal warning indicators based on real-time events; this enables supply chain managers to understand the current security status of the supply chain in a timely manner, and adjust preventive measures based on real-time warning indicators, so as to respond to and deal with potential risks more quickly. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 It is a schematic diagram of a module of a pharmaceutical supply chain data security intelligent monitoring system of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] See also Figure 1 , the present invention provides a technical solution: A pharmaceutical supply chain data security intelligent monitoring system, comprising: a data collection and processing module, a feature analysis and trend monitoring module, a risk transfer and diffusion analysis module, and a real-time monitoring and early warning response module; The data collection and processing module collects historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform. For each supply chain node, the corresponding historical data is divided according to the event log; based on the division results of the historical data, the historical data features of the corresponding events are extracted respectively; The feature analysis and trend monitoring module constructs the corresponding historical data feature trend curves according to the historical data features of the corresponding events of each supply chain node; based on the historical data feature trend curves of the corresponding events, the deviation relationship between the historical data feature trend curves of normal events and abnormal events is analyzed to obtain the abnormal warning indicators of the corresponding supply chain nodes; The risk transmission and diffusion analysis module analyzes the correlation between the abnormal event warning indicators of each supply chain node in the pharmaceutical supply chain based on the information transmission path between each supply chain node in the pharmaceutical supply chain, thereby identifying the potential risk transmission path corresponding to each abnormal event in the supply chain node, and thus obtaining the corresponding potential risk diffusion range; The real-time monitoring and early warning response module obtains the real-time data and real-time event record logs of each supply chain node, and calculates the real-time abnormal early warning indicators of the corresponding supply chain nodes based on the real-time event record logs; based on the real-time abnormal event early warning indicators, the real-time risk transmission path of the corresponding supply chain node is predicted, and the real-time risk diffusion range is obtained based on the real-time risk transmission path, and the real-time risk transmission path and real-time risk diffusion range are output to relevant personnel for further processing.

[0019] The data collection and processing module includes a data collection unit, a data partitioning and feature extraction unit, and a data normalization and feature vector construction unit; The data collection unit collects historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform; the data partitioning and feature extraction unit divides the historical data into time according to the event log, extracts data features from each event, and constructs normal event data sets and abnormal event data sets; the data normalization and feature vector construction unit partitions and extracts features from the historical data of normal events and abnormal events, and constructs normalized historical data feature vectors respectively.

[0020] The feature analysis and trend monitoring module includes a trend curve construction unit, a deviation analysis unit, and an early warning indicator calculation unit; The trend curve construction unit constructs the historical data characteristic trend curves of normal events and abnormal events based on the historical data characteristics of each supply chain node; the deviation analysis unit calculates the dynamic time regularization distance between the trend curves of normal events and abnormal events, and obtains the deviation value; the warning indicator calculation unit calculates the warning indicators of abnormal events based on deviation analysis, summarizes the abnormal warning indicators of each dimension, and thus obtains a comprehensive abnormal warning indicator.

[0021] The risk transmission and diffusion analysis module includes an information transmission path analysis unit, a risk path identification unit, and a risk diffusion range calculation unit; The information transmission path analysis unit calculates the information transmission time interval of abnormal events at each supply chain node based on the information transmission path of each node in the pharmaceutical supply chain, and infers the transmission timestamp of the abnormal event; the risk path identification unit analyzes the association between abnormal events at each supply chain node based on the timestamp of the abnormal event, and identifies potential risk transmission paths; the risk diffusion range calculation unit calculates the potential risk diffusion range of abnormal events based on the association sequence of abnormal events, and corresponds it with the corresponding early warning indicators and risk transmission paths.

[0022] The real-time monitoring and early warning response module includes a real-time data collection and analysis unit, a real-time early warning matching unit, and a real-time risk response unit; The real-time data collection and analysis unit obtains the real-time data and event record logs of each supply chain node, and calculates the real-time abnormal warning indicators by referring to the analysis process of historical data; the real-time warning matching unit compares the real-time abnormal warning indicators with the historical abnormal warning indicators to obtain the matching results; the real-time risk response unit determines whether there is a sequence of abnormal event associations based on the matching results, and outputs the potential risk transmission path and diffusion range, and notifies relevant personnel to handle it.

