Asset security detection and processing mechanism realized based on S0AR

Abstract

The invention discloses an asset security detection and processing mechanism based on S0AR. The asset security detection and processing mechanism comprises equipment configuration; collecting data; data transmission; performing anomaly detection; and performing safety early warning. According to the invention, by combining the RFID technology, the Internet of Things sensor and the SOAR framework, real-time safety monitoring and an automatic response mechanism of the medical equipment are realized. The system not only can effectively improve the management efficiency of the medical equipment and reduce manual intervention, but also can take automatic protection measures in time when the equipment is abnormal, reduce faults and safety risks of the medical equipment, improve the life cycle management of the equipment, and finally improve the quality and safety of medical services.

Description

Technical Field

[0001] The present invention relates to the technical field of device management, and in particular to an asset security detection and processing mechanism based on SOAR. Background Art

[0002] With the rapid development of medical technology, medical devices are playing an increasingly important role in medical places such as hospitals and clinics. There are many types of medical devices, including monitors, imaging equipment, infusion pumps, ventilators, etc. These devices involve the life safety of patients and often require long-term and continuous operation. Therefore, ensuring the safe operation of medical devices and preventing the occurrence of failures, abnormalities and safety incidents has become the key to ensuring medical quality and reducing medical risks.

[0003] In the management and monitoring of medical equipment, the real-time operating status and safety of the equipment are the focus of most attention. Traditional equipment management methods mainly rely on manual inspection and regular maintenance, but these methods have great limitations. For example, the periodicity and non-real-time nature of manual inspection may lead to the omission of potential faults, and when the equipment fails, it cannot be handled in time, and may be further operated, causing the fault to increase. Therefore, how to detect the operating status of the equipment in real time and accurately, and take timely measures when an abnormality occurs, has become an important issue that needs to be solved in the current field of medical equipment management. Summary of the invention

[0004] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] In a first aspect, the present invention provides an asset security detection and processing mechanism based on SOAR, including:

[0007] S1. Equipment configuration: Each medical device is equipped with a unique RFID tag to identify the medical device;

[0008] S2. Data collection: Install sensors on medical equipment and collect behavioral data of medical equipment through multiple sensors;

[0009] S3, data transmission: upload the RFID data of medical equipment and the operating status data collected by the sensor;

[0010] S4. Anomaly Detection: Based on the SOAR framework, perform anomaly analysis on the real-time operation data of medical device equipment to detect whether the equipment has anomalies.

[0011] S5. Safety Warning: When an anomaly is detected, generate a safety warning signal and initiate automated protection measures.

[0012] As a preferred solution of the asset security detection and processing mechanism implemented based on SOAR according to the present invention, wherein: The anomaly analysis algorithm is as follows:

[0013]

[0014] Wherein: A(t) is the safety anomaly degree score of the equipment at time t; x i (t) is the i-th characteristic data of the equipment at time t; μ i (t) is the historical mean of the i-th characteristic of the equipment at time t; σ i (t) is the standard deviation of the i-th characteristic of the equipment at time t; is an indicator function.

[0015] As a preferred solution of the asset security detection and processing mechanism implemented based on SOAR according to the present invention, wherein: The specific formula is as follows:

[0016]

[0017] Wherein: β i is a preset safety threshold factor for controlling the tolerance of the normal fluctuation range.

[0018] As a preferred solution of the asset security detection and processing mechanism implemented based on SOAR according to the present invention, wherein: The specific threshold of A(t) is as follows:

[0019] Preset three critical thresholds A1, A2, and A3;

[0020] A(t) = 0: Normal state, the equipment has no anomalies during the current time period, and all equipment characteristics are within the normal range;

[0021] 0 < A(t) ≤ A1: Mild anomaly, the equipment has minor anomalies in some characteristics, but it does not affect the normal operation of the equipment;

[0022] A1 < A(t) ≤ A2: Moderate anomaly, the equipment has obvious anomalies and there is a risk of potential failure, and monitoring needs to be strengthened;

[0023] A2 < A(t) ≤ A3: Severe anomaly, the equipment has significant anomalies and there are potential safety risks;

[0024] A(t)>A3: Extreme abnormality. The device has an extreme abnormality and is in a faulty state.

