A method and system for identifying abnormal access to medical data

Abstract

This invention relates to the field of medical data security technology, and more particularly to a method and system for identifying abnormal access to medical data. First, user IDs and access logs are collected to provide a basis for behavioral analysis. Then, new users are assigned an initial trust level based on the historical trust level of their group and are redirected to permission settings. Existing users have their current and historical access data vectorized and their relevance calculated. A three-dimensional evaluation vector is then constructed by combining data importance, access duration, and relevance. An initial trust level is calculated using a density function. Finally, a dynamically updated model is matched based on the relevance range, mapping the trust level to a smart contract control interval, automatically intercepting requests exceeding permissions, and achieving fine-grained real-time permission control and accurate interception of abnormal access. This solves the technical problem in traditional medical data access control technologies that lack a fine-grained trust evaluation mechanism, making it difficult to dynamically adapt to the complexity of access behavior and easily leading to a lag in the identification of abnormal access.

Description

Technical Field

[0001] This invention relates to the field of medical data security technology, and more particularly to a method and system for identifying abnormal access to medical data. Background Technology

[0002] Traditional medical data access control technologies often adopt a centralized management model, relying on static rules or simple historical behavior to assess user permissions. This makes it difficult to dynamically adapt to the complexity of access behavior. For example, while the traditional ABAC model can authorize based on attributes, it does not incorporate real-time behavior analysis, resulting in a lag in identifying abnormal access (such as frequent requests for highly sensitive data within a short period of time). Furthermore, it lacks fine-grained trust assessment mechanisms, such as over-reliance on doctor ratings or fixed weights (for example, the FWZIC method, while addressing weight inconsistencies, does not integrate dynamic behavior data), making it difficult to accurately quantify user intent. In addition, existing solutions initialize the credibility of new users in a simple and crude manner, often using fixed thresholds or random assignments without considering group behavior characteristics (such as the historical credibility of doctors in the department to which the new user belongs), which can easily lead to misjudgments or abuse of permissions. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a method and system for identifying abnormal access to medical data. It solves the technical problem that traditional medical data access control technologies lack a fine-grained trust assessment mechanism, making it difficult to dynamically adapt to the complexity of access behavior and easily leading to a lag in the identification of abnormal access.

[0004] To address the aforementioned technical problems, this invention provides the following technical solution: a method for identifying abnormal access to medical data, used in a blockchain platform for sharing medical data, the method comprising the following steps:

[0005] S1. Obtain the user ID and access log of the user making the data request, wherein the access log contains the medical data and access duration of each access by the user;

[0006] S2. Determine if the current user is a new user;

[0007] If so, then grant the current user credibility and proceed to step S6;

[0008] If not, proceed to step S3;

[0009] S3. Vectorize the medical data from this visit and the medical data from previous visits, and calculate the degree of fit between the two.

[0010] S4. Set the importance of each piece of medical data, and calculate the initial credibility of the user's visit based on the relevance of each visit, the duration of the visit, and the average importance of the data visited.

[0011] S5. Set several fit ranges and corresponding credibility update models, and select the corresponding credibility update model according to the fit of the user's current visit, and substitute the initial credibility and fit to update the user's credibility.

[0012] S6. Set up smart contracts based on trust level and identify abnormal access requests based on the user's current trust level.

[0013] Preferably, in step S2, the specific method for granting trust to the user includes the following steps:

[0014] S21. Divide all users into several user groups and mark the user group to which the current user belongs as a feature group;

[0015] S22. Obtain the credibility of all users within the feature group, and set several consecutive credibility intervals between 0 and 1;

[0016] S23. Count the number of confidence values ​​contained in each confidence interval, and select the confidence intervals with the most confidence values ​​as the standard confidence intervals.

[0017] S24. Calculate the average of the median values ​​of each standard credibility interval as the credibility of the current user.

[0018] Preferably, step S3 specifically includes the following steps:

[0019] S31. Number all medical data;

[0020] S32. Obtain all the medical data numbers that the user has accessed based on the user's access log, and arrange them in order to establish an access set;

[0021] S33. Based on the access set, mark the medical data that has been accessed in this user's current access as 1 and the medical data that has not been accessed in this access as 0, so as to generate the current access vector for this access.

[0022] S34. Based on the access set, mark the medical data that has been accessed in the user's historical access as 1 and the medical data that has not been accessed in the past as 0, so as to generate a historical access vector.

[0023] S35. Count the number of medical data IDs marked as 1 in both the current access vector and the historical access vector. ;

[0024] S36. Count the number of times the same medical data ID is marked as 0 and 1 in the current access vector and the historical access vector, respectively. The number of times the unified medical data number is marked as 1 in the current access vector and 0 in the historical access vector. ;

[0025] S37. Calculate the relevance between the medical data accessed this time and the medical data accessed in the past; the formula for calculating the relevance is:

[0026] ;

[0027] In the above formula, This indicates the degree of relevance between the medical data accessed this time and the medical data accessed in the past.

[0028] Preferably, step S32 specifically includes the following steps:

[0029] S321. Based on each user's access logs, obtain all medical data that have been accessed by users within the characteristic group corresponding to each user.

[0030] S322. Count the number of users who have accessed each medical data set by users within the characteristic group.

[0031] S323. Set a user number threshold, and obtain medical data with fewer than the user number threshold, and mark it as data to be filtered;

[0032] S324. Remove the medical data that the current user has accessed during this visit from the data to be filtered to obtain the data to be removed;

[0033] S325. Based on the user's access log, all medical data that the user has accessed will be obtained, and data to be removed will be eliminated to obtain standard medical data.