[0023] A method for intelligently monitoring data security in a pharmaceutical supply chain comprises the following steps: Step S100. Collect historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform, and divide the corresponding historical data according to the event log for each supply chain node; based on the division results of the historical data, extract the historical data features of the corresponding events respectively; the events recorded in the event log include normal events and abnormal events; Step S200. According to the historical data characteristics of the events corresponding to each supply chain node, the corresponding historical data characteristic trend curves are constructed respectively; based on the historical data characteristic trend curves of the corresponding events, the deviation relationship between the historical data characteristic trend curves between normal events and abnormal events is analyzed, so as to obtain the abnormal warning indicators of the corresponding supply chain nodes; Step S300. Based on the information transmission path between each supply chain node in the pharmaceutical supply chain, the correlation between the abnormal event warning indicators of each supply chain node in the pharmaceutical supply chain is analyzed, so as to identify the potential risk transmission path corresponding to each abnormal event of the supply chain node, thereby obtaining the corresponding potential risk diffusion range; Step S400. Obtain the real-time data and real-time event record log of each supply chain node, and calculate the real-time abnormal warning index of the corresponding supply chain node according to the real-time event record log; predict the real-time risk transmission path of the corresponding supply chain node according to the real-time abnormal event warning index, and obtain the real-time risk diffusion range according to the real-time risk transmission path, output the real-time risk transmission path and the real-time risk diffusion range to relevant personnel, and have the relevant personnel do further processing.

[0024] Step S100 includes: S101. Collect historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform. The historical data refers to the operational data of each supply chain node in the pharmaceutical supply chain, including but not limited to inventory data, transaction data, transportation data, etc.; for each supply chain node, analyze the event log in chronological order, and divide the historical data into different time periods according to the start time and end time of the event in the event log, and each time period corresponds to an event; according to the normal events and abnormal events in the event log, construct a normal event data set A and an abnormal event data set B respectively, where A={a1,a2,...,an}, B= {b1, b2, ..., bm}, where a1 represents the historical data corresponding to the first normal event in the event log, a2 represents the historical data corresponding to the second normal event in the event log, and so on, an represents the historical data corresponding to the nth normal event in the event log, and n represents the number of normal events in the event log; similarly, b1 represents the historical data corresponding to the first abnormal event in the event log, b2 represents the historical data corresponding to the second abnormal event in the event log, bm represents the historical data corresponding to the mth abnormal event in the event log, and m represents the number of abnormal events in the event log; S102. For each normal event in the normal event data set A, the historical data corresponding to each normal event is divided into several data segments according to the set time window. For each data segment, feature extraction is performed from the same dimension to obtain the historical data features corresponding to the normal event, and normalization is performed to construct the corresponding historical data feature vector Va. Each normal event corresponds to several historical data feature vectors Va, where Va=[va1,va2,...,vac], va1 represents the first dimension historical data feature value corresponding to the normal event, va2 represents the second dimension historical data feature value corresponding to the normal event. dimensional historical data feature value, and so on, vac represents the c-th dimension historical data feature value corresponding to the normal event, and c represents the number of dimensions of the historical data feature vector; similarly, for the historical data corresponding to each abnormal event in the abnormal event data set B, the analysis is performed according to the analysis method of the historical data of normal events in the normal event data set A, so as to construct the corresponding historical data feature vector Vb, and vb1 represents the 1st dimension historical data feature value corresponding to the abnormal event, vb2 represents the 2nd dimension historical data feature value corresponding to the abnormal event, and vbc represents the c-th dimension historical data feature value corresponding to the abnormal event.

[0025] In this embodiment, let tij_0 be the start time of the jth event of the i-th supply chain node in the event log, tij_1 be the end time of the event, and Dik be the data of the i-th supply chain node at the kth time point. Then the data set Dij corresponding to the jth event of the i-th supply chain node can be expressed as: Dij={Dik|tij_0≤k≤tij_1}; For each divided event data set, historical data features are extracted from multiple dimensions. These dimensions may include statistical features of data (such as mean, median, standard deviation, etc.), distribution features of data (such as skewness coefficient, peak coefficient, etc.), rate of change of data (such as the difference ratio of data at adjacent time points), etc. The specific historical data features extracted are determined according to the specific data.

