Medical resource utilization behavior evaluation method and device, computer equipment and storage medium

Abstract

The invention provides a medical resource utilization behavior assessment method and device, computer equipment and a storage medium. The method comprises the steps of obtaining a to-be-assessed behavior sequence; dividing the behavior sequence into a plurality of windows with the same time length, and converting each behavior point in each window into a corresponding behavior label; generating a sample sequence corresponding to the behavior sequence based on a plurality of windows of the behavior sequence and a plurality of behavior tags in each window; calculating an abnormal score of the behavior sequence based on the sample sequence; capturing a plurality of forward dependencies and a plurality of backward dependencies of the behavior sequence; splicing the plurality of forward dependencies and the plurality of backward dependencies to generate a feature vector; reconstructing the feature vector to obtain a reconstructed behavior sequence; calculating a reconstruction error value between the reconstruction behavior sequence and the behavior sequence; and judging whether the behavior sequence is credible or not based on the abnormal score and the reconstruction error value of the behavior sequence to be evaluated. According to the invention, whether the medical resource utilization behavior is credible can be accurately evaluated.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and specifically to a method, apparatus, computer equipment, and storage medium for evaluating medical resource utilization behavior. Background Art

[0002] While providing convenient medical services, the Internet of Medical Services (IMS) currently faces resource abuse issues such as false appointments, malicious visits, information collection, and falsified medical data. These issues pose a serious threat to the stability of IMS services and the security of service resources. Therefore, accurately identifying resource abuse is crucial.

[0003] Existing behavior analysis methods have the following shortcomings: (1) They are mostly based on single-point user behavior analysis and explicit behavior associations, ignoring the contextual implicit associations and spatiotemporal dynamic distribution characteristics in the behavior sequence. For example, a normal user may check health information in the morning, make a medical appointment at noon, and record health data in the evening. However, an abuser who collects information may frequently visit multiple different health information pages in a short period of time, and this pattern is significantly different from the behavior pattern of normal users; (2) General platform user behavior analysis methods cannot fully combine the diverse characteristics of medical network services and roles. For example, due to the complexity of medical network services, it involves multiple platform user types such as patients, doctors, health consultants, nurses, inspectors, administrators, and third-party research institutions. The business access patterns and operation types of different user types vary greatly. Summary of the Invention

[0004] In view of this, the present application proposes a medical resource utilization behavior evaluation method, apparatus, computer equipment and storage medium for accurately evaluating whether the behavior of various types of users in the medical network is credible.

[0005] The first embodiment of the present application proposes a method for evaluating medical resource utilization behavior, the method comprising:

[0006] Obtaining a behavior sequence to be evaluated; the behavior sequence includes a plurality of behavior points arranged in chronological order;

[0007] Dividing the behavior sequence into a plurality of windows of equal time length, and converting each behavior point in each window into a corresponding behavior label;

[0008] Based on the multiple windows of the behavior sequence and the multiple behavior labels in each window, a sample sequence corresponding to the behavior sequence is generated; any element m(x, y) in the sample sequence represents the number of times the behavior label x appears in the window y;

[0009] Calculating an anomaly score of the behavior sequence based on the sample sequence;

[0010] Capturing multiple forward dependencies and multiple backward dependencies of the behavior sequence; any of the forward dependencies represents a dependency between a behavior point corresponding to any time step and a behavior point corresponding to a previous time step, and the backward dependencies represent a dependency between a behavior point corresponding to any time step and a behavior point corresponding to a subsequent time step;

[0011] Splicing the multiple forward dependency relationships and the multiple backward dependency relationships to generate a feature vector; the feature vector is used to represent context information of the behavior sequence;

[0012] Reconstructing the feature vector to obtain a reconstructed behavior sequence;

[0013] Calculating a reconstruction error value between the reconstructed behavior sequence and the behavior sequence;

[0014] Based on the anomaly score and the reconstruction error value of the behavior sequence to be evaluated, it is determined whether the behavior sequence to be evaluated is credible.

[0015] The embodiment of the present application can capture the spatiotemporal distribution characteristics of the behavior sequence, that is, the regularity and periodicity of the behavior in time, by dividing the behavior sequence into time windows and counting the number of occurrences of the behavior label in the corresponding window. This method can more carefully analyze the changes in the resource utilization behavior of the medical network, thereby more accurately identifying abnormal behavior. For example, the behavior points in different resource utilization behavior sequences have different spatiotemporal distribution characteristics. For example, when a patient visits a doctor remotely, the operation process usually includes logging in, making an appointment, registering and paying, starting the visit, ending the visit, paying for medicine, and picking up medicine online. The behavior sequence of illegally collecting data is manifested as rapid page switching, refreshing, and continuous data downloading. Since many platform behaviors are repetitive and regular, resource utilization behaviors with the same or similar business logic often have a high degree of similarity in spatiotemporal distribution. Therefore, by learning this law, the accuracy of predicting whether the behavior sequence is credible can be greatly improved.

[0016] Preferably, the embodiment of the present application can more comprehensively understand the contextual associations between behaviors by capturing the forward and backward dependencies of the behavior sequence. For example, after a user makes an appointment, online diagnosis and treatment are usually followed, and health data may be uploaded after binding a health detection device. This behavior pattern can be captured through dependencies. If there are frequent switches or sparse contextual associations in the behavior sequence (such as resource abuse behavior), the reconstruction error will increase significantly, making it easier to be identified as an anomaly; therefore, by capturing the forward and backward dependencies of the behavior sequence, multiple forward dependencies and the multiple backward dependencies are spliced to generate a feature vector; the feature vector is used to characterize the contextual information of the behavior sequence; the feature vector is reconstructed to obtain a reconstructed behavior sequence; the reconstruction error value between the reconstructed behavior sequence and the behavior sequence is calculated, which can greatly improve the accuracy of the evaluation of whether the resource utilization behavior is credible.

