Medical data privacy protection method and computer device

Abstract

The embodiment of the invention discloses a medical data privacy protection method and a computer device. The method comprises the following steps: firstly, acquiring medical industry laws and regulations and target medical institution data asset information; building a logic relation graph containing data classification and security level according to laws and regulations, and importing the laws and regulations information into a first graph database to obtain a laws and regulations graph; extracting a logical relationship in the data asset information, constructing a data logical relationship graph containing a library table column structure, and importing the data logical relationship graph into a second graph database to obtain an asset graph; business process information is collected, and a data flow relation is identified to perfect an asset map; analyzing the name and content of the data assets to obtain a classification and grading analysis result; on the basis of the result, constructing a heterogeneous graph neural network model by using a graph attention network, establishing a mapping relationship between the two maps, and updating the asset map; and finally, carrying out privacy protection on the data assets according to the updated asset atlas. According to the method, the accuracy and efficiency of medical data classification and grading can be improved, and the privacy protection capability is enhanced.

Description

Technical Field

[0001] The present disclosure relates to the field of data security technology, and in particular to a medical data privacy protection method and computer device. Background Art

[0002] With the rapid development of medical information technology, medical institutions generate and store a large amount of patient data. This data includes not only basic personal information but also highly sensitive medical information such as disease diagnoses, test results, and treatment plans. How to effectively classify and manage this medical data and implement appropriate privacy protection measures has become a critical issue in data security management for medical institutions.

[0003] At present, data classification and grading in the medical industry are usually based on industry regulations and standards. Traditional classification and grading methods mainly rely on manual sorting and judgment, which not only requires a large workload but is also prone to inconsistent subjective judgments, making it difficult to ensure the accuracy and consistency of the classification and grading results.

[0004] Furthermore, existing approaches to protecting medical data privacy often employ a unified protection strategy, failing to implement differentiated protection based on the sensitivity and importance of the data. This approach can overprotect low-sensitivity data, impacting data utilization efficiency, while also underprotecting highly sensitive data, creating the risk of privacy breaches. Summary of the Invention

[0005] In view of this, the embodiments of the present disclosure provide a medical data privacy protection method and computer device, aiming to solve the technical problems in the prior art of low efficiency and accuracy in medical data classification and grading, as well as insufficiently refined privacy protection strategies.

[0006] In a first aspect, the embodiment of the present disclosure provides a medical data privacy protection method, comprising: obtaining regulatory information of the medical industry and data asset information of a target medical institution; establishing a logical relationship diagram including data classification and security level according to the regulatory information, and importing the regulatory information into a first graph database based on the logical relationship diagram to obtain a regulatory map; extracting logical relationship information from the data asset information, constructing a data logical relationship diagram including a library table column structure according to the logical relationship information, and importing the data asset information into a second graph database based on the data logical relationship diagram to obtain an asset map; collecting business process information of the target medical institution, and identifying business nodes according to the business process information. The data flow relationship between points is analyzed to improve the asset map; the naming in the data asset information is analyzed, and the content in the data asset information is analyzed to obtain classification and grading analysis results; based on the classification and grading analysis results, a heterogeneous graph neural network model is constructed using a graph attention network, and the nodes in the regulatory map and the improved asset map are mapped into feature vectors based on the heterogeneous graph neural network model, and the association relationship is determined by calculating the attention weights between the nodes, and a mapping relationship between the two maps is established; the improved asset map is updated according to the mapping relationship; based on the updated asset map, the privacy of the data asset information of the target medical institution is protected.

[0007] In a second aspect, an embodiment of the present disclosure further provides a computer device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the above-described medical data privacy protection methods.

[0008] In a third aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute any of the medical data privacy protection methods described above.

[0009] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, comprising a computer program / instruction, which implements the steps of any of the above methods when executed by a processor.

[0010] The medical data privacy protection method disclosed in the present application obtains regulatory information of the medical industry and data asset information of the target medical institution, ensures that the data asset information management of the target medical institution complies with the regulatory requirements of the medical industry, and avoids legal risks due to violations; establishes a logical relationship diagram including data classification and security level based on the regulatory information, imports the regulatory information into the first graph database based on the logical relationship diagram, and obtains a regulatory map; extracts logical relationship information from the data asset information, constructs a data logical relationship diagram including the library table column structure based on the logical relationship information, and imports the data asset information into the second graph database based on the data logical relationship diagram, and obtains an asset map. By constructing the regulatory map and the asset map, the logical relationship of the classification and grading of medical data can be intuitively displayed, thereby improving the visualization and comprehensibility of the classification and grading; then collects the business process information of the target medical institution, identifies the data flow relationship between business nodes based on the business process information, and improves the asset map; and performs name processing on the data asset information. Through business process analysis, the data flow relationship between business nodes is identified, the asset map is improved, and the classification and grading are more in line with actual business scenarios; based on the classification and grading analysis results, a heterogeneous graph neural network model is constructed using a graph attention network, and the nodes in the regulatory map and the improved asset map are mapped to feature vectors based on the heterogeneous graph neural network model. The association relationship is determined by calculating the attention weights between the nodes, and a mapping relationship between the two maps is established; the improved asset map is updated according to the mapping relationship, and a heterogeneous graph neural network model is constructed using a graph attention network to realize automatic mapping between the regulatory map and the asset map, effectively improving the accuracy and efficiency of classification and grading; based on the updated asset map, the data asset information of the target medical institution is protected for privacy, and differentiated privacy protection is implemented based on the classification and grading results, which not only ensures the security of sensitive data but also improves data usage efficiency. This method can comprehensively and accurately identify and protect the privacy of data assets, reduce the risk of data leakage and abuse, safeguard patients' personal privacy and the information security of medical institutions, and, combined with business process information, better understand the flow of data in the business, optimize business processes, and improve the operational efficiency and service quality of medical institutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 Flowchart of a medical data privacy protection method provided by an embodiment of the present invention.

[0012] Figure 2 Schematic diagram of business process analysis in an embodiment of the present invention.

[0013] Figure 3 The present invention is a flowchart of a method for constructing a data logic relationship diagram including a library table column structure based on logic relationship information in an embodiment of the present invention. DETAILED DESCRIPTION

[0014] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0015] Reference Figure 1 This application discloses a medical data privacy protection method. The present invention is applied to data classification and privacy protection in medical health information systems, providing a data security management solution for medical institutions. The method specifically includes: S100, obtain regulatory information of the medical industry and data asset information of the target medical institution. Specifically, regulatory information of the medical industry, such as the "XX Medical Health Data Security Classification and Grading Management Technical Specifications", can be obtained from relevant official websites, industry association websites and other channels through crawler technology. At the same time, data asset information of the target medical institution is obtained from the information system of the medical institution through database connection, API interface call and other methods, including electronic medical record system, medical image archiving and communication system (PACS), laboratory information management system (LIS), etc., covering the patient's basic information, diagnosis results, examination and inspection reports, etc. This information includes database structure, table structure, field information, etc. Comprehensive and accurate acquisition of regulatory information and data asset information is the basis of the entire privacy protection method. Regulatory information provides a compliance basis for the privacy protection of data assets, while data asset information is the object of subsequent analysis and protection.

[0016] S200: Based on the regulatory information, a logical relationship diagram containing data classification and security levels is established. Based on the logical relationship diagram, the regulatory information is imported into a first graph database to obtain a regulatory graph. Specifically, the regulatory information is analyzed to determine different types of data (such as patient personal identity information and sensitive medical information) and their corresponding security levels (such as public, internal, and confidential), and a logical relationship diagram is constructed. A suitable graph database, such as Neo4j, is selected and the nodes (data types, security levels, etc.) and edges (logical relationships) in the logical relationship diagram are imported into it to form a regulatory graph. The regulatory graph uses an intuitive graph structure to display the logical relationships between data classifications and security levels in the regulations, facilitating subsequent association and analysis with the data asset graph, thereby improving the understandability and application efficiency of the regulations.

[0017] In a specific embodiment, by importing regulatory information into a first graph database (e.g., Neo4j) based on a logical relationship diagram, a corresponding regulatory map can be generated, where gray nodes with numbers represent levels, dark gray nodes represent categories, and other gray nodes represent content. This diagram allows for intuitive display.

[0018] S300 extracts logical relationship information from the data asset information, constructs a data logical relationship diagram containing the library, table, and column structures based on this logical relationship information, and imports the data asset information into a second graph database based on the data logical relationship diagram to generate an asset map. Specifically, data exploration is performed on the data asset information to analyze the associations between different data tables (such as primary key-foreign key relationships) and the dependencies between columns within tables. For example, the patient ID in the electronic medical record table is associated with the patient ID in the patient basic information table. Based on these logical relationships, a data logical relationship diagram is constructed to clarify the hierarchical structure of the libraries, tables, and columns. The data asset information is then imported into a second graph database (such as Neo4j) to form an asset map. The asset map clearly displays the internal logical relationships and structure of the data assets, facilitating a comprehensive understanding of the distribution and associations of data assets, and providing a foundation for subsequent data classification, grading, and privacy protection.

[0019] S400, collect the business process information of the target medical institution, identify the data flow relationship between business nodes based on the business process information, and improve the asset map. Specifically, business process information can be collected by communicating with the business personnel of the medical institution, viewing the business process diagram, analyzing the operation log of the information system, etc. For example, the data flow of business links such as patient registration, medical treatment, examination, and treatment. Based on the business process information, identify the data input and output relationship between each business node, and add these data flow relationships to the asset map. For example, in the patient treatment link, the electronic medical record system will obtain the patient's basic information from the registration system. The improved asset map not only includes the static structure information of the data assets, but also reflects the dynamic flow of data in the business process, making privacy protection more comprehensive and accurate, and better able to deal with data security risks in actual business.

[0020] S500: Analyze the naming and content of the data asset information to obtain classification and grading analysis results. Specifically, semantic analysis is first performed on the names of the database, table, and column names in the data asset information to extract keywords and match them with the medical terminology database. Next, a sampling analysis is performed on the data content to identify data types and sensitivity levels. Finally, the results of the naming and content analysis are combined to obtain preliminary classification and grading analysis results.

[0021] Furthermore, by formulating naming rules and keyword dictionaries, the table names and column names in the data asset information can be analyzed; natural language processing technology and data mining algorithms can be used to analyze the content of the data asset information; and the results of naming analysis and content analysis can be combined to classify and grade data assets according to the data classification and security level standards in the regulatory map. The classification and grading analysis results provide a basis for the subsequent formulation of privacy protection strategies, and can take corresponding protection measures according to different data categories and security levels, thereby improving the pertinence and effectiveness of privacy protection.

[0022] S600, based on the results of the classification and hierarchical analysis, uses a graph attention network to construct a heterogeneous graph neural network model. Based on the heterogeneous graph neural network model, the nodes in the regulatory map and the improved asset map are mapped into feature vectors. The association relationship is determined by calculating the attention weights between the nodes, and a mapping relationship between the two maps is established. Specifically, based on the results of the classification and hierarchical analysis, a heterogeneous graph neural network model is first constructed using a graph attention network. Then, the regulatory map and the asset map are input into the model, and the nodes in the maps are mapped into feature vectors. Finally, by calculating the attention weights between the nodes, the association relationship between the nodes in the regulatory map and the asset map is determined, and a mapping relationship between the two maps is established. The heterogeneous graph neural network model can effectively capture the complex association relationships between the nodes in the regulatory map and the asset map, establish an accurate mapping relationship, and provide strong technical support for subsequent data asset updates and privacy protection.