[0026] Step S200 includes: S201. For each normal event in the normal event data set A, the corresponding several historical data feature vectors Va are summarized; for each dimension in the historical data feature vector Va, the corresponding historical data feature trend curve La is drawn respectively, and the horizontal axis of the historical data feature trend curve La is the time window, and the vertical axis is the historical data feature of the corresponding dimension; several historical data feature trend curves La corresponding to the same dimension of the same normal event are represented in the same plane rectangular coordinate system, and several historical data feature trend curves La are fitted into a trend curve, and this trend curve is used as the trend curve Qa of the corresponding normal event dimension; similarly, the same analysis is performed on each abnormal event in the abnormal event data set B, so as to obtain the trend curve Qb of the corresponding abnormal event dimension, wherein the trend curve corresponding to each normal event and abnormal event is equal to the dimension of the corresponding historical data feature vector; In this embodiment, for each normal event in the normal event data set A, assuming that there are s historical data characteristic trend curves Qa that need to be fitted, the weighted least square method can be used for fitting. First, the weight wj of each trend curve needs to be determined, and the weight can be set according to the quality, reliability or other relevant factors of the data. For example, the weight can be determined according to factors such as the number of data points and the degree of fluctuation of the data.

[0027] Assuming that the fitted trend curve is y=f(t), common fitting function forms can be polynomial function, exponential function, logarithmic function, etc. Here, taking the polynomial function as an example, the fitted polynomial function is: y=a0+a1t+a2t2+...+aptp; where p is the degree of the polynomial, and a0, a1,..., ap are the fitting coefficients to be determined; by solving the fitting coefficients, the final fitted trend curve is obtained.

[0028] S202. For each supply chain node, the trend curve Qa of each dimension corresponding to the normal event and the trend curve Qb of the same dimension of the abnormal event are sequentially subjected to deviation analysis, and the dynamic time warping distance DTW between the two trend curves is calculated, and the specific calculation formula is: , Among them, min f∈Frepresents the minimum value of all possible time window alignment modes f, and F represents the set of all possible time window alignment modes; Qa(tr) and Qb(tr) represent the historical data feature values ​​of the trend curve Qa of normal events and the trend curve Qb of abnormal events in the time window tr, respectively, and k represents the number of time windows; referring to the deviation analysis process of the trend curve Qa of each dimension corresponding to the normal event and the trend curve Qb of the same dimension of the abnormal event, the dynamic time warping distance between the trend curves Qa of each dimension corresponding to different normal events of the corresponding supply chain node is calculated in turn, and the average value μ and standard deviation σ are calculated, so as to obtain the deviation threshold E of the corresponding supply chain node, and E=μ+g×σ, where g represents the coefficient, which is used to adjust the sensitivity of the threshold, and g is usually selected as 2 or 3; S203. According to the deviation between the trend curves of the same dimension between the normal event and the abnormal event, the corresponding abnormal event warning index P is calculated, and the specific calculation formula is: , Among them, α is the adjustment factor, which is used to control the response speed of the early warning indicator to the deviation change; the abnormal event early warning indicators P of all dimensions are summarized, and the average value is calculated as the abnormal warning indicator P0 of the abnormal event corresponding to the supply chain node.

[0029] In this embodiment, it is assumed that a supply chain node has three dimensions, five normal events and five abnormal events. The following are simplified steps: For normal events, extract the historical data feature vectors of inventory, production, and transportation, and draw the trend curve La (each dimension has a trend curve); perform the same operation for abnormal events to obtain the corresponding trend curve Qb. Use the DTW algorithm to calculate the distance between the trend curve of normal events and the trend curve of abnormal events (for example, the DTW distance of the inventory dimension is 2.3, the DTW distance of the production dimension is 3.1, and the DTW distance of the transportation dimension is 1.7).

[0030] Calculate the mean μ and standard deviation σ of the DTW distance of the normal event trend curve, and calculate the deviation threshold E (assuming μ=2.0, σ=0.5, g=2, then E=3.0).

[0031] Calculate the warning indicator P of abnormal events. For example, for the inventory dimension, if the DTW distance is 2.3, the result of P calculation is 0.52; for other dimensions, perform the same calculation according to the inventory dimension, summarize the P values ​​of all dimensions, and calculate the average value to obtain the corresponding abnormal warning indicator P0 of the supply chain node.