[0025] As a preferred solution of the asset security detection and processing mechanism based on SOAR described in the present invention, the response measures for the status are as follows:

[0026] Normal state: no intervention required, continuous monitoring;

[0027] Mild abnormality: record the abnormality and monitor it to see if it worsens;

[0028] Moderate abnormality: Enhance monitoring, conduct equipment inspection, and recommend preventive maintenance;

[0029] Serious abnormality: immediately diagnose and handle the fault, and lock the device to prevent further operation;

[0030] Extreme abnormalities: Emergency shutdown, emergency response, and thorough inspection and repair.

[0031] As a preferred solution of the asset security detection and processing mechanism based on SOAR described in the present invention, the mechanism also includes:

[0032] S6. Report generation: Automatically generate detailed reports of abnormal events, including device ID, abnormality type, occurrence time, device status and abnormal behavior description, and store event data in the cloud or local database for subsequent analysis.

[0033] As a preferred solution of the asset security detection and processing mechanism based on SOAR described in the present invention, the RFID tag provides the location information of the device in real time, and the RFID data is transmitted together with the sensor data to avoid unauthorized movement.

[0034] In a second aspect, the present invention further provides an asset security detection and processing system based on SOAR, comprising:

[0035] RFID module: configure a unique RFID tag for each medical device and read the tag in real time;

[0036] IoT sensor module: used to collect equipment operation status data in real time;

[0037] Data transmission module: used to transmit the collected data

[0038] SOAR framework module: used to analyze the operation data of the equipment, detect abnormal behavior of the equipment, and generate real-time warnings;

[0039] Protection mechanism module: used to automatically execute protection measures when an anomaly is detected;

[0040] User interface module: used to display the real-time status, historical usage records, alarm management, and abnormal event record information of the device for administrators to monitor and manage.

[0041] In a third aspect, an embodiment of the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of an asset security detection and processing mechanism based on S0AR as described in the first aspect of the present invention is implemented.

[0042] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of an asset security detection and processing mechanism based on SOAR as described in the first aspect of the present invention.

[0043] Beneficial effects of the present invention:

[0044] The present invention realizes real-time security monitoring and automated response mechanism for medical devices by combining RFID technology, IoT sensors and SOAR framework. The system can not only effectively improve the management efficiency of medical devices and reduce manual intervention, but also take automated protective measures in time when abnormalities occur in the equipment, reduce medical device failures and safety risks, improve equipment life cycle management, and ultimately improve the quality and safety of medical services. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0046] Figure 1 A flowchart of an asset security detection and processing mechanism based on SOAR proposed by the present invention;

[0047] Figure 2 This is an architecture diagram of an asset security detection and processing system based on SOAR proposed in the present invention. DETAILED DESCRIPTION

[0048] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0049] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0050] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0051] Reference Figure 1-2 The present invention provides an asset security detection and processing mechanism based on SOAR, including:

[0052] S1. Equipment configuration: Each medical device is equipped with a unique RFID tag to identify the medical device;

[0053] S2. Data collection: Install sensors on medical devices and collect behavioral data of medical devices through multiple sensors, including but not limited to the operating status, temperature, battery power and location information of the device;

[0054] S3, data transmission: upload the RFID data of medical equipment and the operating status data collected by the sensor;

[0055] S4. Anomaly detection: Based on the SOAR framework, perform anomaly analysis on the real-time operation data of medical devices to detect whether the equipment has any anomalies;

[0056] S5. Safety warning: When an abnormality is detected, a safety warning signal is generated and automated protection measures are initiated.

[0057] Among them, the anomaly analysis algorithm is as follows:

[0058]

[0059] Where: A(t) is the safety anomaly score of the device at time t. The value of A(t) reflects whether the status of the device is abnormal; x i (t) is the i-th characteristic data of the device at time t, which can be any dynamically monitored parameter of the device, such as temperature, humidity, battery power, operating speed, pressure, etc.; μ i (t) is the historical mean of the i-th feature of the device at time t, indicating the average value of the i-th feature of the device under normal conditions; σ i (t) is the standard deviation of the i-th feature of the device at time t, indicating the normal fluctuation range of the feature; is an indicator function that ensures that the deviation of a feature affects the total anomaly score only when the device feature meets the safety rules.