[0023] S700: Update the improved asset map based on the mapping relationship. Specifically, based on the established mapping relationship, the classification and level information in the regulatory map is associated with the corresponding nodes in the asset map, forming an updated asset map. In the updated asset map, each data asset node is associated with the corresponding classification and level information.

[0024] Furthermore, based on the mapping relationship between the regulatory map and the asset map, the classification and grading information and security level of data assets in the asset map can be updated. At the same time, the data flow relationship in the asset map can be updated to ensure that it is consistent with regulatory requirements. The updated asset map can promptly reflect changes in regulatory requirements, ensure that the privacy protection measures of data assets always comply with the latest regulatory standards, and improve the security of data assets.

[0025] S800, based on the updated asset map, performs privacy protection on the data asset information of the target medical institution. Specifically, based on the classification and level information in the updated asset map, differentiated privacy protection measures are implemented for the data assets of the target medical institution. For example, for highly sensitive data, strong protection measures such as encryption and desensitization can be adopted; for medium-sensitive data, access control, auditing and other measures can be adopted; for low-sensitivity data, basic security protection measures can be adopted. By implementing privacy protection measures based on the updated asset map, the data asset information of the target medical institution can be effectively protected, data leakage and abuse can be prevented, the security and privacy of medical data can be ensured, and regulatory compliance requirements can be met.

[0026] The medical data privacy protection method disclosed in this application comprehensively and efficiently guarantees the security and compliance of medical data. First, it obtains medical industry regulatory information and data asset information of the target medical institution to ensure that data management complies with regulatory requirements and avoid legal risks. By constructing a regulatory map and an asset map, the regulatory information is imported into the first graph database to form a regulatory map, and the data asset information is imported into the second graph database to obtain an asset map, which intuitively displays the logical relationship between medical data classification and grading, and improves visualization and comprehensibility. Secondly, it collects business process information, identifies the data flow relationship between business nodes, and then improves the asset map to make the classification and grading more in line with the actual business scenario. The naming and content of the data asset information are analyzed to obtain the classification and grading analysis results. Thirdly, a heterogeneous graph neural network model is constructed using a graph attention network to map the nodes of the regulatory map and the improved asset map into feature vectors, calculate the attention weight to determine the association relationship, establish a mapping relationship between the two maps, realize automatic mapping, and improve the accuracy and efficiency of classification and grading. Finally, the asset map is updated according to the mapping relationship, and based on this, the privacy protection of the data asset information of the target medical institution is implemented. This method performs differentiated privacy protection based on classification and grading results, which not only ensures the security of sensitive data but also improves data utilization efficiency.

[0027] This approach offers significant advantages, enabling comprehensive and accurate identification and protection of data asset privacy, reducing the risk of data leakage and misuse, and safeguarding patient privacy and medical institution information security. Furthermore, by integrating business process information, it can better understand the flow of data within businesses, optimize business processes, and improve the operational efficiency and service quality of medical institutions, possessing significant application value in the field of medical data privacy protection.

[0028] The method for "importing regulatory information into the first graph database based on the logical relationship diagram" in S200 includes: A100, extracting classified and graded regulatory information from the logical relationship diagram, and converting the classified and graded regulatory information into structured data containing category nodes and level nodes according to a preset data structure template; A200, obtaining the actual content information of each subcategory in the classified and graded regulatory information, the actual content information including data description, security level and protection requirements; A300, calling the latest legal and regulatory information database to obtain standardized classification and grading specifications; A400, performing a field-level consistency comparison between the actual content information and the standardized classification and grading specifications to obtain a consistency comparison result; A500, when the consistency comparison result is consistent, using the actual content information as the target content of the corresponding subcategory; when the consistency comparison result is inconsistent, using the corresponding content in the standardized classification and grading specifications as the target content; A600, importing the target content into the first graph database to generate a regulatory map containing level nodes, category nodes and content nodes.

[0029] Specifically, extracting classified and graded regulatory information from the logical relationship diagram is the first step in building a regulatory map. First, a deep analysis of regulatory documents within the medical industry is conducted to identify their hierarchical structure and logical relationships. These regulations typically employ a multi-level classification system, such as categorizing medical data into broad categories such as personal information, diagnosis and treatment information, and management information, each of which contains multiple subcategories. The system uses natural language processing technology to extract this classification information from the regulatory text, including category names, hierarchical relationships, and scope of application. Once extracted, this classified and graded regulatory information is converted into structured data based on a preset data structure template. This template defines the attribute structure of category nodes and level nodes. Category nodes contain attributes such as category ID, category name, parent category ID, and description; level nodes contain attributes such as level ID, level name, and safety requirements. Through this structured conversion, the system transforms unstructured regulatory text into structured data that can be processed by a graph database, laying the foundation for subsequent graph construction.

[0030] Obtaining the actual content of each subcategory within the classified and graded regulatory information is crucial for enriching the semantics of the graph. Through in-depth analysis of the regulatory text, detailed information for each data subcategory is extracted. This information typically consists of three core components: data description, security level, and protection requirements. The data description details the definition, scope, and typical examples of the data in this category. For example, a description of "personal identification information" might include "name, ID number, phone number, and other information that can directly identify a specific individual." The security level specifies the sensitivity and level of protection for this data, typically categorized into multiple levels, such as "highest," "high," "medium," and "low." Protection requirements specify the security measures to be taken during the storage, transmission, and use of this data, such as "highest-level data must be stored using strong encryption and access requires multi-factor authentication." Using semantic analysis and pattern matching techniques, this content is accurately extracted from the regulatory text and stored in a structured format. This detailed information not only enriches the semantics of the graph but also provides specific guidance for subsequent data classification and grading, as well as the implementation of protection measures.

[0031] Calling the latest legal and regulatory information database to obtain standardized classification and grading specifications is an important measure to ensure compliance. The legal and regulatory environment for medical data protection is complex and constantly updated. In addition to industry standards, it is also subject to other information protection-related laws and local regulations. Through the API interface, connect to authoritative legal and regulatory information databases, such as the National Health Commission Data Standard Library, the National Standardization Administration Database, etc., to obtain the latest standardized classification and grading specifications in real time. These standardized specifications are usually formulated and maintained by official agencies and have higher authority and timeliness. The obtained standardized specifications include the latest data classification system, security level definitions, protection requirements details, etc. These contents are structured into a unified format to facilitate comparison with the actual content information extracted. In this way, it can be ensured that the constructed regulatory map meets the latest legal and regulatory requirements and avoid compliance risks caused by regulatory updates.

[0032] Comparing the actual content information with the standardized classification and grading specifications at the field level is a key step in ensuring data accuracy. A multi-dimensional comparison strategy is adopted to conduct fine-grained comparisons of the data description, security level, and protection requirements of each subcategory. In terms of data description, a semantic similarity algorithm is used to calculate the degree of match between the actual content and the standard specifications, taking into account semantic variants such as synonyms, hyponyms, and hyponyms; in terms of security levels, the level names and definitions are strictly compared to ensure the consistency of the level division; in terms of protection requirements, a rule-based comparison method is used to check whether the actual content covers all necessary protection measures in the standard specifications. During the comparison process, different matching thresholds are set. Through this strict field-level comparison, the consistency and differences between the actual content and the standard specifications can be accurately identified.

[0033] This system uses Neo4j as its primary graph database. First, a Neo4j database instance is created, node labels and relationship types are defined, and the processed target content is imported into Neo4j according to a predefined graph schema. Specifically, three main types of nodes are created: level nodes (labeled "Level"), representing data security levels, such as "Highest" and "High"; category nodes (labeled "Category"), representing data classifications, such as "Personal Information" and "Medical Information"; and content nodes (labeled "Content"), representing specific data content descriptions, scope, and protection requirements. Furthermore, relationships are created between nodes: an "ASSIGN_LEVEL" relationship is established between level nodes and category nodes, indicating the assigned security level of a category; a "PARENT_OF" relationship is established between category nodes, representing the category hierarchy; and a "HAS_CONTENT" relationship is established between category nodes and content nodes, representing the specific content of a category. All nodes and relationships are assigned corresponding properties. This approach creates a semantically rich and clearly structured regulatory map in Neo4j, visually displaying the complete system of medical data classification and grading. Similarly, the second graph database, mentioned in the subsequent steps, was also implemented using Neo4j. A separate Neo4j database instance was created for the asset graph, defining node types such as database nodes ("Database" tab), table nodes ("Table" tab), and column nodes ("Column" tab), as well as the "CONTAINS" relationship between them. The two Neo4j instances can be deployed on different databases on the same server, or in a distributed environment for improved performance and reliability. Neo4j's cross-database query capabilities enable correlation analysis and mapping between the regulatory graph and the asset graph. The key advantages of choosing Neo4j as a graph database include: efficient graph traversal, particularly well-suited for handling the complex relationships in medical data; a flexible graph model that easily adapts to the changing data structures of different medical institutions; powerful visualization capabilities, providing intuitive graph presentation for data managers; and a rich library of graph algorithms that support complex graph analysis and reasoning. These features of Neo4j enable efficient storage and management of the regulatory graph and asset graph, providing a solid technical foundation for protecting medical data privacy.

[0034] Reference Figure 3, the method of "constructing a data logical relationship diagram including library, table and column structures according to logical relationship information" in S300 specifically includes: S301, extracting database identifier, data table identifier and data field identifier from data asset information; S302, constructing a three-layer data normalization processing interface; the three-layer data normalization processing interface includes a library-level interface for standardizing database information, a table-level interface for standardizing data table information and a column-level interface for standardizing data field information; S303, inputting the database identifier and its corresponding description information into the library-level interface to obtain standardized library-level information; S304, inputting the data table identifier and its corresponding description information into the table-level interface to obtain standardized table-level information; S305, inputting the data field identifier and its corresponding description information into the column-level interface to obtain standardized column-level information; S306, constructing a data logical relationship diagram according to the hierarchical relationship between the standardized library-level information, the standardized table-level information and the standardized column-level information.

[0035] Specifically, the database identifier, data table identifier, and data field identifier are first extracted from the data asset information as the basic elements for constructing the data logical relationship diagram. To ensure the standardization and consistency of data representation, a three-layer data normalization processing interface is constructed, which includes a library-level interface for standardizing database information, a table-level interface for standardizing data table information, and a column-level interface for standardizing data field information. During the data processing process, the database identifier and its corresponding descriptive information are input into the library-level interface, and after normalization processing, standardized library-level information is obtained; similarly, the data table identifier and its corresponding descriptive information are input into the table-level interface to obtain standardized table-level information; the data field identifier and its corresponding descriptive information are input into the column-level interface to obtain standardized column-level information. Finally, based on the hierarchical relationship between standardized library-level information, standardized table-level information, and standardized column-level information, a complete data logical relationship diagram is constructed. This relationship diagram accurately reflects the hierarchical structure and association relationship of the library, table, and column in the data assets.

[0036] The method for identifying the data flow relationship between business nodes in S400 includes: S401, configuring data collection rules including data source type, collection cycle and filtering rules; S402, collecting log information, application programming interface call information and database access records of the target medical institution based on the data collection rules to obtain business process information; S403, constructing an event chain based on timestamps and operation identifiers, correcting abnormal or missing data in the business process information, and obtaining a trimmed business event sequence arranged in chronological order; S404, constructing a Bayesian network model, and using the operation type, data object and access mode in the business event sequence as nodes based on the Bayesian network model to calculate the conditional probability between adjacent business operations; S405, inputting the conditional probability into a Markov decision process model to calculate the transition probability and data dependency between business nodes; wherein the state space in the Markov decision process model is composed of business nodes and data operations; S406, constructing a data flow relationship diagram based on the transition probability and data dependency, and screening the data flow relationship that meets the requirements through a confidence threshold.