[0032] Step S300 includes: S301. Based on the information transmission path between each supply chain node in the pharmaceutical supply chain, combined with the corresponding historical data, the time interval T between each completed information transmission between two adjacent supply chain nodes in the pharmaceutical supply chain is obtained; for the abnormal event corresponding to each supply chain node Gu, according to the time interval T between each completed information transmission between two adjacent supply chain nodes in the pharmaceutical supply chain, the timestamp ty of the abnormal event related information corresponding to the supply chain node Gu transmitted to the next supply chain node Gu+1 is calculated, and the timestamp ty is equal to the sum of the start time of the abnormal event corresponding to the supply chain node Gu and the time interval T; S302. Summarize all abnormal event related information of the supply chain node Gu and pass it to the timestamp ty of the next supply chain node Gu+1, and search for the event including the timestamp ty in the event log of the next supply chain node Gu+1 according to the timestamp ty, retain the found event including the timestamp ty as the abnormal event, and associate the abnormal event of the supply chain node Gu with the abnormal event including the timestamp ty in the event log of the next supply chain node Gu+1; traverse all supply chain nodes in the pharmaceutical supply chain in turn, so as to obtain the abnormal event association sequence corresponding to the supply chain node Gu; S303. According to the abnormal event association sequence corresponding to the supply chain node Gu, the potential risk transmission path of the abnormal event corresponding to the supply chain node Gu is obtained, the number of abnormal events in the abnormal event association sequence is used as the potential risk diffusion range of the abnormal event corresponding to the supply chain node Gu, and the abnormal warning indicator P0, potential risk transmission path and potential risk diffusion range of the abnormal event corresponding to the supply chain node Gu are matched one-to-one.

[0033] In this embodiment, it is assumed that the number of supply chain nodes in the pharmaceutical supply chain is 4, and the information transmission path in the pharmaceutical supply chain is: G1→G2→G3→G4; taking the supply chain node G1 as an example, assuming that the start time of a certain abnormal event in the supply chain node G1 is t0, and the time interval T of the information transmission from the supply chain node G1 to the supply chain node G2 in the time period of this abnormal event, then calculate the timestamp ty of the abnormal event related information corresponding to the supply chain node G1 transmitted to the next supply chain node G2, and ty=t0+T; according to the timestamp ty, search in the event record log of the supply chain node G2, if the event containing the timestamp ty is a normal event, then it means that the abnormal event corresponding to the supply chain node G1 has been processed or has not been processed at all. There is a further impact on the supply chain node G2; if the event containing the timestamp ty is an abnormal event, it means that the abnormal event corresponding to the supply chain node G1 has not been processed in time or further affects the supply chain node G2, then the abnormal event corresponding to the supply chain node G1 is associated with the abnormal event of the supply chain node G2; then traverse to G2→G3 and G3→G4 in turn, assuming that the potential risk transmission path corresponding to this abnormal event in the supply chain node G1 is: G1→G2→G3, then the corresponding potential risk diffusion range is 3, and the abnormal warning indicator P0 of an abnormal event in the supply chain node G1 is obtained, so as to correspond the abnormal warning indicator P0, the potential risk transmission path: G1→G2→G3 and the potential risk diffusion range of 3.

[0034] Step S400 includes: S401. Obtain the real-time data and real-time event log of each supply chain node, refer to the analysis process of historical data, perform the same analysis on the real-time data, and calculate the real-time abnormal warning index P1 of the corresponding supply chain node according to the real-time event log; compare the real-time abnormal warning index P1 with the abnormal warning index P0 of the corresponding supply chain node, and select the one with the smallest |P1-P0| result as the final matching result; S402. Obtain the abnormal warning indicator P0 corresponding to the matching result, and search in the corresponding supply chain node according to the abnormal warning indicator P0 to determine whether there is an abnormal event association sequence for the abnormal warning indicator P0; if not, notify the relevant personnel to handle the abnormal event of the current supply chain node; if so, obtain the abnormal warning indicator P0, potential risk transmission path and potential risk diffusion range of the abnormal event according to the abnormal event association sequence, and output the potential risk transmission path and potential risk diffusion range to the relevant personnel for further processing.

