Zero-trust medical network security immune defense method and system

Abstract

The invention relates to a zero-trust medical network security immune defense method and system. The method comprises the following steps: constructing an abnormal behavior characteristic database based on an artificial immune system; dynamically adjusting vaccine resources distributed to the sub-servers by the central server based on the abnormal behavior feature database in combination with a Lagrange optimization method; and optimizing an attack detection rule of a firewall based on the vaccine resource in combination with an artificial immune algorithm, and performing network attack defense by adopting the attack detection rule. That is to say, by constructing a fine-grained network abnormal behavior feature database, introducing a dynamic vaccine distribution mechanism to distribute detectors to all terminal nodes in a medical internal network, and using an artificial immune algorithm to carry out anomaly detection, strict behavior monitoring is carried out on each access, and attack behaviors are found, blocked and traced back in time. By utilizing the technology, the network security problem in the current medical network environment can be solved, and the defect of traditional medical network security boundary protection is made up.

Description

Technical Field

[0001] The present application relates to the field of cyberspace security technology, and in particular to a zero-trust medical network security immune defense method and system. Background Art

[0002] The network architecture of the medical system is complex and involves multiple layers. From the internal network of the hospital to the external unknown terminal access and telemedicine equipment, various systems and data interactions form a highly distributed environment. The internal network includes the electronic health record system (EHR), hospital information system (HIS), medical image storage and transmission system, drug management and laboratory system, etc., and the external network includes telemedicine equipment, cloud services, external personnel access, etc. In addition, there are many IoT devices in the hospital, such as smart infusion pumps, heart monitors, etc. These devices transmit data to the central system through the hospital network.

[0003] Traditional medical network systems are based on a security architecture based on border protection, such as Figure 1 As shown in the figure, the network is divided into different areas such as internal network and external network according to the physical location of the device in the network. Firewalls, intrusion detection and other measures are deployed at the network boundary, and corresponding security policies are configured to build a boundary security protection system. If the traditional security architecture based on boundary protection is used, when the user enters the internal application network area, the original network security protection measures will become invalid. Once the attacker steals the user's account password, it can easily access the system and data and steal data resources. Under the network boundary protection architecture, even if more security devices are added and more security policies are set, it can only enhance the protection capability of the network boundary, and cannot effectively prevent internal attacks.

[0004] Therefore, in the relevant technology, there is an urgent need for a method that can improve the security protection capabilities of medical network systems. Summary of the invention

[0005] Based on this, it is necessary to provide a zero-trust medical network security immune defense method and system that can improve the security protection capabilities of medical network systems in response to the above technical problems.

[0006] In a first aspect, the present application provides a zero-trust medical network security immune defense method. The method comprises:

[0007] Construct abnormal behavior feature database based on artificial immune system;

[0008] Dynamically adjust the vaccine resources distributed from the central server to the sub-servers based on the abnormal behavior feature database combined with the Lagrangian optimization method;

[0009] Based on the vaccine resources combined with the artificial immune algorithm, the attack detection rules of the firewall are optimized, and the attack detection rules are used to defend against network attacks.

[0010] Optionally, in one embodiment of the present application, the constructing an abnormal behavior feature database based on the artificial immune system includes:

[0011] Randomly generate network abnormal behavior features, and filter them in combination with known network attack behavior data sets to obtain a fine-grained network abnormal behavior feature set;

[0012] Performing variation tolerance operations based on fine-grained network abnormal behavior features to generate new network abnormal behavior features to expand the set of fine-grained network abnormal behavior features;

[0013] A convolutional neural network is used to perform fine-grained classification on the abnormal behavior features of the new network to obtain an abnormal behavior feature database.

[0014] Optionally, in one embodiment of the present application, the adopting a convolutional neural network to perform fine-grained classification on the abnormal behavior features of the new network includes:

[0015] Building a fine-grained classification model based on a convolutional neural network, wherein the fine-grained classification model includes a feature extraction part and a fine-grained classification part;

[0016] Model training is performed based on the fine-grained network abnormal behavior feature set, and the trained fine-grained classification model is used to perform fine-grained classification on the new network abnormal behavior feature.

[0017] Optionally, in one embodiment of the present application, the dynamically adjusting the vaccine resources distributed from the central server to the sub-server based on the abnormal behavior feature database combined with the Lagrangian optimization method includes:

[0018] Use time delay function and adaptive control factor to make preliminary adjustments and updates to vaccine resource distribution;

[0019] A Lagrangian function is constructed in combination with constraint conditions, and the optimal vaccine distribution quantity is solved based on the Lagrangian function. The constraint conditions include total vaccine quantity limit, sub-server load capacity, and network bandwidth limit.