[0037] Specifically, configuring data collection rules, including data source types, collection cycles, and filtering rules, is the primary step in collecting business process information. In actual deployment, data source types are precisely defined based on the medical institution's information system architecture, including the location and format of log files for core business systems such as electronic medical record systems, hospital information systems, laboratory information systems, image archiving, and communication systems. The setting of the collection cycle needs to balance data real-time performance with system load. Typically, a near-real-time collection strategy is adopted for critical business systems such as emergency systems, while daily scheduled collection can be used for non-critical systems such as medical insurance settlement systems. Filtering rules are used to exclude irrelevant data to ensure that the collected data is focused on business processes.

[0038] Based on configured data collection rules, the system automatically collects multi-source, heterogeneous data from the target medical institution. Log information primarily originates from various business application systems, recording user logins, function access, and operation execution. Application programming interface call information reflects data interactions between systems, such as when the electronic medical record system calls the inspection system interface to obtain test results. Database access records directly display data addition, deletion, modification, and query operations. These three types of information complement each other and together form a complete business process view. A distributed collection architecture is employed, with lightweight collection agents deployed at key nodes. Data is transmitted to a central processing server via encrypted channels, ensuring the security and reliability of the data collection process. The collected raw data is standardized and uniformly converted into a structured format containing fields such as operation time, operation type, operation object, and operator, laying the foundation for subsequent analysis.

[0039] Constructing an event chain based on timestamps and operation identifiers is a key step in transforming dispersed operation logs into coherent business processes. First, all operations are sorted by timestamp, and then operations belonging to the same business process are linked based on operation identifiers (such as patient ID, consultation number, etc.). During this process, various anomalies need to be handled: timestamp inconsistencies are corrected through cross-validation of multi-source data; missing operation links are supplemented through inference based on business rules and historical patterns; and duplicate records are deduplicated through similarity calculation. In this way, a chronologically arranged and logically complete sequence of business events is generated, truly reflecting the patient's complete medical process within a medical institution.

[0040] Building a Bayesian network model is a core technology for understanding the causal relationships between business operations. The trimmed business event sequence is fed into a Bayesian network learning algorithm to identify conditional dependencies between operations. During this process, operation types (such as registration, consultation, ordering, and reviewing test results), data objects (such as patient information, medical history, test results, and doctor's orders), and access modes (such as create, read, update, and delete) are represented as nodes in the network. Using statistical learning methods, conditional probability tables between nodes are calculated to quantify the strength of dependencies between different operations. This probabilistic modeling approach effectively addresses the uncertainty and diversity of medical business processes and adapts to personalized diagnosis and treatment pathways for different patients.

[0041] Inputting conditional probabilities into a Markov decision process model is a key step in transforming static dependencies into a dynamic process model. In this model, the state space is composed of business nodes (such as registration offices, clinics, laboratories, and pharmacies) and data operations (such as creating patient records, updating diagnostic information, and querying drug information). Based on the conditional probabilities calculated by the Bayesian network, a state transition matrix is constructed to quantify the probability of transitioning from one business node to another and the degree of data dependency involved in this transition. Data dependency, calculated using metrics such as information gain, reflects the degree to which data generated by upstream nodes influences the decisions of downstream nodes. This Markov decision process-based modeling approach not only captures the mainstream paths of business processes but also identifies key data dependencies, providing an important basis for subsequent data classification and grading.

[0042] Based on the transition probability and data dependency, an intuitive data flow relationship diagram is constructed. The diagram uses business nodes as vertices and data flow relationships as edges. The thickness of the edges represents the intensity of the data flow, and the color represents the type of data. To ensure the quality and reliability of the relationship diagram, a confidence threshold is set and only those statistically significant data flow relationships are retained. During the screening process, the three factors of transition probability, data dependency, and sample size are comprehensively considered to calculate the comprehensive confidence score. The high-confidence data flow relationships finally screened out are integrated into the asset map to form a comprehensive view that includes both static data structure and dynamic data flow. This enhanced asset map can help medical institutions more comprehensively understand the usage of data assets and identify key data flows and potential risk points.

[0043] Further references Figure 2 This example uses a specific business process analysis as an example. In the daily operations of medical institutions, various business processes, such as registration, consultation, examination, treatment, and prescription, generate a large amount of data flow. This step begins by deploying an automated business process collection system based on the BPMN 2.0 standard. This system extracts business interaction traces from the target medical institution's information systems. Flexible data collection rules, including data source type (such as application system logs, database access records, API call information), collection cycle (real-time, hourly, daily, etc.), and filtering rules (excluding irrelevant data), ensure that the collected business process information is comprehensive and accurate. After collection is complete, an event chain is constructed based on timestamps and operation identifiers, chronologically linking business operations distributed across different systems. This process intelligently corrects abnormal or missing data. The corrected business event sequence truly reflects the complete business process from patient admission to discharge, including the data operations involved at each stage.

[0044] Next, a Bayesian network model is constructed, using the operation types (such as query, modification, and addition), data objects (such as patient information, diagnosis records, and test results), and access modes (such as batch access and single query) in the business event sequence as nodes. The model then calculates the conditional probabilities between adjacent business operations. This probability-based analysis method effectively handles the uncertainty and variability in business processes. The calculated conditional probabilities are then input into a Markov decision process model, which uses business nodes and data operations as the state space and calculates the transition probabilities and data dependencies between business nodes. This approach can identify which business nodes have close data flow relationships and the importance of these data flows. For example, in a medical scenario, there is a clear data dependency between "laboratory examination" and "doctor diagnosis." Test result data flows from the laboratory to the doctor's workstation, and this data flow is crucial for medical decision-making. Based on the calculated transition probabilities and data dependencies, a data flow diagram is constructed, which visually illustrates the paths and strength of data flow between business nodes. To ensure the accuracy and reliability of the diagram, a confidence threshold is set, and only data flow relationships with a confidence level above the threshold are retained.

[0045] Ultimately, the filtered data flow relationships are integrated into the asset map, allowing the map to include not only static data structure information but also dynamic data flow information, thereby more comprehensively reflecting the usage and importance of medical data in business processes. This improved asset map can help medical institutions more accurately identify the flow paths of sensitive data, discover potential data security risks, and provide a more solid foundation for subsequent classification and privacy protection. For example, if special sensitive information such as a patient's XX test results is found to be frequently flowing between multiple business nodes, the security level of this data will be automatically increased, and stricter measures will be taken for subsequent privacy protection.

[0046] The method for "analyzing the naming in data asset information" in S500 includes: B100, constructing a medical field vocabulary based on the medical industry standard terminology set and standardized naming guidelines; B200, constructing a naming semantic capture model based on the Transformer architecture, and pre-training the naming semantic capture model according to the medical field vocabulary; B300, inputting the library name, table name and field name in the data asset information into the pre-trained naming semantic capture model to extract the contextual semantic features of the naming at each level; B400, constructing positive sample pairs and negative sample pairs based on the contextual semantic features, and training the naming semantic capture model based on the positive sample pairs and negative sample pairs and using a contrastive learning strategy; B500, using the trained naming semantic capture model to calculate the similarity of the contextual semantic features and generate a feature similarity matrix; B600, performing namespace clustering analysis based on the similarity matrix, calculating the silhouette coefficient and the inter-cluster distance, and obtaining the clustering results of the naming semantics.

[0047] Specifically, constructing a medical vocabulary based on standard medical terminology and naming guidelines is the foundation of naming analysis. This process begins by integrating multiple authoritative medical terminology resources, including the International Classification of Diseases, the International Medical Terminology, the Chinese Drug Coding System, and standard data element specifications for hospital information systems. Furthermore, database naming conventions and design documents from major medical institutions are collected to extract common naming patterns and abbreviations. During the vocabulary construction process, special attention was paid not only to medical terminology but also to technical terms and abbreviations used in medical information systems, such as "PAT" (patient), "MR" (medical record), and "LAB" (laboratory). Furthermore, a hierarchical relationship and synonym mapping of terms were established, for example, linking different expressions such as "blood sugar," "GLU," and "Glucose." The resulting medical vocabulary contains over 100,000 entries, covering various areas such as clinical diagnosis and treatment, hospital management, and medical insurance settlement, providing a rich knowledge base for subsequent naming semantic analysis.

[0048] Building a naming semantics capture model based on the Transformer architecture is a core technology for understanding naming semantics in medical databases. Specifically, the model employs a multi-layer, bidirectional Transformer encoder structure to effectively capture contextual dependencies in naming. During the model pre-training phase, two tasks, masked language modeling and next sentence prediction, are employed. Terms from a previously constructed medical vocabulary and names from real medical databases serve as training data. During pre-training, the model learns the semantic representation of medical terms and the inherent logic of naming conventions. For example, it understands that "HIS_PAT_INFO" and "EMR_PATIENT_BASIC," while different in name, both refer to the concept of basic patient information. After pre-training, the model can map any medical database name into a semantically rich vector space, laying the foundation for subsequent semantic matching and classification.

[0049] Inputting the library, table, and field names from data asset information into a pre-trained naming semantics capture model is a key step in achieving multi-level semantic understanding. The input names are first standardized and pre-processed, including word segmentation, capitalization unification, and special character processing. The processed name sequence is then input into the Transformer model to obtain a contextualized semantic representation. This process considers the hierarchical structure of names, namely the inclusion relationship between library, table, and column. Through special positional encoding and hierarchical labeling, the model understands the different semantics that the same name may have at different levels. For example, "MEDICATION" as a table name may refer to a drug information table, while as a field name it may refer to a specific medication record. Furthermore, an attention mechanism is used to analyze the internal components of the name, identifying core semantic units and modifiers. This multi-level, multi-angle semantic feature extraction method can comprehensively capture the rich semantic information contained in medical database names, providing accurate feature representations for subsequent semantic matching and classification. The naming semantic capture model uses a multi-layer bidirectional Transformer encoder structure, specifically comprising six Transformer encoder blocks, each of which contains a multi-head self-attention layer (8 heads) and a feedforward neural network layer. The model has an input dimension of 768, a hidden layer dimension of 2048, and uses the GELU activation function. The training data is derived from actual medical database names from multiple hospitals and is cleaned and standardized to form a training set. The model is trained using the Adam optimizer with an initial learning rate of 5e-5, a batch size of 32, and 50 epochs. The model is validated using 10-fold cross-validation, and the final naming classification accuracy on the test set reached 92.3%.

[0050] Constructing positive and negative pairs based on extracted contextual semantic features is a key step in optimizing the naming semantics capture model. High-quality training samples are constructed based on semantic similarity and domain knowledge. Positive pairs include synonymous names, names with hyponyms, and names related to functions. Negative pairs include semantically unrelated names and easily confused names. During sample construction, a semi-supervised learning approach is employed. Seed samples are first constructed based on rules and existing knowledge, and then the sample set is iteratively expanded through model prediction and manual verification. During training of the contrastive learning strategy, the InfoNCE loss function is optimized, ensuring that semantically similar names are closer in feature space and semantically dissimilar names are further apart. This contrastive learning-based training method is particularly well-suited for naming analysis in the medical field, as medical database names often contain numerous variants and abbreviations, making it difficult for traditional classification methods to effectively handle this diversity. Through contrastive learning, the model learns more robust semantic representations that adapt to the naming conventions and styles of different medical institutions.