[0034] S326. Arrange the standard medical data numbers in sequence to create an access set.

[0035] Preferably, step S4 specifically includes the following steps:

[0036] S41. Set the importance of each medical data point and calculate the average importance of each medical data point for each user's visit to obtain the average importance value.

[0037] Preferably, setting the importance of each piece of medical data specifically includes the following steps:

[0038] S411. Set several importance assessment criteria, obtain the first importance score for each doctor on each assessment criterion, and construct a first scoring matrix; the expression for the first scoring matrix is:

[0039] ;

[0040] In the above formula, Score represents the scoring matrix. This represents the score given by the m-th doctor to the n-th assessment criterion as the first importance.

[0041] S412. Extract the upper limit, lower limit, and average of the upper and lower limits of the first importance score;

[0042] S413. Transform the scoring matrix into a second scoring matrix; the expression for the second scoring matrix is:

[0043] ;

[0044] in,

[0045] ;

[0046] In the above formula, This represents the second scoring matrix. This represents the score given by the m-th doctor for the second importance of the n-th assessment criterion. These represent the upper limit, lower limit, and average of the upper and lower limits for the first importance score, respectively. This represents the transformation function that converts the independent variable x, i.e., the score for the first importance, into the score for the second importance.

[0047] S414. Normalize the scores for each second importance level according to the second scoring matrix; the normalization calculation formula is:

[0048] ;

[0049] In the above formula, and Let represent the second importance score given by the m-th doctor to the n-th assessment criterion before and after normalization. This represents the second importance score of the kth doctor for the nth assessment criterion before normalization, where there are n doctors in total;

[0050] S415. Based on the second importance scores given by each physician to each assessment criterion before normalization, calculate the average importance score given by all physicians to each assessment criterion after normalization; the formula for calculating the average importance score is as follows:

[0051] ;

[0052] In the above formula, This represents the average importance score for the nth evaluation criterion. This represents the normalized score of the kth doctor for the second importance of the nth assessment criterion;

[0053] S416. Obtain the assessment scores of each doctor for the importance assessment criteria of each medical data;

[0054] S417. Calculate the importance of each medical data point based on the evaluation scores of each doctor on the importance assessment criteria and the normalized importance assessment criteria; the formula for calculating the importance of medical data is:

[0055] ;

[0056] In the above formula, Indicates the importance of each piece of medical data. This represents the q-th importance evaluation criterion. This represents the evaluation score of the Fth doctor for the medical data.

[0057] S42. Construct an evaluation vector for each visit based on the average visit duration, relevance, and importance; the expression for the evaluation vector is:

[0058] ;

[0059] In the above formula, A represents the evaluation vector. This indicates the duration of each access. Indicates fit, This represents the mean importance.

[0060] S43. Calculate the similarity between the evaluation vector of the user's current visit and the evaluation vectors of each visit within a certain period of time; the formula for calculating the similarity is:

[0061] ;

[0062] In the above formula, This represents the similarity between the evaluation vector of the user's current visit and the evaluation vector of the i-th visit. This represents the evaluation vector for the user's current visit. This represents the evaluation vector for the user's i-th visit;

[0063] S44. Construct a statistical interval using the minimum and maximum values ​​among all similarities; the expression for the statistical interval is: ,in, and These represent the minimum and maximum values ​​of the statistical interval, respectively.

[0064] S45. Construct a density function to calculate the density value of any similarity within a statistical interval; the expression for the density function is:

[0065] ;

[0066] In the above formula, M represents the density value. This represents any similarity score within a statistical interval. This represents the similarity between the evaluation vector of the user's current visit and the evaluation vector of the i-th visit. Represents a constant. Represents the relationship between the independent variable and the independent variable. The negatively correlated function is accessed a total of n times.

[0067] S46. Obtain the similarity with the highest density value as the initial credibility of the user's visit.

[0068] Preferably, step S5 specifically includes the following steps:

[0069] S51. Set several consecutive fit ranges within the numerical range of 0 to 1, and determine the fit range corresponding to the fit of the user's current visit.

[0070] S52. Set a negatively correlated inhibition factor based on the distance between the maximum value in the fit range and 0;

[0071] S53. Count the number of times the user failed to make a request during this access;

[0072] S54. Construct a user credibility update model and update the user's credibility as the credibility for the user's next visit. The expression for the credibility update model is:

[0073] ;

[0074] In the above formula, This indicates the user's credibility after the update. Indicates the initial confidence level. This indicates the relevance of the user's visit. This represents the fit during the i-th visit, with a total of n visits. This represents the request failure factor, which is positively correlated with the number of failed requests the user made during this visit. This represents the inhibition factor for the k-th fit range. denoted by , where c represents the sensitivity factor and , where c represents the cooperation factor.

[0075] Preferably, in step S54, the method for setting the cooperation factor is as follows:

[0076] S541. Obtain collaborative access data for each user and other users within the characteristic group to which the user belongs. The collaborative access data includes the timestamp of each collaborative access and the context type of the collaboration. The context type is divided into several categories according to the sensitivity of the medical data.

[0077] S542. Calculate the user's collaboration frequency weight based on the collaboration access data; the formula for calculating the collaboration frequency weight is:

[0078] ;

[0079] In the above formula, This represents the weight of the number of collaborations after time decay, when the context of a user collaborating with the i-th collaborating object is the k-th context type. This represents the total number of collaborations within a certain time period when the context of a user collaborating with the i-th collaborating object is the k-th context type. This represents the decay rate coefficient of the k-th context type. Indicates the current timestamp. This represents the timestamp when the i-th collaborative action occurs;

[0080] S543. Set context weights based on the importance of medical data; the formula for calculating context weights is:

[0081] ;

[0082] In the above formula, This represents the context weight of context type k. This represents the mean importance of the medical data of the k-th context type. Let H represent the average importance of the j-th context type, and H represent the total number of context types.