[0060] Furthermore, The specific formula is as follows:

[0061]

[0062] where: β i is a preset safety threshold factor used to control the tolerance of the normal fluctuation range and can usually be set according to the characteristics of the device and historical data experience.

[0063] Furthermore, the specific thresholds of A(t) are as follows:

[0064] Preset three critical thresholds A1, A2, and A3;

[0065] A(t) = 0: Normal state, the device has no anomalies during the current time period, and all device features are within the normal range;

[0066] 0 < A(t) ≤ A1: Mild anomaly, the device has minor anomalies in some features. The anomalies may be short-term fluctuations or slight deviations close to the normal threshold, but they do not affect the normal operation of the device;

[0067] A1 < A(t) ≤ A2: Moderate anomaly, the device shows obvious anomalies, and multiple features continuously deviate from the normal values. The device may be affected to a certain extent and there is a risk of potential failure. Monitoring needs to be strengthened. At this time, the device operation is not completely reliable but has not reached the level of serious failure;

[0068] A2 < A(t) ≤ A3: Severe anomaly, the device shows significant anomalies, and multiple features deviate significantly from the normal range. It may have affected the normal operation of the device and there are potential safety risks. At this time, the performance or safety of the device may have been threatened;

[0069] A(t) > A3: Extreme anomaly, the device shows extreme anomalies, and all features deviate significantly from the normal state. The device is already in a failure state. At this time, there are major safety hazards in the device operation and it may pose a threat to personnel or the environment.

[0070] Furthermore, the response measures for the status are as follows:

[0071] Normal state: No intervention is required, continue monitoring;

[0072] Mild anomaly: Record the anomaly and monitor it to observe whether it worsens;

[0073] Moderate abnormality: Enhance monitoring, conduct equipment inspection, and recommend preventive maintenance;

[0074] Serious abnormality: immediately diagnose and handle the fault, and lock the device to prevent further operation;

[0075] Extreme abnormalities: Emergency shutdown processing, initiating emergency response, conducting thorough inspection and repair, assessing the severity of the abnormality based on the equipment's abnormality score and taking appropriate treatment measures, which not only helps to systematically manage equipment abnormalities, but also helps operators take appropriate actions in a timely manner to avoid equipment failures or safety accidents.

[0076] Furthermore, the mechanism also includes:

[0077] S6. Report generation: Automatically generate detailed reports of abnormal events, including device ID, abnormality type, occurrence time, device status and abnormal behavior description, and store event data to the cloud or local database for subsequent analysis. Record abnormal events to facilitate subsequent inspection by staff.

[0078] Furthermore, the RFID tag provides the location information of the device in real time, and the RFID data is transmitted together with the sensor data to avoid unauthorized movement. When unauthorized movement is detected, an alarm is issued in time and the device is locked.

[0079] This embodiment also provides an asset security detection and processing system based on SOAR, including:

[0080] RFID module: configure a unique RFID tag for each medical device and read the tag in real time;

[0081] IoT sensor module: used to collect equipment operation status data in real time;

[0082] Data transmission module: used to transmit the collected data

[0083] SOAR framework module: used to analyze the operation data of the equipment, detect abnormal behavior of the equipment, and generate real-time warnings;

[0084] Protection mechanism module: used to automatically execute protection measures when an anomaly is detected;

[0085] User interface module: used to display the real-time status, historical usage records, alarm management, and abnormal event record information of the device for administrators to monitor and manage.

[0086] This embodiment also provides a computer device, which is suitable for an asset security detection and processing mechanism based on SOAR, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement an asset security detection and processing mechanism based on SOAR as proposed in the above embodiment.

[0087] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0088] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, an asset security detection and processing mechanism based on SOAR is implemented as proposed in the above embodiment; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0089] In summary, the present invention realizes real-time security monitoring and automated response mechanism for medical devices by combining RFID technology, IoT sensors and SOAR framework. The system can not only effectively improve the management efficiency of medical devices and reduce manual intervention, but also take automated protective measures in time when abnormalities occur in the equipment, reduce medical device failures and safety risks, improve equipment life cycle management, and ultimately improve the quality and safety of medical services.