[0020] Optionally, in one embodiment of the present application, the attack detection rule based on the vaccine resource combined with the artificial immune algorithm to optimize the firewall includes:

[0021] Generate preliminary attack detection rules based on clonal selection algorithm;

[0022] Based on the preliminary attack detection rules, a negative selection algorithm is used to further optimize the rule base.

[0023] Optionally, in one embodiment of the present application, the adopting the attack detection rule to perform network attack defense includes:

[0024] The similarity between the traffic and the attack detection rule is calculated to determine whether the traffic meets the attack characteristics.

[0025] In a second aspect, the present application also provides a zero-trust medical network security immune defense system. The system includes:

[0026] A database construction module is used to generate a medical network attack behavior feature set and build a behavior feature database;

[0027] The software initialization module is used to use the hospital's existing integrated network management system to read the hospital's network topology and real-time equipment status;

[0028] Data acquisition and preprocessing module, used to import the real-time equipment status database, continuously monitor and update the equipment status in combination with the distributed vaccines;

[0029] Vaccine distribution and synchronization module, used for dynamic adjustment of vaccine distribution;

[0030] The abnormality tracing and processing module is used to analyze abnormal behaviors, find abnormal sources, and block related connections;

[0031] Visual display module, used to intuitively display system status and security risks.

[0032] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor executes the steps of the methods described in the above embodiments.

[0033] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of the method described in each of the above embodiments are implemented.

[0034] The above-mentioned zero-trust medical network security immune defense method and system firstly builds an abnormal behavior feature database based on the artificial immune system; then, dynamically adjusts the vaccine resources distributed by the central server to the sub-server based on the abnormal behavior feature database combined with the Lagrangian optimization method; finally, optimizes the attack detection rules of the firewall based on the vaccine resources combined with the artificial immune algorithm, and adopts the attack detection rules for network attack defense. In other words, by building a fine-grained network abnormal behavior feature database, introducing a dynamic vaccine distribution mechanism to distribute detectors to all terminal nodes in the medical internal network, and using anomaly detection using an artificial immune algorithm, strict behavior monitoring is achieved for each access, and attack behaviors are discovered, blocked and traced in time. The above-mentioned technology can cope with network security issues in the current medical network environment, make up for the shortcomings of traditional medical network security boundary protection, and maximize the security storage of patient data and the safe operation of medical equipment and systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 is a schematic diagram of a security architecture based on border protection in one embodiment;

[0036] Figure 2 A flowchart of a zero-trust medical network security immune defense method in one embodiment;

[0037] Figure 3 A schematic diagram of a process for constructing an abnormal behavior feature database in one embodiment;

[0038] Figure 4 is a schematic diagram of fine-grained classification in one embodiment;

[0039] Figure 5 A schematic diagram of the overall process of vaccine distribution in one embodiment;

[0040] Figure 6 A schematic diagram of uniformly distributing vaccines under normal circumstances in one embodiment;

[0041] Figure 7 A schematic diagram of dynamically distributing vaccines under abnormal circumstances in one embodiment;

[0042] Figure 8 is a schematic diagram of a time delay model in one embodiment;

[0043] Fig. 9 A module tree diagram of a zero-trust medical network security immune defense system in one embodiment;

[0044] Fig.10 A schematic diagram of functions of each layer of a zero-trust medical network security immune defense system in one embodiment;

[0045] Fig.11 is a schematic diagram of a visualization interface in one embodiment;

[0046] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0048] In one embodiment, Figure 2 As shown, a zero-trust medical network security immune defense method is provided, which is applied to Figure 1 The server in the example is used to illustrate the following steps:

[0049] S201: Construct an abnormal behavior feature database based on the artificial immune system.

[0050] In the embodiments of the present application, first, by simulating the immune gene mutation mechanism, the fine-grained behavioral feature samples based on dynamic immune tolerance are studied, that is, by imitating the adaptive defense mechanism in the biological immune system, fine-grained abnormal behavior features are extracted from network traffic. These features undergo cloning, mutation, and self-tolerance during the detector generation process to optimize the feature set and form a network behavior detector that can identify different types of attacks. By classifying and optimizing the features, a "vaccine" database containing fine-grained behavioral features is constructed, which is continuously updated and used to detect emerging network threats.