[0083] S544. Calculate the extended trustworthiness of the user's collaborating objects; the formula for calculating extended trustworthiness is:

[0084] ;

[0085] In the above formula, This represents the extended trustworthiness of the i-th collaborative object. This represents the current trustworthiness of the i-th collaborating object. This represents the current trustworthiness of the j-th collaborating object. This represents the set of collaborative objects that have engaged in collaborative activities with the user. This indicates the number of collaborating objects that have engaged in collaborative activities with the user. This represents the credibility weight of the collaborating object itself;

[0086] S545. Calculate the collaboration factor based on the user's collaboration frequency weight, the extended credibility of the collaboration object, and the context weight; the formula for calculating the collaboration factor is:

[0087] ;

[0088] In the above formula, Indicates the collaboration factor. This represents the collaboration coefficient of the k-th context type. This represents the smoothing constant, and there are a total of M collaborating objects.

[0089] Preferably, step S6 specifically includes the following steps:

[0090] S61. Obtain all possible user actions;

[0091] S62. Divide the confidence level, which ranges from 0 to 1, into several consecutive control intervals;

[0092] S63. Different operational behaviors are each mapped to at least one control zone to establish a smart contract;

[0093] S64. Obtain the user's current operation request;

[0094] S65. Determine whether the operation request is within the corresponding control range;

[0095] If so, allow the user's action request;

[0096] If not, then block the user's action request and mark it as an abnormal access request.

[0097] A medical data abnormal access identification system includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, implements the medical data abnormal access identification method.

[0098] By employing the above technical solution, the present invention provides a method and system for identifying abnormal access to medical data, which has at least the following beneficial effects:

[0099] 1. This invention first collects user IDs and access logs to provide a basis for behavioral analysis. Then, new users are assigned initial credibility based on the historical credibility of their group and jump to permission settings, avoiding the blindness of traditional random weighting. For existing users, current and historical access data are vectorized and the fit is calculated to quantify behavioral continuity and capture abnormal deviations. Then, a three-dimensional evaluation vector is constructed by combining data importance, access duration, and fit. The initial credibility is calculated using a density function. Finally, the model is dynamically updated according to the fit range. The credibility is then mapped to a smart contract control range to automatically intercept requests exceeding permissions, achieving fine-grained real-time permission control and accurate interception of abnormal access, effectively improving the security and credibility of the medical data sharing platform.

[0100] 2. This invention constructs a three-dimensional evaluation vector through multi-dimensional behavioral analysis of fit, access duration, and average data importance, and introduces a density function to calculate the initial credibility, breaking through the limitations of traditional static thresholds or linear models. The fit calculation combines the statistical weights of the overlap of user's historical access data (N11), new access (N10), and historical non-access (N01) to dynamically reflect behavioral consistency.

[0101] 3. The density function of this invention extracts the density center based on the historical similarity distribution, avoiding random bias and ensuring robust credibility assessment. Combined with the real-time update mechanism of blockchain, the credibility is dynamically adjusted with each access, effectively identifying short-term high-frequency anomalies, such as sudden batch requests for sensitive data. Compared with traditional methods, it significantly improves the assessment accuracy and supports real-time parsing of complex behavior patterns.

[0102] 4. This invention constructs a dual anomaly identification model based on fit offset detection and failed request statistics. When the fit is below a threshold, the inhibition factor automatically amplifies the credibility decay. If a single failed access request exceeds a preset number, the failure factor further reduces the credibility. The smart contract monitors user requests in real time. When a user with low credibility attempts a high-risk operation (such as exporting encrypted medical records), the system intercepts and marks the anomaly within a certain time, such as 50ms, and can simultaneously trigger an alarm log to be uploaded to the blockchain for evidence storage.

[0103] 5. For new users, the system uses cluster analysis to classify them into characteristic groups and statistically analyzes the historical credibility distribution within the group. The median mean of the high-frequency credibility interval is selected as the initial value. This method avoids the permission imbalance caused by traditional random weighting or subjective scoring, so that new users can obtain reasonable data access permissions and be constrained by group behavior. The initial permission misjudgment rate is reduced by 40%, significantly reducing the problems of "over-authorization" or "insufficient permissions". Attached Figure Description

[0104] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0105] Figure 1 This is a flowchart of the medical data abnormal access identification method of the present invention. Detailed Implementation

[0106] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. This will allow for a full understanding of how the present application uses technical means to solve technical problems and achieve technical effects, and to facilitate its implementation.

[0107] To address the technical problems of traditional medical data access control technologies, such as the lack of fine-grained trust assessment mechanisms, difficulty in dynamically adapting to the complexity of access behavior, and lag in the identification of abnormal access, this invention provides a method for identifying abnormal access to medical data. This method is used in blockchain platforms that share medical data, such as... Figure 1As shown, by utilizing smart contracts combined with dynamic trust calculations and real-time updates of user permissions, the accuracy of abnormal access detection is improved. This abnormal access identification method specifically includes the following steps:

[0108] S1. Obtain the user ID that made the data request and the user's access log from the blockchain. The access log contains the medical data accessed by the user each time and the duration of each access. The user is usually a doctor. This enables data sharing to help doctors treating patients obtain more comprehensive medical data about the patients.