[0051] Calculating the similarity of contextual semantic features using a trained naming semantic capture model is the foundation for building a naming semantic association network. Cosine similarity is used as the primary metric to calculate the semantic similarity between all library names, table names, and field names in a data asset. The calculation takes into account the hierarchical relationships of names, calculating the similarity between names at the same level (e.g., between tables) and between names across levels (e.g., between tables and fields). To improve computational efficiency, an approximate nearest neighbor search algorithm is used to quickly identify highly similar naming pairs. The calculated similarity values are organized into multiple similarity matrices, corresponding to semantic associations at different levels and across levels. These similarity matrices not only reflect the semantic similarity between names, but also imply the organizational structure and functional associations of data assets. For example, in an analysis of a hospital's HIS system, it was found that the three tables "PAT_BASIC_INFO", "OUTPATIENT_PATIENT" and "INP_PATIENT_MASTER" scattered in different modules had high semantic similarity, indicating that they might store the same type of patient information, which provides important clues for subsequent data classification and privacy protection.

[0052] Performing namespace clustering analysis based on a similarity matrix is a key step in identifying the semantic structure of data assets. The similarity matrix is processed using a spectral clustering algorithm, which is particularly well-suited for high-dimensional, sparse similarity data. During the clustering process, the optimal number of clusters is dynamically determined. Clustering quality is assessed by calculating the silhouette coefficient and inter-cluster distance for different clustering schemes. The silhouette coefficient measures the closeness and separation of clusters; values closer to 1 indicate better clustering. The inter-cluster distance reflects the semantic distinction between categories; larger distances indicate clearer classification. A hierarchical clustering approach is also employed to construct a named semantic tree structure, facilitating understanding of the organizational hierarchy of data assets. After clustering, each cluster is semantically annotated. Based on the shared characteristics of cluster centers and members, descriptive labels are automatically generated, such as "patient basic information," "test results," and "drug prescription information." These semantic clustering results intuitively reflect the inherent organizational structure of medical data assets, helping to identify data objects with similar functions but inconsistent naming, and providing a semantic foundation for subsequent classification and grading. In an implementation case at a tertiary hospital, the system successfully clustered more than 3,000 tables and 15,000 fields into 87 semantic categories with an accuracy rate of 92.3%, greatly improving the efficiency and consistency of data classification.

[0053] Furthermore, building a Transformer-based naming semantics capture model is a key step in achieving semantic understanding of medical database naming. This model utilizes a multi-layer, bidirectional Transformer encoder structure, effectively capturing the semantic information and contextual dependencies in medical database naming. The following details the model's construction scheme: First, the model's input layer is designed as a multi-level embedding representation. For each database name (such as a library, table, or field name), tokenization is performed to break the name into a meaningful token sequence. For example, "PATIENT_BASIC_INFO" is broken down into ["PATIENT", "BASIC", "INFO"]. This tokenization strategy combines rule-based approaches (handling common delimiters such as underscores and camelCase) with statistical methods (identifying abbreviations and terminology unique to the medical field). After token segmentation, three embedding representations are generated for each token: a word embedding, which maps the token into a 300-dimensional semantic space and is initialized using pre-trained medical domain word vectors; a position embedding, which encodes the token's position in the sequence and is generated using the sine-cosine function; and a type embedding, which identifies the naming level (library, table, or column) to which the token belongs and uses a learnable embedding matrix. These three embedding vectors are summed to form the initial representation of the token, which is then input into the Transformer encoder.

[0054] At the heart of the Transformer encoder is a multi-head self-attention mechanism, a key component that enables the model to capture contextual semantic features in naming. This self-attention mechanism allows the model to consider the influence of all other tokens in the sequence when processing each token, thereby capturing long-range dependencies. Specifically, an eight-head attention mechanism is implemented, with each attention head independently learning a different attention pattern. For each token in the input sequence, the model computes three vectors: a query vector, a key vector, and a value vector, obtained by linearly transforming the input vector. Attention weights are then calculated by taking the dot product of the query vector with all key vectors, scaling them, and performing softmax normalization. These weights indicate the degree to which the current token should attend to other tokens in the sequence. Finally, the weighted sum of the attention weights and the value vector is output, capturing a contextually accounted token representation. For example, when processing "PATIENT_BASIC_INFO," the self-attention mechanism recognizes the semantic connection between "PATIENT" and "INFO," understanding that this is a table describing patient information, not just a table describing a patient's treatment or billing statement. This context-aware feature extraction is crucial for understanding the complex naming patterns found in medical databases.

[0055] The middle layer of the model is composed of six stacked Transformer encoder blocks, each of which contains a multi-head self-attention layer and a feedforward neural network layer, equipped with residual connections and layer normalization. The feedforward neural network adopts a two-layer structure with a hidden layer dimension of 2048 and uses the GELU activation function. This deep structure enables the model to abstract layer by layer, from low-level lexical features to high-level semantic concepts, forming a hierarchical representation. The output layer of the model is designed to be a contextualized token representation and a sequence-level representation. For the token-level representation, the vectors output by the last encoder block are directly used. These vectors contain token semantics that take into account the global context; for the sequence-level representation, the system uses an attention pooling mechanism to perform a weighted average of all token representations, and the weights are calculated through a learnable attention network. This two-level representation method enables the model to capture both local lexical semantics and global naming intent.

[0056] During the pre-training phase, the model is trained jointly using two tasks: a masked language model (MLM) and a name classification task. The MLM task randomly masks 15% of the tokens in the input sequence and requires the model to predict the masked tokens based on the context, which encourages the model to learn bidirectional contextual representations. The name classification task requires the model to predict the functional category of the names (such as patient information, test results, and drug information), which guides the model to acquire medical domain expertise. The pre-training dataset contains over 500,000 real-world medical database names collected from multiple hospitals, covering common hospital information systems (HIS), electronic medical records (EMR), and laboratory information systems (LIS). The model is trained using the Adam optimizer with an initial learning rate of 5e-5, a learning rate schedule with linear warmup and cosine decay, and a batch size of 32. Distributed training is performed on eight NVIDIA V100 GPUs for 50 epochs. To improve training efficiency, mixed-precision training and gradient accumulation techniques are used. During training, training progress is monitored by performance on the validation set, and the best model checkpoint is saved. After pre-training, the model can map any medical database name into a 768-dimensional semantic space. These vector representations not only encode the literal information of the name, but also contain domain knowledge and contextual relationships. This deep semantic understanding capability provides a solid foundation for subsequent naming analysis and classification and grading.

[0057] In a specific embodiment, the method of "analyzing the content in the data asset information" in S500 specifically includes: C100, extracting structured data from the data asset information, encoding and reconstructing the structured data through a variational graph autoencoder, and extracting structural features; C200, extracting text content from the data asset information, inputting the text content into a pre-trained biomedical language understanding model, and extracting semantic features in combination with the medical field ontology knowledge base; C300, extracting special format content including medical imaging paths and gene sequences from the data asset information, and extracting domain features in the special format content through a dedicated feature extractor; C400, setting the noise range and disturbance intensity based on the structural features, semantic features and domain features, performing local differential privacy processing based on the Laplace mechanism, and obtaining privacy-processed feature data; C500, using an adaptive weighted attention mechanism to fuse the privacy-processed feature data to generate a comprehensive feature representation for content analysis.

[0058] Specifically, structured data is extracted from data asset information. This structured data primarily includes numerical fields (such as test results and vital signs), enumerated fields (such as gender and blood type), and time fields (such as date of birth and visit times). This structured data is first sampled and statistically analyzed to calculate basic features such as numerical distribution, value range, and missing rate. A variational graph autoencoder (VGAE) is then used to perform deep feature extraction on this structured data. In the encoding phase, data fields are represented as nodes in a graph, and the statistical correlations between fields are represented as edges. A multi-layer graph convolutional network is used to learn the hidden representations of these nodes. In the reconstruction phase, the original data distribution is reconstructed from the hidden representations. This process enables the model to learn the essential characteristics of the data rather than superficial patterns. For example, when analyzing patient test data, the VGAE can capture the intrinsic correlations between indicators such as blood glucose, cholesterol, and blood pressure, and identify the characteristic patterns of metabolic syndrome that these indicators collectively constitute. In this way, the extracted structural features not only contain the statistical properties of individual fields but also the correlation patterns between fields, providing a multi-dimensional feature representation for subsequent data classification.

[0059] Extracting text from data assets is a key step in unlocking the value of unstructured medical data. Text in medical databases primarily includes medical records, diagnosis descriptions, surgical notes, and medical orders. These texts are first preprocessed, including word segmentation, stop word removal, and entity recognition. The processed text is then fed into pretrained biomedical language understanding models, such as BioBERT or Chinese Medical BERT. These models are pretrained on large-scale medical literature and clinical text and can understand specialized medical terminology and expressions. To further enhance semantic understanding, medical domain ontology knowledge bases, such as the Unified Medical Language System (UMLS) or the Chinese Traditional Medicine Knowledge Graph, are combined to map the identified medical concepts into a standardized semantic network. This combined deep learning and knowledge graph approach effectively processes synonyms, abbreviations, and specialized terminology within medical text, extracting accurate semantic features. For example, when analyzing the "chief complaint" field in an electronic medical record, the symptom entity and time information in "chest tightness and shortness of breath for three days, accompanied by intermittent precordial pain" can be identified and mapped to corresponding medical concepts, thereby understanding the association with cardiovascular disease. Through this deep semantic analysis, rich semantic features can be extracted from text content, providing a basis for identifying sensitive information and classification and grading.

[0060] Extracting specially formatted content from data asset information is a specialized step in processing data types unique to the medical field. Commonly found in medical databases, specially formatted content includes medical imaging paths, gene sequence data, and electrocardiogram (ECG) waveform data. While not directly sensitive information, these specially formatted contents often correlate with or point to highly sensitive patient data. These special content are analyzed using specialized feature extractors. For example, for medical imaging paths, not only are the path strings themselves analyzed, but path parsing also extracts metadata such as examination type, location, and time. For gene sequence data, sequence feature analysis is used to identify segments that may indicate genetic diseases or markers of specific populations. For waveform data, spectral analysis and pattern recognition are used to extract key features. These specialized feature extractors combine domain knowledge with machine learning techniques to extract domain features from specially formatted content, revealing potentially sensitive information. For example, in a case study at a hospital, by analyzing the naming patterns of image paths in the PACS system, image files containing examinations for specific diseases, such as AIDS and mental illness, were successfully identified. This information, which is easily overlooked in conventional analysis, is actually highly sensitive personal privacy data.