[0035] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0036] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for intelligent monitoring of pharmaceutical supply chain data security, characterized by: The method comprises the following steps: Step S100. Collect historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform, and divide the corresponding historical data according to the event log for each supply chain node; based on the division results of the historical data, extract the historical data features of the corresponding events respectively; the events recorded in the event log include normal events and abnormal events; Step S200. According to the historical data characteristics of the events corresponding to each supply chain node, the corresponding historical data characteristic trend curves are constructed respectively; based on the historical data characteristic trend curves of the corresponding events, the deviation relationship between the historical data characteristic trend curves between normal events and abnormal events is analyzed, so as to obtain the abnormal warning indicators of the corresponding supply chain nodes; Step S300. Based on the information transmission path between each supply chain node in the pharmaceutical supply chain, the correlation between the abnormal event warning indicators of each supply chain node in the pharmaceutical supply chain is analyzed, so as to identify the potential risk transmission path corresponding to each abnormal event of the supply chain node, thereby obtaining the corresponding potential risk diffusion range; Step S400. Obtain the real-time data and real-time event record log of each supply chain node, and calculate the real-time abnormal warning index of the corresponding supply chain node according to the real-time event record log; predict the real-time risk transmission path of the corresponding supply chain node according to the real-time abnormal event warning index, and obtain the real-time risk diffusion range according to the real-time risk transmission path, output the real-time risk transmission path and the real-time risk diffusion range to relevant personnel, and have the relevant personnel do further processing.

2. A pharmaceutical supply chain data security intelligent monitoring method according to claim 1, characterized in that: The step S100 includes: S101. Collect historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform, wherein the historical data refers to the operational data of each supply chain node in the pharmaceutical supply chain; for each supply chain node, analyze the event log in chronological order, and divide the historical data into different time periods according to the start time and end time of the event in the event log, and each time period corresponds to an event; construct a normal event data set A and an abnormal event data set B according to the normal events and abnormal events in the event log, respectively, where A={a1,a2,...,an}, B={b1,b2,..., bm}, where a1 represents the historical data corresponding to the first normal event in the event log, a2 represents the historical data corresponding to the second normal event in the event log, and so on, an represents the historical data corresponding to the nth normal event in the event log, and n represents the number of normal events in the event log; similarly, b1 represents the historical data corresponding to the first abnormal event in the event log, b2 represents the historical data corresponding to the second abnormal event in the event log, bm represents the historical data corresponding to the mth abnormal event in the event log, and m represents the number of abnormal events in the event log; S102. For each normal event in the normal event data set A, the historical data corresponding to each normal event is divided into several data segments according to the set time window. For each data segment, feature extraction is performed from the same dimension to obtain the historical data features corresponding to the normal event, and normalization is performed to construct the corresponding historical data feature vector Va. Each normal event corresponds to several historical data feature vectors Va, where Va=[va1,va2,...,vac], va1 represents the first dimension historical data feature value corresponding to the normal event, va2 represents the second dimension historical data feature value corresponding to the normal event. dimensional historical data feature value, and so on, vac represents the c-th dimension historical data feature value corresponding to the normal event, and c represents the number of dimensions of the historical data feature vector; similarly, for the historical data corresponding to each abnormal event in the abnormal event data set B, the analysis is performed according to the analysis method of the historical data of normal events in the normal event data set A, so as to construct the corresponding historical data feature vector Vb, and vb1 represents the 1st dimension historical data feature value corresponding to the abnormal event, vb2 represents the 2nd dimension historical data feature value corresponding to the abnormal event, and vbc represents the c-th dimension historical data feature value corresponding to the abnormal event.