[0109] S2. Determine whether the current user is a new user, i.e., whether it is a user visiting for the first time;

[0110] If so, then grant the current user credibility, which will facilitate the subsequent establishment of smart contracts, identification of new users' access behavior, and proceed to step S6;

[0111] If not, proceed to step S3;

[0112] Traditional methods for setting trust levels for new users are simplistic and crude, often using fixed thresholds or random assignments without considering group behavioral characteristics (such as the historical trustworthiness of doctors in the new user's department). This can easily lead to misjudgments or abuse of permissions. Therefore, in this invention, the specific method for granting trust levels to users includes the following steps:

[0113] S21. Divide all users into several user groups and mark the user group to which the current user belongs as a feature group. Each user group can be all doctors in a hospital, or all doctors in each department of a hospital, etc.

[0114] S22. Obtain the credibility of all users within the feature group, and set several consecutive credibility intervals between 0 and 1. For example, the credibility interval can be set to... Three consecutive confidence intervals.

[0115] S23. Count the number of confidence values ​​contained in each confidence interval, and select the confidence intervals with the most confidence values ​​as the standard confidence intervals.

[0116] S24. Calculate the average of the medians of each standard credibility interval and use it as the current user's credibility. For example, for the intervals given above... Three consecutive confidence intervals with values ​​of 0.2, 0.6, and 0.9 are given. If the interval is selected as the standard confidence interval... and Then the average of the median of the standard confidence interval is .

[0117] The method for assigning credibility to the current user is based on the user's identity verification. If an anomaly is found during the identity verification process, the initial credibility can also be manually set through the backend. For example, a lower credibility can be set for suspicious individuals who need to apply for an account temporarily.

[0118] S3. Vectorize the medical data from this visit and the medical data from previous visits, and calculate the fit between the two. To further describe the method of medical data vectorization and fit calculation, step S3 specifically includes the following steps:

[0119] S31. Number all medical data, for example, by numbering each medical data with Arabic numerals. This can unify the unique identifier of medical data, eliminate data ambiguity, provide a standardized basis for vectorization, and avoid dimensional conflicts caused by chaotic data naming.

[0120] S32. Obtain the access numbers of all medical data accessed by the user based on the user's access logs, and arrange them sequentially to establish an access set. A standardized access set is established, but there may be a large amount of noisy data in the access set, such as requests for specific actions made by a user through accidental operation. These noisy data need to be removed. The following is a method for removing noisy data from group medical data, specifically including the following steps:

[0121] S321. Based on each user's access logs, obtain all medical data that users within the corresponding characteristic group have accessed. Based on the characteristic group to which the user belongs (such as department or role), extract the historical medical data of all users within that group to avoid the bias caused by relying solely on individual behavior and enhance the group representativeness of the access set.

[0122] S322. Count the number of users who have accessed each medical data by users within the characteristic group, count the total number of users within the group who have accessed each medical data, identify high-frequency common data and low-frequency marginal data, and provide quantitative basis for subsequent screening.

[0123] S323. Set a user number threshold, and obtain medical data with fewer than the user number threshold, and mark it as data to be filtered, remove low-frequency noise (such as unpopular medical records or abnormal test records), and reduce the interference of irrelevant data on fit calculation.

[0124] S324. Remove medical data that the current user has already accessed during this visit from the data to be filtered to obtain the data to be removed. This prevents the loss of the user's actual behavioral characteristics due to excessive removal and ensures the accuracy and completeness of the data filtering.

[0125] S325. Based on the user's access log, obtain all the medical data that the user has accessed, and remove the data to be removed to obtain standard medical data. Generate standard medical data that only contains high-frequency data of the user group and the user's actual access records, balancing the commonality of the group and the specificity of the individual, and improving the reliability of subsequent analysis.

[0126] S326. Arrange the standard medical data numbers in sequence to create an access set.

[0127] S33. Based on the access set, mark the medical data that has been accessed in this user's current access as 1 and the medical data that has not been accessed in this access as 0, so as to generate the current access vector for this access.

[0128] S34. Based on the access set, mark the medical data that has been accessed in the user's historical access as 1 and the medical data that has not been accessed in the past as 0 to generate a historical access vector. Through steps S33 and S34, a unique current access vector and historical access vector are generated to achieve a clear expression of the access status and provide structured input for statistical calculation.

[0129] S35. Count the number of medical data IDs marked as 1 in both the current access vector and the historical access vector. ;

[0130] S36. Count the number of times the same medical data ID is marked as 0 and 1 in the current access vector and the historical access vector, respectively. The number of times the unified medical data number is marked as 1 in the current access vector and 0 in the historical access vector. ;

[0131] S37. Calculate the relevance between the medical data accessed this time and the medical data accessed in the past; the formula for calculating the relevance is:

[0132] ;

[0133] In the above formula, This indicates the degree of relevance between the medical data accessed this time and the medical data accessed in the past, and is obtained through statistical analysis. To comprehensively capture the continuity and shift characteristics of user behavior patterns, through data... It emphasizes both positive consistency and data. Embracing the continuity of historical behavior and through data Identifying abnormal user behavior ensures that the fit is both stable and sensitive to anomaly detection, more accurately reflecting the correlation between user behavior and historical behavior.

[0134] S4. Set the importance of each piece of medical data, i.e., the confidentiality or privacy level of the medical data, and calculate the initial credibility of the user's visit based on the relevance of each visit, the duration of the visit, and the average importance of the data visited. This dynamic initial credibility calculation method facilitates subsequent credibility updates. The specific steps include the following:

[0135] S41. Set the importance of each piece of medical data, and calculate the average importance of each piece of medical data for each user's visit to obtain the average importance value. Setting the importance of each piece of medical data specifically includes the following steps:

[0136] S411. Set several importance assessment criteria, obtain the first importance score of each doctor for each criterion, and construct a first scoring matrix. Collect the original scores of different doctors for each importance assessment criterion to form an initial data matrix. Through multi-dimensional expert opinions, provide basic data for subsequent quantification of the importance of medical data. The expression of the first scoring matrix is:

[0137] ;

[0138] In the above formula, Score represents the scoring matrix. This represents the score given by the m-th doctor to the n-th assessment criterion as the first importance.