[0061] Differential privacy processing based on extracted structural, semantic, and domain features is a key measure for ensuring data analysis security. First, a data sensitivity assessment model is constructed based on the sensitivity of the features and their usage scenarios. The differential privacy parameter ε is calculated. Higher sensitivity and smaller ε values indicate stronger privacy protection. Next, the global sensitivity of each feature is calculated, representing the maximum potential impact of a single record change on the feature value. For structural features, global sensitivity is determined through theoretical analysis and data range; for semantic and domain features, sensitivity is estimated through local sampling and perturbation experiments. Based on the calculated sensitivity and ε values, the system uses a Laplace mechanism to generate a noise sequence and adds the noise layer-by-layer to the original features, dimension by dimension. By adding random noise that follows a Laplace distribution, the Laplace mechanism ensures that even if an attacker possesses all information except for a single record, they cannot accurately infer the feature value of that record. Finally, the system normalizes the noise-processed features to ensure consistent scaling across different dimensions, facilitating subsequent fusion analysis. Furthermore, the differential privacy parameter ε is set based on the data sensitivity level: ε = 0.1-0.5 for the most sensitive data, ε = 0.5-1.0 for moderately sensitive data, and ε = 1.0-2.0 for low-sensitivity data. Laplace noise addition is performed using the following formula: x' = x + Lap(Δf / ε), where Δf is the sensitivity and Lap represents the Laplace distribution. During implementation, experimental verification determined the sensitivity of various types of medical data: patient identification information had a sensitivity of 1.0, disease diagnosis information had a sensitivity of 0.8, and general physiological indicators had a sensitivity of 0.5. Comparing data analysis results before and after noise addition verified that this method can reduce the risk of privacy leakage by 85% while maintaining over 95% data availability.

[0062] The final step in generating a comprehensive feature representation is to fuse privacy-treated feature data using an adaptively weighted attention mechanism. The multimodal nature of medical data means that different types of features contribute differently to data classification, and this contribution may vary across scenarios. The system employs a multi-head attention mechanism to separately calculate attention weights for structural, semantic, and domain features. Attention calculation is based on a query-key-value framework, where the query vector represents the requirements of the current classification task, and the key vector represents the characteristics of each feature. Attention scores are calculated by calculating the similarity between the two. This mechanism enables the system to dynamically adjust the importance of different features based on specific scenarios. For example, when analyzing patient diagnostic information, semantic features may receive a higher weight, while when analyzing test results, structural features may be more important. To further improve the adaptability of the fusion, a meta-learning mechanism is introduced. Using a small number of labeled samples, it quickly adapts to new data environments and automatically adjusts the fusion strategy. Ultimately, through weighted summation or nonlinear transformation, multimodal features are fused into a unified, comprehensive feature representation. This adaptive fusion approach not only improves the comprehensiveness and accuracy of the feature representation but also enhances the model's adaptability to diverse medical data environments.

[0063] In addition, the use of an adaptive weighted attention mechanism to fuse privacy-processed feature data is a key step in generating a comprehensive feature representation. The multimodal nature of medical data determines that different types of features contribute differently to data classification, and this contribution may vary in different scenarios. It is possible to implement a feature fusion framework based on multi-head attention, which can dynamically evaluate the importance of structural features, semantic features, and domain features. In the specific implementation, the system first designs a special feature transformation layer for each type of feature, maps features of different dimensions and scales to a unified representation space, and then constructs a multi-head attention module. Each attention head independently learns the association pattern between different features. In the attention calculation, the scaled dot product attention mechanism is used to calculate the attention weight through the learnable query matrix Q, key matrix K, and value matrix V: Attention(Q,K,V) = softmax(QK^T / )V, where d k is the dimension of the key vector. This mechanism enables the system to automatically adjust the emphasis on different features based on the current analysis task and data characteristics. For example, when analyzing patient diagnosis information, semantic features may receive higher weight, while when analyzing test results, structural features may be more important.

[0064] To further improve the adaptability of fusion, a context-aware gating mechanism is introduced to dynamically adjust the fusion strategy based on the global feature distribution. Specifically, a gating network receives statistical summaries of all features (such as mean, variance, and entropy) as input and outputs importance scores for each feature type. These scores are multiplied by attention weights to form the final fusion weights. The gating network employs a two-layer feedforward neural network structure with a LeakyReLU activation function in the middle layer and a Sigmoid function in the output layer to ensure weights remain in the range [0, 1]. This gating mechanism adjusts the fusion strategy based on the overall characteristics of the data. For example, when the data contains a large amount of unstructured text, the weight of semantic features is automatically increased; when the data is found to be primarily composed of structured numerical values, the weight of structural features is increased. Ultimately, multimodal features are fused into a unified comprehensive feature representation through weighted summation. This representation comprehensively captures the multidimensional characteristics of medical data and provides a solid foundation for subsequent classification and grading.

[0065] Weighted fusion of naming semantics clustering results and comprehensive feature representations from content analysis is a key step in achieving comprehensive data understanding. The classification and grading of medical data requires considering both naming features (reflecting design intent and organizational structure) and content features (reflecting the actual stored information). These two aspects of information can sometimes be inconsistent. For example, a table named "PATIENT_BASIC_INFO" may actually store sensitive disease diagnosis information. The system employs a two-stream fusion architecture to process the results of naming analysis and content analysis separately, then fuses them together using an adaptive weighting mechanism. Specifically, the system first converts the naming semantics clustering results into feature vectors, with each dimension corresponding to a semantic category (e.g., "patient basic information," "test results," "drug information," etc.). The vector value represents the probability or degree of membership of the data object in that category. Similarly, the system maps the comprehensive feature representation from content analysis into the same semantic space, making the two features comparable.

[0066] Adaptive weighting is determined using a multi-level strategy. At the dataset level, the system uses meta-learning to learn the overall importance of naming analysis and content analysis based on historical classification results. Specifically, using a small dataset, gradient descent optimizes the weights of the two analyses to bring the fusion result closest to the standard answer. This process generates dataset-level base weights that reflect the overall trends in the characteristics of medical institution data. At the data object level, weights are dynamically adjusted through confidence assessment. Confidence metrics are calculated for naming analysis and content analysis results: the confidence of naming analysis is based on the clustering silhouette coefficient and intra-class distance; the confidence of content analysis is based on the completeness of feature extraction and the information retention rate after privacy processing. The higher the confidence, the greater the weight of the corresponding analysis in the fusion. This adaptive mechanism enables the system to flexibly respond to different situations. In specific scenarios, the influence of domain knowledge and regulatory requirements is also considered. For example, regulations may have clear classification requirements for certain types of medical data (such as genetic data and mental illness records). In this case, the weight of analysis results that are consistent with the regulations will be increased. In specific implementation, a domain rule library is maintained, which contains the recognition patterns of specific data types and the corresponding weight adjustment strategies. When it is detected that the data meets a specific pattern, the corresponding weight adjustment rules will be triggered to ensure that the classification results meet regulatory requirements.

[0067] The final weighted fusion formula is: F = α·N + (1-α)·C; 0≤ α ≤1; α = β·α base + (1-β)·(w n ·c n ) / (w n ·c n + w c ·c c ) Among them, F is the final fusion feature, N is the naming analysis feature, and C is the content analysis feature. α is the adaptive weight, α base is the basic weight at the dataset level, c n and c c are the confidence levels of naming analysis and content analysis, w n and w c is the weight coefficient adjusted by domain knowledge, βis a balancing parameter (typically set to 0.7). Through this multi-level adaptive weighting mechanism, the system intelligently integrates the results of naming and content analysis to generate more accurate and comprehensive classification and grading analysis results. These results directly reflect the sensitivity and protection requirements of medical data, providing a scientific basis for subsequent privacy protection measures.

[0068] In an implementation case at a certain tertiary hospital, the system conducted a classification and grading analysis of the electronic medical record database, which contains approximately 500 tables and 8,000 fields, covering a variety of medical data such as basic patient information, outpatient records, hospitalization records, tests and examinations, and drug prescriptions. The system first performed naming analysis and content analysis: Naming analysis extracts naming semantic features through the aforementioned Transformer model, clustering all tables and fields into 42 semantic categories; content analysis identifies the sensitivity and type of data content through feature extraction after differential privacy processing. During the fusion stage, the system found that the hospital's database naming was relatively standardized, but there was a deviation between the naming of some historical legacy systems and the actual content. In response to this situation, the fusion weight was dynamically adjusted: for mainstream system data with standardized naming, naming analysis obtained a higher weight ( α ≈0.7); for legacy systems, content analysis received a higher weight ( α ≈0.3). Furthermore, the system identified certain special types of data (such as psychiatric diagnoses and HIV test results) as meeting regulatory protection requirements, automatically increasing the weight of content analysis on these data to ensure they were correctly classified as the highest sensitivity level. Ultimately, the system-generated classification and grading results mapped the tables and fields in the database to the categories and levels defined in the "Technical Specifications for Security Classification and Grading Management of Medical and Health Data," achieving an accuracy rate of 96.8%, significantly higher than the results obtained using naming analysis alone (89.2%) or content analysis (87.5%). This case study fully demonstrates the superiority of the adaptive weight fusion mechanism in processing complex medical data, flexibly addressing inconsistencies between naming and content, and ensuring the accuracy and compliance of classification and grading results.

[0069] The method for obtaining privacy-processed feature data in C400 specifically includes: C410, constructing a data sensitivity assessment model and calculating differential privacy parameters based on the data types, usage scenarios and security levels of structural features, semantic features and domain features; C420, using statistical analysis methods to calculate the global sensitivity of structural features, semantic features and domain features respectively, and determining the local sensitivity through local sampling; C430, generating a Laplace noise sequence using an exponential distribution function based on global sensitivity, local sensitivity and differential privacy parameters; C440, adding the Laplace noise sequence to the structural features, semantic features and domain features layer by layer according to the feature dimension to form noise-processed features; C450, normalizing the noise-processed features to obtain privacy-processed feature data.

[0070] In this embodiment, building a data sensitivity assessment model based on the data type, usage scenario, and security level of structural, semantic, and domain features is the foundation for achieving refined privacy protection. A multidimensional sensitivity assessment framework is first established to comprehensively assess feature sensitivity across three dimensions: data content, usage context, and regulatory requirements. In the data content dimension, the system categorizes features based on the type of information they represent. For example, features containing patient identifiers (such as ID numbers and names) are assigned the highest sensitivity, followed by disease diagnosis and treatment information, and general physiological indicators are less sensitive. In the usage context dimension, data access scope, purpose, and potential risks are considered. For example, scenarios used for direct patient diagnosis and treatment are more sensitive than those used for hospital management and statistics. In the regulatory requirements dimension, features are mapped to corresponding regulatory classifications, referencing standards such as the Technical Specifications for Security Classification and Grading of Medical and Health Data. Based on the combined scores across these three dimensions, the system constructs a nonlinear mapping function to convert the sensitivity score into the differential privacy parameter ε. High-sensitivity features correspond to smaller ε values (such as 0.1-0.5), providing stronger privacy protection; medium-sensitivity features correspond to moderate ε values (such as 0.5-1.0); low-sensitivity features use larger ε values (such as 1.0-2.0), retaining more useful information while ensuring privacy. This adaptive parameter setting strategy ensures a precise match between privacy protection strength and data sensitivity, avoiding the problem of over- or under-protection.

[0071] Calculating the global and local sensitivity of features using statistical analysis methods is a key step in ensuring the effectiveness of differential privacy mechanisms. Global sensitivity, defined as the maximum impact a single record change can have on query results, is the theoretical basis for adding noise to differential privacy. For structural features, global sensitivity is determined through theoretical analysis and data range. For example, for numerical features normalized to the interval [0, 1], global sensitivity is 1. For count features, global sensitivity is typically 1 or a specific constant. For semantic features, the maximum possible change in word vector space is analyzed, typically based on cosine distance or Euclidean distance. For domain features, the system determines sensitivity based on the characteristics of the feature extraction algorithm and the data distribution. However, global sensitivity is often overly conservative and can lead to excessive noise. To address this issue, local sampling techniques are used to estimate more accurate local sensitivity. Specifically, multiple subsets are randomly selected from the dataset, and the actual impact of removing or modifying a single record on the feature value is calculated. Statistical analysis is then used to determine the local sensitivity with high probability. For example, in an implementation case in a certain hospital, the theoretical global sensitivity of the patient age feature is the maximum age difference. However, through local sampling analysis, it was found that in 95% of cases, the impact of a single record change on the age distribution does not exceed 5. Therefore, 5 is used as the local sensitivity, which significantly reduces the required amount of noise and improves data availability.