3. A pharmaceutical supply chain data security intelligent monitoring method according to claim 2, characterized in that: The step S200 includes: S201. For each normal event in the normal event data set A, the corresponding several historical data feature vectors Va are summarized; for each dimension in the historical data feature vector Va, the corresponding historical data feature trend curve La is drawn respectively, and the horizontal axis of the historical data feature trend curve La is the time window, and the vertical axis is the historical data feature of the corresponding dimension; several historical data feature trend curves La corresponding to the same dimension of the same normal event are represented in the same plane rectangular coordinate system, and several historical data feature trend curves La are fitted into a trend curve, and this trend curve is used as the trend curve Qa of the corresponding normal event dimension; similarly, the same analysis is performed on each abnormal event in the abnormal event data set B, so as to obtain the trend curve Qb of the corresponding abnormal event dimension, wherein the trend curve corresponding to each normal event and abnormal event is equal to the dimension of the corresponding historical data feature vector; S202. For each supply chain node, the trend curve Qa of each dimension corresponding to the normal event and the trend curve Qb of the same dimension of the abnormal event are sequentially subjected to deviation analysis, and the dynamic time warping distance DTW between the two trend curves is calculated, and the specific calculation formula is: ， Among them, min f∈F represents the minimum value of all possible time window alignment modes f, and F represents the set of all possible time window alignment modes; Qa(tr) and Qb(tr) represent the historical data feature values ​​of the trend curve Qa of normal events and the trend curve Qb of abnormal events in the time window tr, respectively, and k represents the number of time windows; referring to the deviation analysis process of the trend curve Qa of each dimension corresponding to the normal event and the trend curve Qb of the same dimension of the abnormal event, the dynamic time warping distance between the trend curves Qa of each dimension corresponding to different normal events of the corresponding supply chain node is calculated in turn, and the average value μ and standard deviation σ are calculated, so as to obtain the deviation threshold E of the corresponding supply chain node, and E=μ+g×σ, where g represents the coefficient; S203. According to the deviation between the trend curves of the same dimension between the normal event and the abnormal event, the corresponding abnormal event warning index P is calculated, and the specific calculation formula is: ， Among them, α is the adjustment factor, which is used to control the response speed of the early warning indicator to the deviation change; the abnormal event early warning indicators P of all dimensions are summarized, and the average value is calculated as the abnormal warning indicator P0 of the abnormal event corresponding to the supply chain node.

4. A pharmaceutical supply chain data security intelligent monitoring method according to claim 3, characterized in that: The step S300 includes: S301. Based on the information transmission path between each supply chain node in the pharmaceutical supply chain, combined with the corresponding historical data, the time interval T between each completed information transmission between two adjacent supply chain nodes in the pharmaceutical supply chain is obtained; for the abnormal event corresponding to each supply chain node Gu, according to the time interval T between each completed information transmission between two adjacent supply chain nodes in the pharmaceutical supply chain, the timestamp ty of the abnormal event related information corresponding to the supply chain node Gu transmitted to the next supply chain node Gu+1 is calculated, and the timestamp ty is equal to the sum of the start time of the abnormal event corresponding to the supply chain node Gu and the time interval T; S302. Summarize all abnormal event related information of the supply chain node Gu and pass it to the timestamp ty of the next supply chain node Gu+1, and search for the event including the timestamp ty in the event log of the next supply chain node Gu+1 according to the timestamp ty, retain the found event including the timestamp ty as the abnormal event, and associate the abnormal event of the supply chain node Gu with the abnormal event including the timestamp ty in the event log of the next supply chain node Gu+1; traverse all supply chain nodes in the pharmaceutical supply chain in turn, so as to obtain the abnormal event association sequence corresponding to the supply chain node Gu; S303. According to the abnormal event association sequence corresponding to the supply chain node Gu, the potential risk transmission path of the abnormal event corresponding to the supply chain node Gu is obtained, the number of abnormal events in the abnormal event association sequence is used as the potential risk diffusion range of the abnormal event corresponding to the supply chain node Gu, and the abnormal warning indicator P0, potential risk transmission path and potential risk diffusion range of the abnormal event corresponding to the supply chain node Gu are matched one-to-one.

5. A pharmaceutical supply chain data security intelligent monitoring method according to claim 4, characterized in that: The step S400 includes: S401. Obtain the real-time data and real-time event log of each supply chain node, refer to the analysis process of historical data, perform the same analysis on the real-time data, and calculate the real-time abnormal warning index P1 of the corresponding supply chain node according to the real-time event log; compare the real-time abnormal warning index P1 with the abnormal warning index P0 of the corresponding supply chain node, and select the one with the smallest |P1-P0| result as the final matching result; S402. Obtain the abnormal warning indicator P0 corresponding to the matching result, and search in the corresponding supply chain node according to the abnormal warning indicator P0 to determine whether there is an abnormal event association sequence for the abnormal warning indicator P0; if not, notify the relevant personnel to handle the abnormal event of the current supply chain node; if so, obtain the abnormal warning indicator P0, potential risk transmission path and potential risk diffusion range of the abnormal event according to the abnormal event association sequence, and output the potential risk transmission path and potential risk diffusion range to the relevant personnel for further processing.