[0139] S412. Extract the upper and lower limits of the first importance score, as well as the average of the upper and lower limits, to facilitate the elimination of disagreements among doctors and to unify opinions through the second scoring matrix.

[0140] S413. Transform the scoring matrix into a second scoring matrix; the expression for the second scoring matrix is:

[0141] ;

[0142] in,

[0143] ;

[0144] In the above formula, This represents the second scoring matrix. This represents the score given by the m-th doctor for the second importance of the n-th assessment criterion. These represent the upper limit, lower limit, and average of the upper and lower limits for the first importance score, respectively. This represents the transformation function that converts the independent variable x, i.e., the score for the first importance, into the score for the second importance.

[0145] S414. Normalize the scores for each secondary importance level based on the second scoring matrix to eliminate differences in dimensions, making the weight distribution of each evaluation standard more balanced and preventing certain standards from dominating the results due to their large scoring range; the normalization calculation formula is:

[0146] ;

[0147] In the above formula, and Let represent the second importance score given by the m-th doctor to the n-th assessment criterion before and after normalization. This represents the second importance score of the kth doctor for the nth assessment criterion before normalization, where there are n doctors in total;

[0148] S415. Based on the second importance scores given by each doctor to each assessment criterion before normalization, calculate the average importance score given by all doctors to each assessment criterion after normalization. This yields the consensus on the importance of each assessment criterion within the group, reflecting the priority of overall medical data management. The formula for calculating the average importance score is as follows:

[0149] ;

[0150] In the above formula, This represents the average importance score for the nth evaluation criterion. This represents the normalized score of the kth doctor for the second importance of the nth assessment criterion;

[0151] S416. Obtain the assessment scores of each doctor for the importance assessment criteria of each medical data;

[0152] S417. Calculate the importance of each medical data point based on the evaluation scores of each doctor on the importance assessment criteria and the normalized importance assessment criteria; the formula for calculating the importance of medical data is:

[0153] ;

[0154] In the above formula, Indicates the importance of each piece of medical data. This represents the q-th importance evaluation criterion. This represents the evaluation score of the Fth doctor for the medical data.

[0155] By using expert scoring, standardization, normalization, and weighted calculation, the importance of medical data is dynamically quantified, ensuring that the system prioritizes the protection of highly sensitive data in access control, while avoiding subjective scoring bias and improving the accuracy of abnormal access identification.

[0156] S42. Construct an evaluation vector for each visit based on the average visit duration, relevance, and importance; the expression for the evaluation vector is:

[0157] ;

[0158] In the above formula, A represents the evaluation vector. This indicates the duration of each access. Indicates fit, This represents the mean importance, thus establishing an evaluation vector from three perspectives, which serves as a reference data source for subsequent calculation of initial credibility, enabling refined and dynamic calculation of credibility.

[0159] S43. Calculate the similarity between the evaluation vector of the user's current visit and the evaluation vectors of each visit within a certain period of time; the formula for calculating the similarity is:

[0160] ;

[0161] In the above formula, This represents the similarity between the evaluation vector of the user's current visit and the evaluation vector of the i-th visit. This represents the evaluation vector for the user's current visit. This represents the evaluation vector for the user's i-th visit;

[0162] S44. Calculate the density centers of all similarities to obtain the initial credibility of the user's visit. There are multiple methods for calculating the density centers of a set of data. The following is a new method for calculating density centers to obtain the updated initial credibility in a more granular way. The specific steps include:

[0163] S441. Construct a statistical interval using the minimum and maximum values ​​among all similarities; the expression for the statistical interval is: ,in, and These represent the minimum and maximum values ​​of the statistical interval, respectively.

[0164] S442. Construct a density function to calculate the density value of any similarity within a statistical interval; the expression for the density function is:

[0165] ;

[0166] In the above formula, M represents the density value. This represents any similarity score within a statistical interval. This represents the similarity between the evaluation vector of the user's current visit and the evaluation vector of the i-th visit. Represents a constant. Represents the relationship between the independent variable and the independent variable. The negatively correlated function is accessed a total of n times.

[0167] S443. The similarity with the highest density value is used as the initial credibility of the user's visit, which is the level of consistency of the user's most frequently exhibited behavior. This avoids the random bias of a single high or low similarity value, ensures that the credibility initialization is based on the user's historical behavior patterns, and enhances the robustness and interpretability of the evaluation by extracting the initial credibility in a more scientific way through the density value.

[0168] S5. Set several fit ranges and corresponding credibility update models, and select the corresponding credibility update model based on the fit of the user's current visit. Substitute the initial credibility and fit into the model to update the user's credibility. To achieve dynamic updates of credibility and ensure sensitivity to user behavior during the update process, so as to more scientifically reflect the user's credibility, an adaptive credibility update mechanism is constructed, which specifically includes the following steps:

[0169] S51. Set several consecutive fit ranges within the numerical range of 0 to 1, and determine the fit range corresponding to the fit of the user's current visit.

[0170] S52. Set a negatively correlated inhibition factor based on the distance between the maximum value in the fit range and 0. Thus, depending on the user's fit, the inhibition factor for high fit range approaches 0, and the inhibition factor for low fit range approaches 1, thereby dynamically controlling the confidence update amplitude and avoiding excessive punishment for high consistency behavior or lenient tolerance for low consistency behavior.