[0072] The core mechanism for achieving differential privacy protection is to use an exponential distribution function to generate a Laplace noise sequence based on global sensitivity, local sensitivity, and the differential privacy parameter ε. The Laplace mechanism is a classic implementation of differential privacy. It protects the original data by adding random noise that follows a Laplace distribution. The appropriate sensitivity value is first selected based on the nature and sensitivity type of the feature. For most features, local sensitivity is used to improve data availability. However, for high-risk features or small sample scenarios, global sensitivity is used to ensure strict privacy protection. The system then uses an exponential distribution function to generate Laplace noise. The probability density function of the noise is f(x) = (1 / 2b)·exp(-|x| / b), where the scale parameter b = Δf / ε, Δf is the selected sensitivity value, and ε is the differential privacy parameter calculated previously. To ensure the randomness and unpredictability of the noise, a cryptographically secure random number generator is used, and the uniform distribution is converted into a Laplace distribution through the inverse transform sampling method. For multidimensional features, noise is generated independently for each dimension to form a noise sequence. This differential privacy based on the Laplace mechanism provides provable privacy protection. Even if an attacker has all information except a certain record, they cannot accurately infer the information of the record from the analysis results, thereby effectively protecting the patient's privacy.

[0073] Differential privacy is achieved by adding Laplace noise sequences layer by layer to structural, semantic, and domain features according to their dimension. A layered noise addition strategy is employed, adjusting the noise addition method based on the characteristics and importance of different feature types. For structural features, the system directly adds noise to the original feature values. For example, for numerical features such as blood pressure and blood sugar, the corresponding Laplace noise is directly added. For categorical features, differential privacy is achieved through an exponential mechanism, where the output category is probabilistically selected based on the category's utility score and the added noise. For semantic features, noise is added to the word vector space, preserving relative semantic relationships while blurring specific expressions. For example, adding a moderate amount of noise to the semantic vector of a disease description still reflects the general disease category, but the specific disease name may be blurred. For domain features, a hybrid strategy is adopted based on the structural and semantic importance of the feature, adding less noise to key dimensions and more noise to secondary dimensions. During the noise addition process, boundary processing is also implemented to ensure that the feature values after noise addition are still within the valid range. For example, the age feature should not be negative after noise is added. Through this refined noise addition strategy, the useful information of the data is retained to the maximum extent while ensuring privacy, achieving a balance between privacy protection and data availability.

[0074] Normalizing the noise-processed features is essential to ensure feature comparability and model stability. The addition of noise may alter the scale and distribution of different features. Directly using these features can lead to certain dimensions receiving undue weight in subsequent analysis. Therefore, various normalization techniques are employed to process different types of features. For numerical structural features, Min-Max normalization or Z-score normalization are primarily used to map feature values to a uniform range or standard distribution. For high-dimensional semantic and domain features, L2 normalization is employed to preserve directional information while eliminating amplitude variations. Furthermore, outlier handling is implemented, truncating or remapping noise-processed results that fall outside a reasonable range to ensure that normalized features are not affected by extreme values. During the normalization process, transformation parameters (such as maximum and minimum values, mean and standard deviation) are saved for subsequent application to new data. This comprehensive normalization process yields privacy-processed feature data with consistent scale and reasonable distribution, providing high-quality input for subsequent feature fusion and model analysis. In this embodiment, normalizing the noise-processed features is a key step in ensuring feature comparability and model stability. The addition of Laplace noise can significantly alter the scale and distribution of different features. Directly using these features can cause certain dimensions to receive unreasonable weight in subsequent analysis, impacting classification accuracy. Furthermore, robust normalization is implemented, using Winsorization techniques or the IQR method to mitigate the impact of extreme noise values. During normalization, transformation parameters (such as maximum and minimum values, mean and standard deviation) are saved for subsequent application to new data, ensuring consistent processing.

[0075] Evaluating the privacy protection strength of privacy-treated feature data by calculating mutual information and differential entropy is a scientific method for quantifying the level of privacy protection. Mutual information measures the degree of interdependence between two random variables. In privacy protection assessment, the mutual information I(X;X') between the original feature X and the privacy-treated feature X' is calculated. Lower mutual information indicates more effective privacy protection and less information leakage from the original data. The calculation uses a k-nearest-neighbor mutual information estimation algorithm, which is suitable for high-dimensional continuous data and accurately captures nonlinear dependencies. In the implementation, the original and processed features are first normalized, then the k-nearest-neighbor distances are calculated in the joint space, and finally, the mutual information value is estimated based on these distances. Differential entropy measures the uncertainty of a continuous random variable. The change in differential entropy between the features before and after privacy treatment is calculated as ΔH = H(X') - H(X). An increase in differential entropy indicates increased uncertainty, indicating enhanced privacy protection. Differential entropy is calculated using a kernel density estimation method, which first estimates the probability density function of the feature and then calculates its negative expected logarithm. For multidimensional features, multivariate kernel density estimation is used, and adaptive bandwidth selection is used to improve estimation accuracy.

[0076] The calculated mutual information and differential entropy are compared with preset security thresholds to generate a comprehensive privacy protection assessment report. These security thresholds are set based on the medical data security level and regulatory requirements. During the comparison process, not only is the overall privacy protection level of the features assessed, but the protection strength of each feature dimension is also analyzed to identify potential weaknesses. The assessment report includes several key components: an overall privacy protection score, based on a weighted calculation of mutual information and differential entropy; a feature dimension analysis, which displays the protection strength and potential risks of each dimension; attack simulation results, which evaluate defense capabilities by simulating common privacy attacks (such as attribute inference and membership inference); a compliance analysis, which assesses whether protection measures meet relevant regulatory requirements; and optimization suggestions, which propose improvement measures for weak links. For example, the report may indicate that certain dimensions of patient diagnostic information are insufficiently protected and recommend increasing noise intensity or adopting stricter access controls.

[0077] The privacy protection assessment report is generated using layered visualization technology, making the results accessible to users from all technical backgrounds. The top layer is an executive summary, using a red, yellow, and green color indicator system to visually display the overall protection status. The middle layer provides a detailed analysis, showcasing the protection strength and threshold comparison results for each dimension through interactive charts. The bottom layer contains technical details, providing the complete calculation process and raw data for in-depth analysis by professionals. The system also implements historical tracking of assessment results, recording trends in privacy protection strength and helping medical institutions continuously improve their data protection measures. Assessment reports are sent to authorized personnel via a secure channel, and an encrypted copy is stored in the system as proof of compliance.

[0078] The privacy protection assessment report and the privacy-processed feature data are used together for subsequent processing to form a closed-loop privacy protection mechanism. During the model training and data analysis phases, the system adjusts the processing strategy based on the risk level in the assessment report: for fully protected features, they can be directly used to train the classification model; for features at the protection boundary, additional access control and usage restrictions are implemented; for features that are insufficiently protected, reprocessing or the use of stricter differential privacy parameters may be triggered. In addition, the assessment report also guides the adaptive optimization of the system: by analyzing the impact of different privacy processing parameters on protection strength and data utility, the parameter configuration is gradually adjusted to maximize data availability while meeting privacy protection requirements. This adaptive optimization mechanism based on assessment feedback enables the system to maintain a balance between privacy protection and data utility in a dynamic environment, providing reliable protection for the secure analysis of medical data.

[0079] In actual deployment, a privacy budget management mechanism was implemented to track the privacy budget consumed by each data access and ensure that cumulative queries do not exceed the preset privacy protection limit. When the budget approaches the threshold, the noise intensity is automatically increased or the query complexity is limited to prevent the reconstruction of the original data through multiple queries. At the same time, a privacy attack detection module is integrated to monitor data access patterns and identify possible privacy attack attempts, such as related query attacks or differential attacks. Once suspicious activity is detected, an alarm is triggered and access to the relevant data is suspended until the security audit is completed. This multi-layered protection mechanism ensures that privacy-processed feature data is strictly protected throughout its lifecycle, while still providing valuable information support for medical data classification and grading and privacy protection decision-making.

[0080] For S600, the method for establishing a mapping relationship between two graphs includes: S610, extracting semantic feature data from the classification and grading analysis results; S620, based on the semantic feature data, using a graph attention network to build a heterogeneous graph neural network model that supports heterogeneous nodes, and the heterogeneous graph neural network model contains feature extractors corresponding to different types of nodes; S630, inputting the regulatory graph and the improved asset graph into the heterogeneous graph neural network model, using the corresponding feature extractor to extract the feature information of each node, and obtaining the feature vector corresponding to each feature information; S640, based on the semantic association between the feature vector and the node, designing a meta-path template to obtain a meta-path set for node sampling, and the meta-path set includes: a library-table-column path for representing the data structure, a category-content path for representing the classification system, and a meta-path template for designing a meta-path template based on the semantic association between the feature vector and the node. path and column-category path for establishing mapping; S650, using the meta-path set to sample the nodes in the regulatory map and the improved asset map to obtain multiple groups of node sequences; S660, using the scaled dot product attention mechanism to calculate the attention scores between the node pairs in the multiple groups of node sequences, and visualize the attention scores according to the positions and relationships of the nodes to generate multiple attention distribution maps; S670, according to the importance of each meta-path, assign different weights to the corresponding attention distribution maps, and perform weighted fusion of the multiple attention distribution maps according to the weights to generate a comprehensive attention weight that reflects the node association strength; S680, according to the comprehensive attention weights, calculate the association strength between the nodes in the regulatory map and the improved asset map, determine the node pairs that meet the preset association threshold, and establish a mapping relationship between the two maps.

[0081] Specifically, the classification and grading analysis results generated in the previous stage are first deeply analyzed to extract the semantic information contained therein. These semantic feature data include semantic clustering results obtained from naming analysis, topic distribution obtained from content analysis, sensitivity assessment results, and business association analysis results. Multimodal feature fusion technology is used to uniformly represent semantic information from these different sources as high-dimensional feature vectors. During the feature extraction process, special attention is paid to semantic features that can reflect data categories and security levels, such as disease type, identity identification, and sensitivity. At the same time, contextual features reflecting data structure and business associations are also extracted. These features help understand the position and role of data in the overall architecture. For example, in an implementation case at a tertiary hospital, the system extracted semantic features such as "personal identification information," "high sensitivity," and "directly related to patient privacy" from the analysis results of the patient information table. These features directly indicate that the table should be classified as "personal sensitive information" and the security level should be "highest." In this way, the results of the classification and grading analysis are converted into structured semantic feature data, providing a rich semantic foundation for subsequent graph mapping.