6. A pharmaceutical supply chain data security intelligent monitoring system, applied to a pharmaceutical supply chain data security intelligent monitoring method according to any one of claims 1 to 5, characterized in that: The system includes: a data collection and processing module, a feature analysis and trend monitoring module, a risk transfer and diffusion analysis module, and a real-time monitoring and early warning response module; The data collection and processing module collects historical data and event logs of each supply chain node in the pharmaceutical supply chain through the cloud platform, and divides the corresponding historical data according to the event log for each supply chain node; based on the division results of the historical data, the historical data features of the corresponding events are respectively extracted; The feature analysis and trend monitoring module constructs corresponding historical data feature trend curves according to the historical data features of the events corresponding to each supply chain node; based on the historical data feature trend curves of the corresponding events, analyzes the deviation relationship between the historical data feature trend curves between normal events and abnormal events, thereby obtaining abnormal warning indicators for the corresponding supply chain nodes; The risk transmission and diffusion analysis module analyzes the correlation between the abnormal event warning indicators of each supply chain node in the pharmaceutical supply chain based on the information transmission path between each supply chain node in the pharmaceutical supply chain, thereby identifying the potential risk transmission path corresponding to each abnormal event of the supply chain node, and thus obtaining the corresponding potential risk diffusion range; The real-time monitoring and early warning response module obtains the real-time data and real-time event record log of each supply chain node, and calculates the real-time abnormal early warning index of the corresponding supply chain node according to the real-time event record log; based on the real-time abnormal event early warning index, the real-time risk transmission path of the corresponding supply chain node is predicted, and the real-time risk diffusion range is obtained according to the real-time risk transmission path, and the real-time risk transmission path and the real-time risk diffusion range are output to relevant personnel for further processing.

7. The pharmaceutical supply chain data security intelligent monitoring system according to claim 6 is characterized by: The data collection and processing module includes a data collection unit, a data partitioning and feature extraction unit, and a data normalization and feature vector construction unit; The data collection unit collects historical data and event logs of each supply chain node in the pharmaceutical supply chain through a cloud platform; the data partitioning and feature extraction unit divides the historical data into time periods according to the event logs, extracts data features from each event, and constructs a normal event data set and an abnormal event data set; the data normalization and feature vector construction unit partitions and extracts features from the historical data of normal events and abnormal events, and constructs normalized historical data feature vectors respectively.

8. The pharmaceutical supply chain data security intelligent monitoring system according to claim 6 is characterized by: The feature analysis and trend monitoring module includes a trend curve construction unit, a deviation analysis unit and an early warning indicator calculation unit; The trend curve construction unit constructs a historical data characteristic trend curve of normal events and abnormal events based on the historical data characteristics of each supply chain node; The deviation analysis unit calculates the dynamic time warping distance between the trend curves of normal events and abnormal events, and obtains the deviation value; The warning indicator calculation unit calculates the warning indicator of the abnormal event based on the deviation analysis, and summarizes the abnormal warning indicators of each dimension to obtain a comprehensive abnormal warning indicator.

9. The pharmaceutical supply chain data security intelligent monitoring system according to claim 6, characterized in that: The risk transfer and diffusion analysis module includes an information transfer path analysis unit, a risk path identification unit and a risk diffusion range calculation unit; The information transmission path analysis unit calculates the information transmission time interval of abnormal events at each supply chain node based on the information transmission path of each node in the pharmaceutical supply chain, and infers the transmission timestamp of the abnormal event; The risk path identification unit analyzes the association between abnormal events between various supply chain nodes based on the timestamps of the abnormal events and identifies potential risk transmission paths; The risk diffusion range calculation unit calculates the potential risk diffusion range of the abnormal event according to the association sequence of the abnormal event, and corresponds it with the corresponding early warning indicator and risk transmission path.

10. The pharmaceutical supply chain data security intelligent monitoring system according to claim 6, characterized in that: The real-time monitoring and early warning response module includes a real-time data collection and analysis unit, a real-time early warning matching unit and a real-time risk response unit; The real-time data collection and analysis unit obtains the real-time data and event record logs of each supply chain node, and calculates the real-time abnormal warning index by referring to the analysis process of historical data; The real-time warning matching unit compares the real-time abnormal warning index with the historical abnormal warning index to obtain a matching result; The real-time risk response unit determines whether there is an abnormal event association sequence based on the matching results, outputs the potential risk transmission path and diffusion range, and notifies relevant personnel to handle it.

Images