[0171] S53. Count the number of times the user failed to make a request during this access, so as to quantify the penalty caused by abnormal user operations in subsequent calculations.

[0172] S54. Construct a user credibility update model and update the user's credibility as the credibility for the user's next visit; the expression for the credibility update model is:

[0173] ;

[0174] In the above formula, This indicates the user's credibility after the update. Indicates the initial confidence level. This represents the relevance of the user's current visit. Setting the value of R in the denominator can significantly improve the model's sensitivity to relevance, enabling efficient identification of visits with low relevance and enhancing sensitivity to abnormal behavior. There are a total of n visits. This represents the request failure factor, which is positively correlated with the number of failed requests the user made during this visit. This represents the inhibition factor for the k-th fit range. Let c represent the sensitivity factor and c represent the collaboration factor, thereby enabling elastic updates of trustworthiness. High-fit access enhances trust accumulation, while low-fit or high-failure access triggers trust decay, thus accurately capturing abnormal behavior characteristics. This overcomes the problem of poor adaptability of traditional static threshold or linear update models to complex behavior patterns, ultimately supporting smart contracts in real-time interception of abnormal access and dynamic permission adjustment. The collaboration factor c is located in the denominator and forms a dynamic balance with the failure chair and the inhibition factor.

[0175] To further achieve a balance between secure sharing and efficient collaboration of medical data, the impact of users' collaborative behavior on their credibility during medical data access is dynamically quantified. This enhances the system's adaptability to complex medical operation modes, such as the need for multi-role collaboration in modern medicine (e.g., collaboration between attending physicians, nurses, and radiologists). It prevents the system from misjudging individual abnormal behavior due to team operations. For example, when interns access sensitive data under the guidance of mentors, the collaboration factor can be linked to the mentor's credibility, preventing insufficient permissions from hindering the normal learning process. Simultaneously, if the credibility of the collaborating partner is too low, the system can automatically ignore such collaboration records, preventing malicious users from artificially inflating their credibility through fake collaborations. The specific method for setting the collaboration factor is as follows:

[0176] S541. Obtain collaborative access data of each user and other users in the characteristic group to which the user belongs. The collaborative access data includes the timestamp of each collaborative access and the context type of the collaboration. The context type is divided into several categories according to the sensitivity of the medical data, such as two categories: one is regular medical data and the other is sensitive medical data.

[0177] S542. Calculate the user's collaboration frequency weight based on the collaboration access data; the formula for calculating the collaboration frequency weight is:

[0178] ;

[0179] In the above formula, This represents the weight of the number of collaborations after time decay, when the context of a user collaborating with the i-th collaborating object is the k-th context type. This represents the total number of collaborations within a certain time period when the context of a user collaborating with the i-th collaborating object is the k-th context type. This represents the decay rate coefficient of the k-th context type. Indicates the current timestamp. The timestamp representing the i-th collaborative action is represented by an exponential function. The weight of historical collaborations is dynamically reduced to differentiate the contributions of emergency and routine collaborations. An exponential decay function is used to reduce the weight of historical collaborations, while reinforcing the positive contribution of recent collaborations to credibility. For example, emergency collaborations such as real-time data sharing during surgery have a stronger timeliness, and the decay rate is faster. It should be lower to preserve long-term impact.

[0180] S543. Set context weights based on the importance of medical data; the formula for calculating context weights is:

[0181] ;

[0182] In the above formula, This represents the context weight of context type k. This represents the mean importance of the medical data of the k-th context type. H represents the mean importance of the j-th context type, and H represents the total number of context types, based on the importance of medical data. The system dynamically assigns weights to different context types to ensure that high-risk collaborations dominate credibility assessments. For example, in an epidemic scenario, the average importance of infectious disease data can be increased from 0.7 to 0.9, and its weight... Correspondingly, we should also increase and strengthen the trust contributions in related collaborations.

[0183] S544. Calculate the extended trustworthiness of the user's collaborating objects; the formula for calculating extended trustworthiness is:

[0184] ;

[0185] In the above formula, This represents the extended trustworthiness of the i-th collaborative object. This represents the current trustworthiness of the i-th collaborating object. This represents the current trustworthiness of the j-th collaborating object. This represents the set of collaborative objects that have engaged in collaborative activities with the user. This indicates the number of collaborating objects that have engaged in collaborative activities with the user. It represents the credibility weight of the collaborating object itself. By combining the credibility of the collaborating object itself with the credibility of the users associated with it in the collaborating network, it identifies potential risk propagation chains and blocks the vulnerability of "low-credibility users mutually boosting collaboration".

[0186] S545. Calculate the collaboration factor based on the user's collaboration frequency weight, the extended credibility of the collaboration object, and the context weight; the formula for calculating the collaboration factor is:

[0187] ;

[0188] In the above formula, Indicates the collaboration factor. This represents the collaboration coefficient of the k-th context type. This represents the smoothing constant, and there are M collaborating objects to prevent the denominator from being 0.

[0189] S6. Set up smart contracts based on trust levels, and identify abnormal access requests based on the user's current trust level. For different user requests with different operational behaviors, permissions need to be set according to their trust levels to form smart contracts. The specific steps for building smart contracts include the following:

[0190] S61. Obtain all possible user actions;

[0191] S62. Divide the confidence level, which ranges from 0 to 1, into several consecutive control intervals;

[0192] S63. Different operational behaviors are each mapped to at least one control zone to establish a smart contract;

[0193] S64. Obtain the user's current operation request;

[0194] S65. Determine whether the operation request is within the corresponding control range;

[0195] If so, allow the user's action request;

[0196] If not, then block the user's action request and mark it as an abnormal access request.