[0051] Specifically, in one embodiment of the present application, the construction of an abnormal behavior feature database based on the artificial immune system includes:

[0052] S301: Randomly generate network abnormal behavior features, and filter them in combination with known network attack behavior data sets to obtain a fine-grained network abnormal behavior feature set.

[0053] S303: Perform a variation tolerance operation based on the fine-grained network abnormal behavior feature to generate a new network abnormal behavior feature to expand the fine-grained network abnormal behavior feature set.

[0054] S305: Using a convolutional neural network to perform fine-grained classification on the abnormal behavior features of the new network to obtain an abnormal behavior feature database.

[0055] In one embodiment of the present application, Figure 3As shown in Figure 1, first, a feature set based on fine-grained medical network abnormal behavior classification is generated. A large number of network abnormal behavior features are randomly generated in the feature space, and these features are expressed as:

[0056] F={f1,f2,…,f n}

[0057] Among them, each eigenvector f i It is defined in the feature space R d The d-dimensional vector in is:

[0058] f i =[f i1 ,f i2 ,…,f id ]

[0059] These randomly generated feature vectors are used to cover the entire feature space as a set of candidate abnormal feature behaviors to ensure that different abnormal patterns can be captured. The generated feature vectors have sufficient diversity to meet the needs of fine-grained medical network abnormal behavior classification.

[0060] We use known network attack behavior datasets for screening. Network attack behavior datasets usually contain a variety of known attack patterns and their corresponding feature descriptions, which can reflect different types of attack behavior characteristics. Assume that the attack behavior feature set: A = {a1, a2, …, a n} is matched with the randomly generated abnormal behavior feature set F, using Euclidean distance as the metric. Any randomly generated behavior feature f i and aggressive behavior characteristics i The Euclidean distance between can be expressed as:

[0061]

[0062] If the distance dist(f i ,a j )<θ, (θ) is a specific threshold, then the feature f is considered i Can effectively detect abnormal behavior i Therefore, the fine-grained network abnormal behavior feature set obtained after screening is:

[0063]

[0064] The F obtained after screening selected Different feature subsets are formed, and the features in each subset correspond to different types of network attack behaviors. Suppose each attack behavior a j The corresponding feature set is F j ,Right now:

[0065] F j={f i ∈F selected |d(f i ,a j )<θ}

[0066] Thus, different feature sets F j Can be used to detect different network attack behaviors j , forming a fine-grained network abnormal behavior feature cluster.

[0067] After that, we simulate the immune gene mutation mechanism and perform mutation tolerance operations on the abnormal behavior characteristics of fine-grained medical networks. The purpose of the mutation operation is to make minor adjustments to the feature vectors initially screened, so as to explore the surrounding feature space and generate new features. Suppose the mutation operation is applied to the feature vector f i A dimension f ik Above, the mutated feature f i ′ can be expressed as:

[0068] f ik ′=f ik +∈ k

[0069] The random perturbation process can be generated by the noise parameter ∈ k ~N(0,σ 2 ). Gaussian distribution describes the distribution of noise through its probability density function, and its formula is:

[0070]

[0071] Each dimension f ik A random noise from Gaussian distribution will be added to each feature, and since the mean of Gaussian distribution is 0, such a variation will not systematically deviate from the original features. The amplitude of the variation is controlled by σ. If σ is small, the variation will be relatively conservative. On the contrary, the noise disturbance amplitude will be larger, the generated features will be more diverse, and a wider feature space will be explored.

[0072] These new features can help the detection system capture new or unknown abnormal medical network behavior patterns to increase the diversity and robustness of the behavior features. After the mutation operation, the immune tolerance operation is performed. The Euclidean distance between the generated abnormal medical network behavior features and the normal network behavior is calculated to eliminate abnormal feature vectors that can match the normal network behavior to prevent them from making misjudgments of normal network behavior.

[0073] Afterwards, as the system continuously generates new abnormal behavior features of the medical network, the convolutional neural network is used to perform fine-grained classification on these new features, thereby constructing an abnormal behavior feature database. n}, each eigenvector f i The corresponding classification label y i Together they form a convolutional neural network training data set, from which high-level feature representations are extracted to build a more general fine-grained classification model.

[0074] Specifically, in one embodiment of the present application, the fine-grained classification of the abnormal behavior features of the new network using a convolutional neural network includes:

[0075] S401: constructing a fine-grained classification model based on a convolutional neural network, wherein the fine-grained classification model includes a feature extraction part and a fine-grained classification part.