[0082] Based on the extracted semantic feature data, a graph attention network (GAT) is used to construct a heterogeneous graph neural network model that supports heterogeneous nodes. Unlike traditional graph neural networks, heterogeneous graph neural networks can handle complex graph structures of different types of nodes and edges, and are particularly suitable for multi-heterogeneous scenarios such as medical data. Special feature extractors are designed for different types of nodes in the graph: for level nodes in the regulatory graph, a hierarchical feature extractor is used to capture the progressive relationship of security levels; for category nodes, a semantic similarity-based feature extractor is used to understand the association and distinction between categories; for content nodes, a text understanding-based feature extractor is used to extract key information in the detailed description. Similarly, corresponding feature extractors are designed for the library nodes, table nodes, and column nodes in the asset graph, focusing on the characteristics of data at different levels. These feature extractors together constitute the basic architecture of the heterogeneous graph neural network. Each extractor has been optimized to effectively capture the characteristics of the corresponding type of node. For example, the feature extractor of the column node pays special attention to features such as data type, value range, and naming pattern, while the feature extractor of the category node pays more attention to semantic definition, inclusion relationship, and regulatory basis. This heterogeneous design enables the model to process nodes of different natures at the same time, laying a technical foundation for subsequent graph mapping.

[0083] Inputting the regulatory graph and the refined asset graph into a heterogeneous graph neural network model is a key step in achieving feature vectorization. First, the two graphs are preprocessed, including node encoding, edge type definition, and initial feature construction. Then, the processed graph data is input into the heterogeneous graph neural network model, where contextual representations of the nodes are learned through multi-layer graph convolution operations. During this process, each type of node is processed by a corresponding feature extractor. For example, the category nodes in the regulatory graph are processed by a category feature extractor to extract semantic features, while the table nodes in the asset graph are processed by a table feature extractor to extract structural and content features. Graph convolution operations enable each node to aggregate information from its neighboring nodes, thereby learning a representation that incorporates the local graph structure. To capture a wider range of contextual information, a multi-hop message passing mechanism is adopted, allowing information to propagate over a wider range. After multi-layer graph convolution, each node is mapped to a high-dimensional feature vector. These vectors not only contain the node's own features, but also incorporate its structural information and semantic associations within the graph. For example, the feature vector of a patient information table not only reflects the name and structural characteristics of the table, but also includes its relationship with other tables and its location information in the business process. This feature vector that integrates multiple aspects of information provides a comprehensive semantic basis for the subsequent establishment of mapping relationships.

[0084] Designing meta-path templates based on feature vectors and semantic associations between nodes is an effective method to capture complex relationships in heterogeneous graphs. Based on the characteristics of medical data and the requirements of classification and grading, three core meta-paths are designed: the library-table-column path used to represent the data structure, which reflects the hierarchical organizational structure of data assets; the category-content path used to represent the classification system, which describes the classification framework defined by regulations; and the column-category path used to establish mappings, which directly connects data assets and regulatory classifications. In addition to these three core paths, it also includes a variety of auxiliary meta-paths, such as the table-business-category path, the column-value-concept-category path, etc. These meta-paths together constitute a comprehensive path set that can capture semantic associations between nodes from different angles. Through this meta-path-based design, complex semantic relationships in heterogeneous graphs can be flexibly defined and captured, providing structured path guidance for subsequent node sampling and association analysis.

[0085] Using the meta-path set to sample nodes in the regulatory map and the improved asset map is an important step in constructing training data. The meta-path-guided random walk algorithm is used to sample nodes in the map along the predefined meta-path. Specifically, for each meta-path, starting from the starting node, a random walk is performed according to the node type sequence defined by the path to generate a series of node sequences. For example, along the "library-table-column" path, a node sequence such as "HIS library-patient information table-patient name column" may be generated; along the "category-content" path, a node sequence such as "personal identification information category-name content" may be generated. In order to enhance the sampling generation In order to ensure the representativeness and diversity of the graph, a multi-strategy sampling method is adopted: for core nodes with high frequency of access, the probability of them being the starting point is increased; for low frequency but potentially important nodes, importance sampling technology is used to improve their chances of being selected; for new or changed nodes, they are preferentially included in the sampling range to adapt to data changes; through this diversified sampling strategy, multiple groups of node sequences covering different paths and different node types are finally obtained. These node sequences not only contain the structural information within a single graph, but also capture the potential mapping relationship between the two graphs through cross-graph meta-paths (such as "column-category" paths), providing rich training data for subsequent attention calculations.

[0086] Using the scaled dot-product attention mechanism to calculate attention scores between pairs of nodes in multiple node sequences is a core technique for quantifying the strength of node associations and effectively captures the dependencies between sequence elements. The sampled node sequence is input into the attention calculation module, where each node is represented as a feature vector obtained in the previous step. For each pair of nodes i and j in the sequence, the attention score is calculated: first, the feature vector of node i is used as the query vector, and the feature vector of node j is used as the key vector, and the dot product between them is calculated. The dot product result is then scaled by dividing it by the square root of the feature dimension to avoid the vanishing gradient problem caused by large-dimensional vectors. Finally, the result is normalized into a probability distribution using the softmax function. This calculation method results in higher attention scores for semantically similar and functionally related node pairs. Furthermore, the attention scores can be visualized according to the position and relationship of the nodes, generating attention distribution maps in the form of heat maps. These distribution maps clearly demonstrate the strength of attention between different nodes.

[0087] Assigning different weights to the corresponding attention distribution maps based on the importance of each meta-path and performing weighted fusion is a key step in generating comprehensive evaluation results. Different meta-paths capture different aspects of node relationships, and their importance may vary in specific application scenarios. Various methods are used to determine the importance weights of meta-paths. These methods can be based on prior weights based on expert knowledge, reflecting the judgment of domain experts on the importance of different relationships; statistical learning based on historical data, analyzing existing mapping cases, and calculating the prediction accuracy of different paths; and adaptive weight adjustment based on reinforcement learning, which continuously optimizes path weights based on feedback from mapping results. After determining the weights, multiple attention distribution maps are weightedly fused. For any node pair (i, j), its combined attention weight is equal to the weighted average of the attention scores under each meta-path. This fusion method comprehensively considers node associations from different perspectives, generating a more comprehensive and accurate assessment of association strength. For example, when evaluating the mapping of patient diagnostic information to regulatory categories, a higher weight can be assigned to the "column-value-concept-category" path, a medium weight to the "table-business-category" path, and lower weights to other paths. This allows for greater emphasis on semantic matching during fusion. Through this weighted fusion mechanism, the resulting composite attention weights more accurately reflect the actual strength of associations between nodes, providing a reliable quantitative basis for establishing the final mapping relationship.

[0088] The final step in establishing a mapping relationship between the two graphs is to calculate the association strength between nodes in the regulatory graph and the asset graph based on the comprehensive attention weights and identify node pairs that meet a preset association threshold. This involves traversing all possible node pairs in the two graphs and calculating the comprehensive association strength between them. This calculation takes into account both direct attention weights and indirect path influences. Once the association strengths are calculated, they are filtered according to a preset association threshold, retaining only those node pairs whose association strengths exceed the threshold. These node pairs constitute the initial candidate mapping set. To further improve the accuracy and reliability of the mapping, historical data with manually annotated mapping relationships was selected from a medical database as a training set. This historical data covers different types of medical data assets, such as electronic medical records, laboratory systems, and medical imaging systems. Based on this training data, three basic mapping models were trained: a rule-based mapping model, a semantic-based mapping model, and a structure-based mapping model. Each model has its own advantages and is suitable for different mapping scenarios. To combine the advantages of these models, a Bayesian model averaging framework was constructed that adaptively adjusts their weights based on their uncertainty. In the BMA framework, the prediction result of each basic model is regarded as a hypothesis. The posterior probability is calculated based on the prior probability of the model and the likelihood of the observed data. The final prediction result is the weighted average of the predictions of each model, and the weight is the posterior probability of the corresponding model. This probability-based integration method not only improves the prediction accuracy, but also provides an estimate of the uncertainty of the prediction, which helps to identify boundary conditions that require manual confirmation. The initial candidate mapping set and the comprehensive attention weight are input into the BMA framework to obtain the mapping evaluation results of each candidate node pair, including mapping probability and uncertainty estimation. Based on these evaluation results, the system finally determines the mapping relationship between the two graphs, forming a complete mapping network from the asset graph to the regulatory graph. This mapping method based on graph neural network and Bayesian model averaging provides a solid technical foundation for the privacy protection of medical data.

[0089] In a specific embodiment, for S680: calculating the association strength between nodes in the regulatory graph and the improved asset graph based on the comprehensive attention weight, determining node pairs that meet a preset association threshold, and establishing a mapping relationship between the two graphs, the specific establishment method includes: S681: Traverse all node pairs in the regulatory graph and the refined asset graph. Based on the comprehensive attention weight and a preset correlation threshold, select node pairs with correlation strength greater than the preset correlation threshold. These node pairs constitute the initial candidate mapping set. Assume that the regulatory graph contains nodes such as "Medical Data Security Regulation Clause A" and "Medical Data Usage Specification Clause B," and the refined asset graph contains nodes such as "Patient Medical Record Data Assets" and "Medical Imaging Data Assets." Traverse all node pairs in the regulatory graph and asset graph, for example, pairing "Medical Data Security Regulation Clause A" with nodes such as "Patient Medical Record Data Assets" and "Medical Imaging Data Assets." The comprehensive attention weight is calculated using an algorithm in the previous step and represents the importance of the correlation between different nodes. The preset correlation threshold is a fixed value set based on business needs and experience, for example, 0.6. For each node pair, its association strength is calculated based on the comprehensive attention weight. If the association strength is greater than 0.6, the node pair is included in the initial candidate mapping set. This step greatly narrows the scope of subsequent processing by screening out node pairs with higher association strength, reduces unnecessary calculations and analysis, and improves the efficiency of subsequent model processing. It only focuses on those node pairs that may have strong associations, avoiding invalid processing of a large number of weakly associated node pairs.

[0090] S682: Historical data with manually annotated mapping relationships is selected from the medical database to obtain a mapping model training set. This historical data covers different types of medical data assets. Specifically, historical data with manually annotated mapping relationships is searched from the medical database. This historical data contains different types of medical data assets, such as outpatient data assets, inpatient data assets, and laboratory and examination data assets. The manually annotated mapping relationships may include "a certain regulatory provision applies to a certain type of medical data asset." Collecting this historical data forms the mapping model training set. Using historical data for model training allows the model to learn existing mapping relationship patterns in actual business operations.

[0091] S683: Using the mapping model training set, a rule-based mapping model, a semantics-based mapping model, and a structure-based mapping model are trained to obtain multiple basic mapping models. The rule-based mapping model is trained based on specific business rules. For example, a rule states that "medical data assets involving patient personal identity information must comply with specific privacy protection regulations." Using the training set data, the model learns these rules. When encountering similar node pairs, it can determine whether a mapping relationship exists based on the rules. The semantics-based mapping model utilizes natural language processing technology to analyze the semantics of regulatory terms and medical data asset names. The structure-based mapping model considers the structural information of the graph, such as the hierarchical relationships and connections between nodes. If a clause in the regulatory graph is related to multiple sub-clauses, and a data asset in the asset graph has a similar hierarchical structure, the model can determine the mapping relationship based on the similarity of these structures. Different types of basic mapping models learn and determine mapping relationships from different perspectives. Rule-based models ensure that mapping relationships comply with clear business rules; semantics-based models handle semantic associations; and structure-based models leverage the structural information of the graph. The combination of multiple models can more comprehensively and accurately determine the mapping relationship between node pairs.