[0090] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An asset security detection and processing mechanism based on SOAR, characterized by: Including: S1. Device Configuration: Configure a unique RFID tag for each medical device to identify the medical device equipment; S2. Data Collection: Install sensors on the medical device and collect the behavior data of the medical device equipment through multiple sensors; S3. Data Transmission: Upload the RFID data of the medical device equipment and the operation status data collected by the sensors; S4. Anomaly Detection: Based on the SOAR framework, perform anomaly analysis on the real-time operation data of the medical device equipment to detect whether the device has anomalies; S5. Security Warning: When an anomaly is detected, generate a security warning signal and initiate automated protection measures.

2. The asset security detection and processing mechanism based on SOAR according to claim 1 is characterized in that: The anomaly analysis algorithm is as follows: Where: A(t) is the safety anomaly score of the device at time t; x i (t) is the i-th characteristic data of the device at time t; μ i (t) is the historical mean of the i-th feature of the device at time t; σ i (t) is the standard deviation of the i-th feature of the device at time t; is the indicator function.

3. The asset security detection and processing mechanism based on SOAR according to claim 2 is characterized in that: Said The specific formula is as follows: Where: β i It is a preset safety threshold factor used to control the tolerance of the normal fluctuation range.

4. The asset security detection and processing mechanism based on SOAR according to claim 3 is characterized in that: The specific threshold of A(t) is as follows: Preset three critical thresholds A1, A2, and A3; A(t) = 0: Normal state, the device has no anomalies at all during the current time period, and all device features are within the normal range; 0 < A(t) ≤ A1: Mild anomaly, the device has minor anomalies in some features, but it does not affect the normal operation of the device; A1 < A(t) ≤ A2: Moderate anomaly, the device has obvious anomalies, there is a risk of potential failure, and monitoring needs to be strengthened; A2 < A(t) ≤ A3: Severe anomaly, the device has significant anomalies, there are potential security risks; A(t) > A3: Extreme anomaly, the device has extreme anomalies and the device is already in a faulty state.

5. The asset security detection and processing mechanism based on SOAR according to claim 4 is characterized in that: The countermeasures for the above states are as follows: Normal state: No intervention is required, continue to monitor; Mild anomaly: Record the anomaly and monitor it to observe whether it worsens; Moderate anomaly: Enhance monitoring, conduct equipment inspections, and recommend preventive maintenance; Severe anomaly: Immediately conduct fault diagnosis and handling, lock the device to prevent further operation; Extreme anomaly: Perform emergency shutdown processing, initiate an emergency response, and conduct a thorough inspection and repair.

6. The asset security detection and processing mechanism based on SOAR according to claim 5 is characterized in that: The mechanism also includes: S6. Report Generation: Automatically generate a detailed report of the anomaly event, including device ID, anomaly type, occurrence time, device status, and description of the abnormal behavior, and store the event data in the cloud or a local database for subsequent analysis.

7. The asset security detection and processing mechanism based on SOAR according to claim 6 is characterized in that: The REID tag provides the location information of the device in real time, and the RFID data and sensor data are transmitted together to prevent unauthorized movement.

8. An asset security detection and processing system based on SOAR, based on the asset security detection and processing mechanism based on SOAR described in claims 1-7, characterized in that: Including: RFID Module: Configure a unique RFID tag for each medical device equipment and read the tag in real time; Internet of Things Sensor Module: Used to collect the operation status data of the device in real time; Data Transmission Module: Used to transmit the collected data; SOAR Framework Module: Used to analyze the operation data of the device, detect the abnormal behavior of the device, and generate real-time warnings; Protection Mechanism Module: Used to automatically execute protection measures when an anomaly is detected; User Interface Module: Used to display the real-time status of the device, historical usage records, alarm management, and anomaly event record information for administrators to monitor and manage.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, it implements the steps of a mechanism for asset security detection and handling based on S0AR according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of an asset security detection and processing mechanism based on SOAR as described in any one of claims 1-7 are implemented.

Images