[0076] S403: Performing model training based on the fine-grained network abnormal behavior feature set, and using the trained fine-grained classification model to perform fine-grained classification on the new network abnormal behavior feature.

[0077] In one embodiment of the present application, Figure 4 As shown in Figure 1, first, a fine-grained classification model is constructed based on a convolutional neural network. The fine-grained classification model includes a feature extraction part and a fine-grained classification part. The structure of the convolutional neural network mainly includes an input layer, a convolution layer, a pooling layer, and a fully connected layer. Assume that the feature vector f i is a d-dimensional vector. This vector will first undergo a convolution operation to extract local features through a filter. The formula for the convolution operation can be expressed as:

[0078]

[0079] in, represents the output of the i-th hidden unit in the l-th layer, σ represents the activation function ReLU, represents the weight connecting the kth input unit and the ith hidden unit in the lth layer, represents the output of the i-th unit in the l-1th layer, represents the bias term of the i-th hidden unit in the l-th layer.

[0080] This convolution operation can extract local features with high-level semantics from the original feature vector, capturing the correlation and change trend between different dimensions. Afterwards, the output of the convolution layer will pass through the pooling layer to reduce the dimension of the feature, compress the data volume, and retain important features. The maximum pooling operation is used, and its formula is:

[0081] h i (l-1) =max(h i1 (l-1) ,h i2 (l-1) ,…,h im (l-1) )

[0082] The pooling layer further aggregates information and reduces the spatial dimension of features by selecting the maximum value in the local area. This can effectively avoid overfitting problems and speed up the calculation of the model. After multiple layers of convolution and pooling operations, the features will be flattened into a vector and input to the fully connected layer. In the fully connected layer, the extracted high-level features are mapped to specific classification labels. The output of the fully connected layer can be expressed as:

[0083] z=Wh+b

[0084] Among them, W is the weight matrix of the fully connected layer, h is the output feature vector of the convolution and pooling layer, b is the bias vector of the fully connected layer, and z represents the final output of the network. Next, the output is normalized using the softmax function to obtain the predicted probability of each category:

[0085]

[0086] Among them, f i For a given input, z c represents the score of category c, z c′ represents the score of category c′, and C represents the total number of categories.

[0087] Using the cross entropy loss function

[0088]

[0089] Among them, N represents the total number of samples, C represents the total number of categories, and y ic Indicator variable indicating the true label of sample i belonging to category c. If sample i belongs to category c, then y ic =1, otherwise y ic =0, P(y=c|f i ) indicates that given input f i , the model predicts the probability that it belongs to category c.

[0090] This minimizes the gap between the predicted results and the true labels, allowing the convolutional neural network to gradually learn the differences between different network behavior features and perform fine-grained classification of newly generated abnormal network behavior features.

[0091] Finally, after using the convolutional neural network to perform fine-grained classification on the newly generated network abnormal behavior features, the system will store the classification results in the abnormal behavior feature database. The database records the feature vectors of different types of network attack behaviors and their corresponding classification labels, and can be continuously updated. The core data stored in the database includes behavior features d i , classification label y i , timestamp t i , in the newly generated network abnormal behavior feature f i ′After entering the convolutional neural network for fine-grained classification, the classification result y is obtained i ′, the triple: (f i ′,y i ′,t i ) is stored in the database.

[0092] When new features enter the system, the database can query existing feature records and dynamically update them based on feature similarity or timestamp. i ′ and the feature f in the database j The similarity dist(f i ′,f j ) is less than a predetermined threshold θ, and its generation time t j Earlier, you can choose to update the existing record and keep the latest characteristics.

[0093] Through this mechanism, the abnormal behavior feature database can be continuously expanded as the system runs, including more and more fine-grained network abnormal behavior features, thereby improving the entire system's ability to identify and respond to unknown attacks.

[0094] S203: Dynamically adjust the vaccine resources distributed from the central server to the sub-servers based on the abnormal behavior feature database combined with the Lagrangian optimization method.