[0092] S684: Based on multiple base mapping models, a Bayesian model averaging framework is constructed. The Bayesian model averaging framework is used to integrate the prediction results of each base mapping model. Specifically, the Bayesian model averaging framework is constructed based on Bayesian theory. Taking the prediction results of the previously trained rule-based mapping model, semantic-based mapping model, and structure-based mapping model as input, the Bayesian model averaging framework performs a weighted average of these prediction results based on factors such as the accuracy and reliability of each base model, thereby obtaining a more comprehensive and reliable prediction result.

[0093] S685: Input the initial candidate mapping set and the comprehensive attention weights into the Bayesian model averaging framework to obtain candidate node pair mapping evaluation results. Specifically, the node pairs in the initial candidate mapping set and the comprehensive attention weights are input into the Bayesian model averaging framework. The Bayesian model averaging framework evaluates each candidate node pair according to the previously established rules and methods. Evaluating the initial candidate mapping set using the Bayesian model averaging framework can produce more scientific and accurate mapping evaluation results. The addition of comprehensive attention weights makes the evaluation results more reasonable and takes into account the importance of the associations between different nodes.

[0094] S686: Based on the candidate node pair mapping evaluation results, a mapping relationship is established between the two graphs. Specifically, an evaluation threshold is set based on the candidate node pair mapping evaluation results. For example, if the evaluation result is greater than 0.8, a mapping relationship is considered to exist. For node pairs with an evaluation result greater than 0.8, the mapping relationship is formally established. Ultimately, a mapping relationship is established between the regulatory graph and the asset graph, enabling regulations to correspond to specific medical data assets.

[0095] By establishing an accurate mapping relationship between the regulatory map and the asset map, medical companies can clearly understand which regulatory provisions each medical data asset must comply with, thereby ensuring that data use and management comply with relevant regulatory requirements, avoiding legal risks caused by violations, and quickly locating the regulations corresponding to different data assets. In the collection, storage, use, and sharing of data, standardized operations are carried out in accordance with regulations, thereby improving the efficiency and quality of data management. The use of multiple basic mapping models and their integration through the Bayesian model averaging framework fully leverages the advantages of different models, improves the accuracy and reliability of mapping relationship judgments, and reduces the limitations of a single model. Using historical data covering different types of medical data assets for training enables the model and overall solution to adapt to various complex medical data scenarios and possess strong generalization capabilities.

Claims

1. A medical data privacy protection method, characterized in that: include: Obtain regulatory information for the medical industry and data asset information for target medical institutions; Establishing a logical relationship diagram including data classification and security level according to the regulatory information, and importing the regulatory information into a first graph database based on the logical relationship diagram to obtain a regulatory map; Extracting logical relationship information from the data asset information, constructing a data logical relationship graph including a library table column structure based on the logical relationship information, and importing the data asset information into a second graph database based on the data logical relationship graph to obtain an asset graph; Collecting business process information of the target medical institution, identifying the data flow relationship between business nodes based on the business process information, and improving the asset map; Analyze the names in the data asset information and analyze the content in the data asset information to obtain classification and grading analysis results; Based on the classification and grading analysis results, a heterogeneous graph neural network model is constructed using a graph attention network. Based on the heterogeneous graph neural network model, the nodes in the regulatory map and the improved asset map are mapped into feature vectors. The association relationship is determined by calculating the attention weights between the nodes, and a mapping relationship between the two maps is established. Updating the improved asset map according to the mapping relationship; Based on the updated asset map, the privacy of the data asset information of the target medical institution is protected.

2. The medical data privacy protection method according to claim 1, characterized in that: The importing of the regulatory information into the first graph database based on the logical relationship graph includes: Extracting classified and graded regulatory information from the logical relationship diagram, and converting the classified and graded regulatory information into structured data including category nodes and level nodes according to a preset data structure template; Obtaining actual content information of each subcategory in the classification and grading regulatory information, the actual content information including data description, security level, and protection requirements; Call the latest legal and regulatory information database to obtain standardized classification and grading specifications; Performing a field-level consistency comparison between the actual content information and the standardized classification and grading specifications to obtain a consistency comparison result; When the consistency comparison result is consistent, the actual content information is used as the target content of the corresponding subcategory; when the consistency comparison result is inconsistent, the corresponding content in the standardized classification and grading specification is used as the target content; The target content is imported into the first graph database to generate the regulatory graph including level nodes, category nodes and content nodes.

3. The medical data privacy protection method according to claim 1, characterized in that: The step of constructing a data logical relationship diagram including a library table column structure according to the logical relationship information includes: Extracting a database identifier, a data table identifier, and a data field identifier from the data asset information; Construct a three-layer data normalization processing interface; the three-layer data normalization processing interface includes a library-level interface for standardizing database information, a table-level interface for standardizing data table information, and a column-level interface for standardizing data field information; Inputting the database identifier and its corresponding description information into the library-level interface to obtain standardized library-level information; Inputting the data table identifier and its corresponding description information into the table-level interface to obtain standardized table-level information; Inputting the data field identifier and its corresponding description information into the column-level interface to obtain standardized column-level information; The data logical relationship diagram is constructed according to the hierarchical relationship among the standardized library-level information, the standardized table-level information and the standardized column-level information.

4. The medical data privacy protection method according to claim 1, characterized in that: The collecting of the business process information of the target medical institution and identifying the data flow relationship between business nodes according to the business process information include: Configure data collection rules including data source type, collection cycle and filtering rules; Collecting log information, application programming interface call information, and database access records of the target medical institution based on the data collection rules to obtain business process information; Building an event chain based on the timestamp and operation identifier, correcting abnormal or missing data in the business process information, and obtaining a trimmed business event sequence arranged in chronological order; Constructing a Bayesian network model, and calculating conditional probabilities between adjacent business operations based on the Bayesian network model using the operation types, data objects, and access modes in the business event sequence as nodes; Inputting the conditional probability into a Markov decision process model to calculate the transition probability and data dependency between service nodes; wherein the state space in the Markov decision process model is composed of service nodes and data operations; Based on the transition probability and the data dependency, a data flow relationship diagram is constructed, and data flow relationships that meet the requirements are screened using a confidence threshold.

5. The medical data privacy protection method according to claim 1, characterized in that: The analyzing the naming in the data asset information includes: Build a medical vocabulary based on the medical industry standard terminology and naming guidelines; Constructing a naming semantics capture model based on the Transformer architecture, and pre-training the naming semantics capture model according to the medical field vocabulary; Input the library name, table name, and field name in the data asset information into the pre-trained naming semantics capture model to extract contextual semantic features of naming at each level; constructing positive sample pairs and negative sample pairs according to the contextual semantic features, and training the naming semantic capture model based on the positive sample pairs and the negative sample pairs using a contrastive learning strategy; Using the trained naming semantic capture model, similarity calculation is performed on the context semantic features to generate a feature similarity matrix; Based on the similarity matrix, namespace clustering analysis is performed, silhouette coefficients and inter-cluster distances are calculated, and clustering results of naming semantics are obtained.

6. The medical data privacy protection method according to claim 5, characterized in that: The analyzing the content of the data asset information includes: Extracting structured data from the data asset information, encoding and reconstructing the structured data through a variational graph autoencoder to extract structural features; Extracting text content from the data asset information, inputting the text content into a pre-trained biomedical language understanding model, and extracting semantic features in combination with a medical field ontology knowledge base; Extracting special format content including medical imaging paths and gene sequences from the data asset information, and extracting domain features from the special format content using a dedicated feature extractor; According to the structural features, the semantic features, and the domain features, a noise range and a disturbance intensity are set, and local differential privacy processing based on the Laplace mechanism is performed to obtain feature data after privacy processing; An adaptive weighted attention mechanism is used to fuse the privacy-processed feature data to generate a comprehensive feature representation for content analysis.

7. The medical data privacy protection method according to claim 6, characterized in that: The step of setting the noise range and disturbance intensity based on the structural features, the semantic features, and the domain features, performing local differential privacy processing based on the Laplace mechanism, and obtaining privacy-processed feature data includes: Constructing a data sensitivity assessment model and calculating differential privacy parameters based on the data types, usage scenarios, and security levels of the structural features, the semantic features, and the domain features; Calculating the global sensitivity of the structural feature, the semantic feature, and the domain feature respectively by using a statistical analysis method, and determining the local sensitivity by local sampling; generating a Laplace noise sequence using an exponential distribution function based on the global sensitivity, the local sensitivity, and the differential privacy parameter; Adding the Laplacian noise sequence to the structural features, the semantic features, and the domain features layer by layer according to feature dimensions to form noise-processed features; Normalizing the noise-processed features to obtain privacy-processed feature data.

8. The medical data privacy protection method according to claim 1, characterized in that: Based on the classification and grading analysis results, a heterogeneous graph neural network model is constructed using a graph attention network. Based on the heterogeneous graph neural network model, the nodes in the regulatory map and the improved asset map are mapped into feature vectors, and the association relationship is determined by calculating the attention weights between the nodes, thereby establishing a mapping relationship between the two maps, including: Extracting semantic feature data from the classification and grading analysis results; Based on the semantic feature data, a graph attention network is used to construct a heterogeneous graph neural network model that supports heterogeneous nodes, wherein the heterogeneous graph neural network model includes feature extractors corresponding to different types of nodes; Inputting the regulatory map and the improved asset map into the heterogeneous graph neural network model, using the corresponding feature extractor to extract feature information of each node, and obtaining feature vectors corresponding to each feature information; Based on the semantic association between the feature vector and the nodes, a meta-path template is designed to obtain a meta-path set for node sampling, wherein the meta-path set includes: a library-table-column path for representing a data structure, a category-content path for representing a classification system, and a column-category path for establishing a mapping; Using the meta-path set, sampling nodes in the regulatory graph and the improved asset graph to obtain multiple groups of node sequences; Calculating attention scores between pairs of nodes in the multiple sets of node sequences using a scaled dot product attention mechanism, visualizing the attention scores according to positions and relationships of the nodes, and generating multiple attention distribution maps; According to the importance of each meta-path, different weights are assigned to the corresponding attention distribution maps, and multiple attention distribution maps are weightedly fused according to the weights to generate a comprehensive attention weight that reflects the node association strength; The association strength between the nodes in the regulatory map and the improved asset map is calculated based on the comprehensive attention weight, the node pairs that meet the preset association threshold are determined, and a mapping relationship between the two maps is established.

9. The medical data privacy protection method according to claim 8, characterized in that: The step of calculating the association strength between nodes in the regulatory graph and the improved asset graph based on the comprehensive attention weight, determining node pairs that meet a preset association threshold, and establishing a mapping relationship between the two graphs includes: Traversing all node pairs in the regulatory graph and the improved asset graph, and screening out node pairs with a correlation strength greater than the preset correlation threshold based on the comprehensive attention weight and the preset correlation threshold, these node pairs constitute the initial candidate mapping set; Selecting historical data with manually annotated mapping relationships from a medical database to obtain a mapping model training set, wherein the historical data covers different types of medical data assets; Using the mapping model training set, respectively training a rule-based mapping model, a semantics-based mapping model, and a structure-based mapping model to obtain a plurality of basic mapping models; Based on the multiple basic mapping models, a Bayesian model averaging framework is constructed; the Bayesian model averaging framework is used to integrate the prediction results of each basic mapping model; Inputting the initial candidate mapping set and the comprehensive attention weight into the Bayesian model averaging framework to obtain candidate node pair mapping evaluation results; A mapping relationship between the two graphs is established based on the candidate node pair mapping evaluation results.

10. A computer device, characterized in that: The computer device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the medical data privacy protection method described in any one of claims 1-9.

Images