[0197] Of course, this is a smart contract under normal circumstances. In emergency situations, backend personnel can modify permissions. For example, an emergency room doctor can apply to increase permissions in an emergency, which will not be elaborated here.

[0198] The proposed method for identifying abnormal access to medical data constructs a dynamic credibility assessment mechanism through steps S1 to S6. First, user IDs and access logs are collected to provide a basis for behavioral analysis. Then, by distinguishing between new and old users, new users are assigned an initial credibility score based on the historical credibility of their group and are then automatically moved to the permission settings, avoiding the blindness of traditional random weighting. For old users, current and historical access data are vectorized and their relevance is calculated to quantify behavioral continuity and capture abnormal deviations. Next, a three-dimensional evaluation vector is constructed by combining data importance, access duration, and relevance. An initial credibility score is calculated using a density function to improve assessment accuracy. Finally, the model is dynamically updated based on the relevance range, and the credibility score is adjusted based on the number of failed requests to achieve flexible credibility management. Finally, the credibility score is mapped to a smart contract control range to automatically intercept requests exceeding permissions. This method, through the combination of dynamic behavioral modeling and smart contracts, overcomes the lag of traditional static rules, achieving fine-grained real-time permission control and precise interception of abnormal access, effectively improving the security and credibility of medical data sharing platforms.

[0199] The present invention also provides a medical data abnormal access identification system, including a processor and a memory, wherein the memory is used to store a computer program, and the computer program is executed by the processor to implement a medical data abnormal access identification method.

[0200] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0201] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. Since the above embodiments are substantially similar to the method embodiments, their descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0202] The above embodiments provide a detailed description of the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for identifying abnormal access to medical data, used in a blockchain platform for sharing medical data, characterized in that, The method includes the following steps: S1. Obtain the user ID and access log of the user making the data request, wherein the access log contains the medical data and access duration of each access by the user; S2. Determine if the current user is a new user; If not, proceed to step S3; S3. Vectorize the medical data from this visit and the medical data from previous visits, and calculate the fit between the two; Step S3 specifically includes the following steps: S31. Number all medical data; S32. Obtain all the medical data numbers that the user has accessed based on the user's access log, and arrange them in order to establish an access set; S33. Based on the access set, mark the medical data that has been accessed in this user's current access as 1 and the medical data that has not been accessed in this access as 0, so as to generate the current access vector for this access. S34. Based on the access set, mark the medical data that has been accessed in the user's historical access as 1 and the medical data that has not been accessed in the past as 0, so as to generate a historical access vector. S35. Count the number of medical data IDs marked as 1 in both the current access vector and the historical access vector. ; S36. Count the number of times the same medical data ID is marked as 0 and 1 in the current access vector and the historical access vector, respectively. The number of times the unified medical data number is marked as 1 and 0 in the current access vector and historical access vector, respectively. ; S37. Calculate the relevance between the medical data accessed this time and the medical data accessed in the past; the formula for calculating the relevance is: ； In the above formula, This indicates the degree of similarity between the medical data accessed by the user this time and the medical data accessed in the past; S4. Set the importance of each piece of medical data, and calculate the initial credibility of the user's visit based on the relevance of each visit, the duration of the visit, and the average importance of the data visited. S5. Set several fit ranges and corresponding credibility update models, and select the corresponding credibility update model according to the fit of the user's current visit, and substitute the initial credibility and fit to update the user's credibility; Step S5 specifically includes the following steps: S51. Set several consecutive fit ranges within the numerical range of 0 to 1, and determine the fit range corresponding to the fit of the user's current visit. S52. Set a negatively correlated inhibition factor based on the distance between the maximum value in the fit range and 0; S53. Count the number of times the user failed to make a request during this access; S54. Construct a user credibility update model and update the user's credibility as the credibility for the user's next visit; the expression for the credibility update model is: ； In the above formula, This indicates the user's credibility after the update. Indicates the initial confidence level. This indicates the relevance of the user's visit. This represents the fit during the i-th visit, with a total of n visits. This represents the request failure factor, which is positively correlated with the number of failed requests the user made during this visit. This represents the inhibition factor for the k-th fit range. represents the sensitivity factor, and c represents the cooperation factor; S6. Set up smart contracts based on trust level and identify abnormal access requests based on the user's current trust level.

2. The abnormal access identification method according to claim 1, characterized in that, Step S32 specifically includes the following steps: S321. Based on each user's access logs, obtain all medical data that have been accessed by users within the characteristic group corresponding to each user. S322. Count the number of users who have accessed each medical data set by users within the characteristic group. S323. Set a user number threshold, and obtain medical data with fewer than the user number threshold, and mark it as data to be filtered; S324. Remove the medical data that the current user has accessed during this visit from the data to be filtered to obtain the data to be removed; S325. Based on the user's access log, all medical data that the user has accessed will be obtained, and data to be removed will be eliminated to obtain standard medical data. S326. Arrange the standard medical data numbers in sequence to create an access set.