[0095] In an embodiment of the present application, the central server in the medical network system is responsible for managing the distribution of vaccines. Under normal circumstances, vaccines will be evenly distributed to each sub-server according to the load status of the sub-server to ensure that each sub-server has basic anomaly detection capabilities. When a sub-server detects an anomaly, the central server will use reinforcement learning to dynamically adjust the vaccine distribution amount based on the detected anomaly, load condition or bandwidth condition, and provide additional vaccine resources to the sub-server. On a macro scale, the Lagrangian optimization method is used for global optimization to ensure that the system maximizes the vaccine defense effectiveness and minimizes system resource consumption when running for a long time. With the continuous update of the vaccine database, the central server will regularly redistribute the latest vaccines to all sub-servers to ensure that each sub-server can synchronously update its detection capabilities. This mechanism can effectively improve the defense level of the entire network system and ensure a rapid response to new attacks.

[0096] Specifically, in one embodiment of the present application, the method of dynamically adjusting the vaccine resources distributed from the central server to the sub-server based on the abnormal behavior feature database combined with the Lagrangian optimization method includes:

[0097] S501: Use time delay function and adaptive control factor to perform preliminary vaccine resource distribution adjustment and update.

[0098] S503: Construct a Lagrangian function in combination with constraint conditions, and solve the optimal vaccine distribution quantity based on the Lagrangian function. The constraint conditions include total vaccine quantity limit, sub-server load capacity, and network bandwidth limit.

[0099] In one embodiment of the present application, Figure 5 As shown in Figure 1, firstly, a dynamic vaccine distribution model based on threat situation awareness is established. Figure 6 As shown in the figure, the uniform distribution strategy under normal conditions can ensure that the number of vaccines per sub-server is relatively stable under normal conditions. j The basic vaccine received can be expressed as v j =v avg .Right now: like Figure 7 As shown, in abnormal situations, dynamic adjustments are required to ensure that the total amount of vaccines remains unchanged while giving more vaccine resources to the server that detects the abnormality. k Reflects the abnormal degree of user behavior detected by the sub-server. k >1, it means that the server detects an abnormality, the more serious the abnormality is. k The larger the value, the greater the new distribution volume v′ k It can be expressed as: v′ k =v avg ·a k .

[0100] In order to keep the overall vaccine distribution volume unchanged, other servers S j The vaccine distribution volume (j≠k) also needs to be based on a k Adjust the new distribution v′ j for:

[0101]

[0102] A vaccine update and synchronization mechanism based on a time delay model is proposed. The time delay function T is introduced. j (t) represents the sub-server S j The time distribution of receiving a new characteristic vaccine. Time delay function T j (t) is associated with the network environment of the sub-server, and the function is expressed as:

[0103]

[0104] Among them, λ j represents the load factor of the sub-server, γ represents the adjustment parameter to control the sensitivity of time delay, and load j Indicates the current load of the sub-server, distance j Indicates the network distance between the sub-server and the central server. Figure 8 As shown, the central server distributes new abnormal behavior features according to different time windows based on the time delay function results of each sub-server.

[0105] Introduce adaptive adjustment to update the dynamic distribution of vaccines, and control the dynamic increase or decrease of vaccine distribution under specific circumstances. Define a control factor β j (t):

[0106]

[0107] Among them, α j Indicates the anomaly detection sensitivity coefficient of the sub-server, anomaly j (t) represents the number of anomalies detected by the sub-server at time t, bandwidth j (t) represents the current bandwidth of the sub-server.

[0108] v′ j (t) = v j (t)·(1+β j (t))

[0109] According to this formula, when the number of abnormalities detected by a sub-server increases, its vaccine distribution volume v j (t) will automatically increase to v′ j(t), otherwise it should be reduced appropriately. Establish a synchronization mechanism between the vaccine database and the sub-server vaccine collection, and j With β j (t) is combined to calculate the vaccine distribution time window and distribution quantity of the sub-server, ensuring that the sub-server can maintain the latest detection capabilities after the feature library is updated. The update mechanism can be expressed by the following formula:

[0110] V j (t) = V j (t-1)∪ΔV(t)

[0111] Among them, V j (t) represents the sub-server S j The vaccine set at time t, ΔV(t) is the newly added vaccine set in the feature library at time t.

[0112] Afterwards, a global optimization strategy for vaccine distribution based on the Lagrange multiplier method is proposed. Assume that at time t, the subserver S j The number of anomalies detected is anomaly j (t), and the corresponding vaccine distribution volume is v′ j (t). The optimization objective function can be expressed as:

[0113]

[0114] M is the total number of sub-servers, log(v′ j (t)) ensures that the objective function exhibits an increasing characteristic as the amount of vaccine distribution increases, while avoiding numerical instability caused by extreme maximum or minimum values.

[0115] Constraints include total vaccine quantity limit, sub-server load capacity, network bandwidth limit, etc. The Lagrangian function is constructed in combination with the constraints to ensure that global optimization can be achieved during the optimization process. Combining the objective function with the constraints in actual operation, the Lagrangian function L is constructed as:

[0116]

[0117] Among them, λ is the Lagrange multiplier, which represents the influence of the constraint condition on the objective function. Solving the partial derivative of the constraint condition yields:

[0118]

[0119] Combining the two equations, we can get the optimal vaccine distribution volume v′ j (t) and the Lagrange multiplier λ. v′ j(t) can be used for the rational distribution of vaccines and maximize the anomaly detection capability; at the same time, λ can be used to evaluate the impact of constraints and provide a basis for subsequent adjustments.

[0120] S205: Optimizing the attack detection rules of the firewall based on the vaccine resources in combination with an artificial immune algorithm, and using the attack detection rules to defend against network attacks.

[0121] In the embodiment of the present application, by combining an artificial immune algorithm, the attack detection rules of the firewall are optimized based on the vaccine distribution mechanism, so that the firewall can generate, optimize and distribute rules in real time, so as to effectively detect known and unknown attacks.

[0122] Specifically, in one embodiment of the present application, the attack detection rule based on the vaccine resource combined with the artificial immune algorithm to optimize the firewall includes:

[0123] S601: Generate preliminary attack detection rules based on the clonal selection algorithm.

[0124] S603: Based on the preliminary attack detection rules, a negative selection algorithm is used to further optimize the rule base.

[0125] In one embodiment of the present application, first, the firewall generates preliminary attack detection rules through a clonal selection algorithm. In the clonal selection algorithm, the feature vector of each network flow is regarded as an "antibody". These feature vectors generate rules through fitness evaluation. Fitness evaluation is usually based on the difference between the flow characteristics and normal flow, and is calculated using a fitness function, which is in the form of:

[0126]

[0127] Among them, y is the characteristic vector of the rule, x normal is the characteristic vector of normal flow, ‖yx normal ‖ 2 is the Euclidean distance, which measures the difference between the rule and normal behavior. The fitness function measures the effectiveness of the rule. Rules with higher fitness can better distinguish normal traffic from attack behaviors. The clone selection algorithm generates rule copies with high fitness through the cloning process and explores new attack modes through mutation operations. The mutated rule is generated by the following formula:

[0128] y clone =y+δy

[0129] Among them, δy represents the amount of change generated by random mutation. In this way, the firewall can generate multiple potential rules through cloning and mutation, thereby enhancing the attack detection capability.

[0130] Afterwards, the negative selection algorithm is used to further optimize the rule base on this basis. The negative selection algorithm is used to exclude rules that are similar to normal traffic to avoid false positives. The negative selection algorithm identifies attack patterns by calculating the difference measure between attack behavior and normal traffic. If the characteristics of the attack sample are similar to those of normal traffic, the generated rules will be excluded. The difference measure formula is:

[0131] D(x attack ,x normal )=‖x attack -x normal ‖

[0132] If the distance D(x attack ,x normal ) is less than a certain threshold ∈, the attack mode is considered to be too similar to normal behavior, and the rule will be excluded. Through this mechanism, the negative selection algorithm ensures the simplicity and efficiency of the rule base and reduces redundant rules.

[0133] Once the rules are generated and optimized, the firewall distributes the new rules to all firewall nodes through the vaccine distribution mechanism. Whenever the firewall generates new rules, these rules are pushed to each firewall node in the distributed system as a "vaccine". These newly generated rules are integrated into the node's rule base, allowing each firewall node to perform efficient attack detection locally. Through this vaccine distribution mechanism, the firewall can ensure that each node always keeps the latest set of rules and maintains consistent defense capabilities. Assume that the new rule set is R new ={r1,r2,…,r k}, then the local rule base R of node N N Will be updated to:

[0134] R N,new =R N ∪R new

[0135] In order to cope with the continuous evolution of network attack patterns, firewalls must have the ability to adaptively optimize. Whenever a new attack pattern emerges, the firewall generates new rules through an incremental learning mechanism and adds them to the rule base. In addition, the firewall will regularly optimize and deduplicate existing rules to ensure that the rule base is always optimal. The update of the rule base is optimized through the following objective function:

[0136]

[0137] Among them, α and β are weighted coefficients of false alarm rate and false negative rate, and R is the rule base. The firewall continuously updates and optimizes the rule base to ensure that it can quickly identify and defend against new types of attacks.