3. The abnormal access identification method according to claim 1, characterized in that, Step S4 specifically includes the following steps: S41. Set the importance of each medical data point and calculate the average importance of each medical data point for each user's visit to obtain the average importance value. S42. Construct an evaluation vector for each visit based on the average visit duration, relevance, and importance; the expression for the evaluation vector is: ； In the above formula, A represents the evaluation vector. This indicates the duration of each access. Indicates fit, This represents the mean importance. S43. Calculate the similarity between the evaluation vector of the user's current visit and the evaluation vectors of each visit within a certain period of time; the formula for calculating the similarity is: ； In the above formula, This represents the similarity between the evaluation vector of the user's current visit and the evaluation vector of the i-th visit. This represents the evaluation vector for the user's current visit. This represents the evaluation vector for the user's i-th visit; S44. Construct a statistical interval using the minimum and maximum values ​​among all similarities; The expression for the statistical interval is: ,in, and These represent the minimum and maximum values ​​of the statistical interval, respectively. S45. Construct a density function to calculate the density value of any similarity within a statistical interval; the expression for the density function is: ； In the above formula, M represents the density value. This represents any similarity score within a statistical interval. This represents the similarity between the evaluation vector of the user's current visit and the evaluation vector of the i-th visit. Represents a constant. Represents the relationship between the independent variable and the independent variable. The negatively correlated function is accessed a total of n times. S46. Obtain the similarity with the highest density value as the initial credibility of the user's visit.

4. The abnormal access identification method according to claim 3, characterized in that, In step S41, setting the importance of each piece of medical data specifically includes the following steps: S411. Set several importance assessment criteria, obtain the first importance score for each doctor on each assessment criterion, and construct a first scoring matrix; the expression for the first scoring matrix is: ； In the above formula, Score represents the scoring matrix. This represents the score given by the m-th doctor to the n-th assessment criterion as the first importance. S412. Extract the upper limit, lower limit, and average of the upper and lower limits of the first importance score; S413. Transform the scoring matrix into a second scoring matrix; the expression for the second scoring matrix is: ； in, ； In the above formula, This represents the second scoring matrix. This represents the score given by the m-th doctor for the second importance of the n-th assessment criterion. , and These represent the upper limit, lower limit, and average of the upper and lower limits for the first importance score, respectively. This represents the transformation function that converts the independent variable x, i.e., the score for the first importance, into the score for the second importance. S414. Normalize the scores for each second importance level according to the second scoring matrix; the normalization calculation formula is: ； In the above formula, and Let represent the second importance score given by the m-th doctor to the n-th assessment criterion before and after normalization. This represents the second importance score of the kth doctor for the nth assessment criterion before normalization, where there are n doctors in total; S415. Based on the second importance scores given by each physician to each assessment criterion before normalization, calculate the average importance score given by all physicians to each assessment criterion after normalization; the formula for calculating the average importance score is as follows: ； In the above formula, This represents the average importance score for the nth evaluation criterion. This represents the normalized score of the kth doctor for the second importance of the nth assessment criterion; S416. Obtain the assessment scores of each doctor for the importance assessment criteria of each medical data; S417. Calculate the importance of each medical data point based on the evaluation scores of each doctor on the importance assessment criteria and the normalized importance assessment criteria; the formula for calculating the importance of medical data is: ； In the above formula, Indicates the importance of each piece of medical data. This represents the q-th importance evaluation criterion. This represents the evaluation score of the Fth doctor for the medical data.

5. The abnormal access identification method according to claim 1, characterized in that, Step S6 specifically includes the following steps: S61. Obtain all possible user actions; S62. Divide the confidence level, which ranges from 0 to 1, into several consecutive control intervals; S63. Different operational behaviors are each mapped to at least one control zone to establish a smart contract; S64. Obtain the user's current operation request; S65. Determine whether the operation request is within the corresponding control range; If so, allow the user's action request; If not, then block the user's action request and mark it as an abnormal access request.

6. The abnormal access identification method according to claim 1, characterized in that, The method for setting the collaboration factor is as follows: S541. Obtain collaborative access data for each user and other users within the characteristic group to which the user belongs. The collaborative access data includes the timestamp of each collaborative access and the context type of the collaboration. The context type is divided into several categories according to the sensitivity of the medical data. S542. Calculate the user's collaboration frequency weight based on the collaboration access data; the formula for calculating the collaboration frequency weight is: ； In the above formula, This represents the weight of the number of collaborations after time decay, when the context of a user collaborating with the i-th collaborating object is the k-th context type. This represents the total number of collaborations within a certain time period when the context of a user collaborating with the i-th collaborating object is the k-th context type. This represents the decay rate coefficient of the k-th context type. Indicates the current timestamp. This represents the timestamp when the i-th collaborative action occurs; S543. Set context weights based on the importance of medical data; The formula for calculating context weights is: ； In the above formula, This represents the context weight of context type k. This represents the mean importance of the medical data of the k-th context type. Let H represent the average importance of the j-th context type, and H represent the total number of context types. S544. Calculate the extended trustworthiness of the user's collaborating objects; the formula for calculating extended trustworthiness is: ； In the above formula, This represents the extended trustworthiness of the i-th collaborative object. This represents the current trustworthiness of the i-th collaborating object. This represents the current trustworthiness of the j-th collaborating object. This represents the set of collaborative objects that have engaged in collaborative activities with the user. This indicates the number of collaborating objects that have engaged in collaborative activities with the user. This represents the credibility weight of the collaborating object itself; S545. Calculate the collaboration factor based on the user's collaboration frequency weight, the extended credibility of the collaboration object, and the context weight; the formula for calculating the collaboration factor is: ； In the above formula, Indicates the collaboration factor. This represents the collaboration coefficient of the k-th context type. This represents the smoothing constant, and there are a total of M collaborating objects.

7. A system for implementing the medical data abnormal access identification method according to any one of claims 1-6, characterized in that, It includes a processor and a memory, the memory being used to store a computer program, which, when executed by the processor, implements the medical data abnormal access identification method as described in any one of claims 1-6.

Images