[0138] By combining the clonal selection algorithm, negative selection algorithm and vaccine distribution mechanism, the firewall designed by the present invention can not only intelligently generate and optimize attack detection rules, but also maintain efficient protection against new attacks by dynamically updating and synchronizing rules in real time. Through the collaborative work of these technologies, the firewall can flexibly respond to various network attacks in the distributed environment of medical networks, ensuring the security and stability of the medical network system.

[0139] In one embodiment of the present application, the using the attack detection rule to perform network attack defense includes:

[0140] The similarity between the traffic and the attack detection rule is calculated to determine whether the traffic meets the attack characteristics.

[0141] In one embodiment of the present application, when new traffic arrives at the firewall, the firewall will perform real-time matching according to the rules in the rule base to determine whether the traffic meets the attack characteristics. The similarity between the traffic and the rules is calculated by Euclidean distance:

[0142] D(x flow ,r i )=‖x flow -r i ‖

[0143] Among them, x flow The feature vector representing network traffic, r i Represents the feature vector of the i-th rule. If the traffic feature matches a rule, the firewall will take corresponding protective measures, such as dropping packets, logging, or sending alerts. This process relies on an efficient rule matching algorithm to ensure that the firewall can respond in real time in a high-concurrency, high-traffic network environment.

[0144] In the above-mentioned zero-trust medical network security immune defense method, first, an abnormal behavior feature database is constructed based on the artificial immune system; then, based on the abnormal behavior feature database combined with the Lagrangian optimization method, the vaccine resources distributed by the central server to the sub-server are dynamically adjusted; finally, based on the vaccine resources combined with the artificial immune algorithm, the attack detection rules of the firewall are optimized, and the attack detection rules are used for network attack defense. In other words, by constructing a fine-grained network abnormal behavior feature database, introducing a dynamic vaccine distribution mechanism to distribute detectors to all terminal nodes in the medical internal network, and using anomaly detection using an artificial immune algorithm, strict behavior monitoring is achieved for each access, and attack behaviors are discovered, blocked and traced in time. The above-mentioned technology can cope with network security issues in the current medical network environment, make up for the shortcomings of traditional medical network security boundary protection, and maximize the security storage of patient data and the safe operation of medical equipment and systems.

[0145] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0146] Based on the same inventive concept, the embodiment of the present application also provides a zero-trust medical network security immune defense system for implementing the above-mentioned zero-trust medical network security immune defense method. The implementation solution provided by the system to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more zero-trust medical network security immune defense system embodiments provided below can be found in the above limitations on a zero-trust medical network security immune defense method, which will not be repeated here.

[0147] In one embodiment, Fig. 9 As shown, a zero-trust medical network security immune defense system is provided, including: a database construction module, a software initialization module, a data acquisition and preprocessing module, a vaccine distribution and synchronization module, an abnormality tracing and processing module and a visualization display module, wherein:

[0148] A database construction module is used to generate a medical network attack behavior feature set and build a behavior feature database;

[0149] The software initialization module is used to use the hospital's existing integrated network management system to read the hospital's network topology and real-time equipment status;

[0150] Data acquisition and preprocessing module, used to import the real-time equipment status database, continuously monitor and update the equipment status in combination with the distributed vaccines;

[0151] Vaccine distribution and synchronization module, used for dynamic adjustment of vaccine distribution;

[0152] The abnormality tracing and processing module is used to analyze abnormal behaviors, find abnormal sources, and block related connections;

[0153] Visual display module, used to intuitively display system status and security risks.

[0154] In one embodiment of the present application, the system architecture is divided into a core data construction layer, a data transmission layer, a data processing layer, a core algorithm application layer, and a human-computer interaction layer. The functions of each layer are as follows: Fig.10 As shown. The system is based on a zero-trust architecture, selects Python as the system development language, pytorch as the algorithm training framework, and calls multiple auxiliary development libraries such as Numpy and MySQLdb. The system design architecture is divided into the following modules:

[0155] (1) Database construction module: This module generates a medical network attack behavior feature set through the basic steps of the core data construction layer, uses a convolutional neural network for fine-grained division, and then constructs a behavior feature database for subsequent detection and comparison.

[0156] (2) Software initialization module: This module uses the hospital's existing integrated network management system to read the hospital's network topology and real-time equipment status, and then stores it in the local database after extraction so that it can be displayed centrally in the human-computer interaction interface later.

[0157] (3) Data acquisition and preprocessing module: This module imports the real-time device status database and continuously monitors the distributed vaccines to continuously update the device status. The detector comes from the vaccine distribution and synchronization section, and the test results will also be re-transmitted to this section.

[0158] (4) Vaccine distribution and synchronization module: This module distributes vaccines evenly under normal circumstances and performs real-time detection on sub-servers. If abnormal behavior is found, it will be dynamically adjusted and the detected abnormal behavior will be transmitted to the abnormal tracing and processing module for further processing. In addition, this module will continuously update and synchronize the feature sets of the central server and sub-servers.

[0159] (5) Abnormal tracing and processing module: Further analyze the abnormal behavior transmitted by the vaccine distribution module to find the source of the abnormality. The firewall will filter the source with this behavioral feature and block all related connections.

[0160] (6) Visual display module: It intuitively displays system status and security risks through text, charts, etc., dynamically displays attack behavior data, draws a traceability diagram through the abnormal traceability section, displays abnormal behavior and its source, and forms a visual result, such as Fig.11 shown.

[0161] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.12As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a zero-trust medical network security immune defense method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse.

[0162] Those skilled in the art will understand that Fig.12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0163] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0164] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0165] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0166] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0167] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0168] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0169] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A zero-trust medical network security immune defense method, characterized in that: The method comprises: Construct abnormal behavior feature database based on artificial immune system; Dynamically adjust the vaccine resources distributed from the central server to the sub-servers based on the abnormal behavior feature database combined with the Lagrangian optimization method; Based on the vaccine resources combined with the artificial immune algorithm, the attack detection rules of the firewall are optimized, and the attack detection rules are used to defend against network attacks.

2. According to claim 1, a zero-trust medical network security immune defense method is characterized in that: The abnormal behavior feature database constructed based on the artificial immune system includes: Randomly generate network abnormal behavior features, and filter them in combination with known network attack behavior data sets to obtain a fine-grained network abnormal behavior feature set; Performing variation tolerance operations based on fine-grained network abnormal behavior features to generate new network abnormal behavior features to expand the set of fine-grained network abnormal behavior features; A convolutional neural network is used to perform fine-grained classification on the abnormal behavior features of the new network to obtain an abnormal behavior feature database.

3. A zero-trust medical network security immune defense method according to claim 2, characterized in that: The fine-grained classification of the abnormal behavior features of the new network using a convolutional neural network includes: Building a fine-grained classification model based on a convolutional neural network, wherein the fine-grained classification model includes a feature extraction part and a fine-grained classification part; Model training is performed based on the fine-grained network abnormal behavior feature set, and the trained fine-grained classification model is used to perform fine-grained classification on the new network abnormal behavior feature.

4. According to claim 1, a zero-trust medical network security immune defense method is characterized in that: The method of dynamically adjusting the vaccine resources distributed from the central server to the sub-servers based on the abnormal behavior feature database combined with the Lagrangian optimization method includes: Use time delay function and adaptive control factor to make preliminary adjustments and updates to vaccine resource distribution; A Lagrangian function is constructed in combination with constraint conditions, and the optimal vaccine distribution quantity is solved based on the Lagrangian function. The constraint conditions include total vaccine quantity limit, sub-server load capacity, and network bandwidth limit.

5. According to claim 1, a zero-trust medical network security immune defense method is characterized in that: The attack detection rules based on the vaccine resources combined with the artificial immune algorithm to optimize the firewall include: Generate preliminary attack detection rules based on clonal selection algorithm; Based on the preliminary attack detection rules, a negative selection algorithm is used to further optimize the rule base.

6. A zero-trust medical network security immune defense method according to claim 1, characterized in that: The use of the attack detection rule to defend against network attacks includes: The similarity between the traffic and the attack detection rule is calculated to determine whether the traffic meets the attack characteristics.

7. A zero-trust medical network security immune defense system, characterized in that: include: A database construction module is used to generate a medical network attack behavior feature set and build a behavior feature database; The software initialization module is used to use the hospital's existing integrated network management system to read the hospital's network topology and real-time equipment status; Data acquisition and preprocessing module, used to import the real-time equipment status database, continuously monitor and update the equipment status in combination with the distributed vaccines; Vaccine distribution and synchronization module, used for dynamic adjustment of vaccine distribution; The abnormality tracing and processing module is used to analyze abnormal behaviors, find abnormal sources, and block related connections; Visual display module, used to intuitively display system status and security risks.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images