[0017] In an embodiment of the present application, the method further includes:

[0018] Divide user behavior logs into multiple behavior sequences;

[0019] For any behavior sequence among the multiple behavior sequences, based on the multiple windows corresponding to the behavior sequence and the multiple behavior labels of each window, a two-dimensional matrix corresponding to the behavior sequence is generated; any matrix element m(i, j) in the two-dimensional matrix represents the number of times the behavior label i appears in the length window j;

[0020] Generate a three-dimensional matrix based on the multiple two-dimensional matrices corresponding to the multiple behavior sequences; the three-dimensional matrix is an array composed of multiple two-dimensional matrices, and any matrix element m(a, b, c) in the three-dimensional matrix represents the number of times the behavior label b in the behavior sequence a appears in the length window c;

[0021] The three-dimensional matrix is reshaped by dimensionality reduction to obtain a reshaped target two-dimensional matrix; wherein the dimensionality reduction and reshaping refers to adjusting the behavior label and window of each behavior sequence into a one-dimensional vector; any matrix element m(x,(yz)) in the target two-dimensional matrix represents the number of times the behavior label y in the behavior sequence x appears in the window z; the target two-dimensional matrix includes multiple sample sequences corresponding to the multiple behavior sequences, and any sample sequence includes multiple matrix elements of corresponding rows in the target two-dimensional matrix; wherein the sample sequence corresponding to the behavior sequence to be evaluated is any one of the multiple sample sequences.

[0022] In the embodiment of the present application, calculating the abnormality score of the behavior sequence based on the sample sequence includes:

[0023] constructing a plurality of isolation trees according to the sample sequences;

[0024] Calculating the average path length of each element in the sample sequence in the plurality of isolated trees;

[0025] An abnormality score of a behavior sequence corresponding to the sample sequence is determined according to a plurality of average path lengths corresponding to a plurality of elements in the sample sequence and an average path length of all trees.

[0026] In the embodiment of the present application, judging whether the behavior sequence to be evaluated is credible based on the anomaly score and reconstruction error value of the behavior sequence to be evaluated includes:

[0027] Inputting the anomaly score and the reconstruction error value into a trained prediction model, and outputting a first judgment result of the behavior sequence to be evaluated; the first judgment result includes a credible label or an uncredible label;

[0028] The prediction model is trained by the following steps:

[0029] Obtain a normal sequence and an abnormal sequence, and set a corresponding trusted label for the normal sequence, and set a corresponding untrusted label for the abnormal sequence;

[0030] The initial model learns a first relationship between the abnormality score and the reconstruction error value of the normal sequence and the credible label, and learns a second relationship between the abnormality score and the reconstruction error value of the abnormal sequence and the uncredible label;

[0031] The model parameters of the initial model are adjusted according to the first relationship and the second relationship to obtain the trained prediction model.

[0032] In an embodiment of the present application, the method further includes:

[0033] For any window in the plurality of windows of the behavior sequence, obtaining a behavior statistical indicator value in the window; the behavior statistical indicator value includes at least one of the following: average login frequency, cumulative timeout number, number of unauthorized requests, and number of payment cancellations;

[0034] Comparing the statistical indicator value of each behavior in the window with the corresponding statistical indicator threshold, and determining a second judgment result of the behavior sequence to be evaluated according to the comparison result;

[0035] It is determined whether the behavior sequence to be evaluated is credible according to the first judgment result and the second judgment result of the behavior sequence to be evaluated.

[0036] In the embodiment of the present application, capturing multiple forward dependencies and multiple backward dependencies of the behavior sequence includes:

[0037]

[0038] Among them, GRU forward Represents the forward GRU unit of the autoencoder, GRU reverse represents the reverse GRU unit of the autoencoder, e t represents the behavior embedding vector corresponding to the behavior sequence at time t, represents the forward hidden state at time t-1, represents the reverse hidden state at time t+1; the flow state summary at time step t is expressed as

[0039]

[0040] in, represents the forward hidden state of the i-th layer at time step t; represents the backward hidden state of the i-th layer at time step t, is the flow state output of the i-1th layer.

[0041] In an embodiment of the present application, the multiple forward dependency relationships and the multiple backward dependency relationships are concatenated to generate a feature vector, including:

[0042]

[0043] Among them, V e represents a feature vector used to characterize the contextual information of the behavior sequence; F is the number of Bi-GRU layers in the encoder.

[0044] An embodiment of the second aspect of the present application provides a medical resource utilization behavior evaluation device, comprising:

[0045] A sequence acquisition module is used to acquire a behavior sequence to be evaluated; the behavior sequence includes a plurality of behavior points arranged in chronological order;

[0046] A window division module, configured to divide the behavior sequence into a plurality of windows of equal time length, and convert each behavior point in each window into a corresponding behavior label;

[0047] A sample sequence generation module is configured to generate a sample sequence corresponding to the behavior sequence based on multiple windows of the behavior sequence and multiple behavior labels in each window; any element m(x, y) in the sample sequence represents the number of times the behavior label x appears in window y;

[0048] an anomaly score calculation module, configured to calculate an anomaly score of the behavior sequence based on the sample sequence;

[0049] A dependency capture module, configured to capture multiple forward dependencies and multiple backward dependencies of the behavior sequence; any forward dependency represents a dependency between a behavior point corresponding to any time step and a behavior point corresponding to a previous time step, and any backward dependency represents a dependency between a behavior point corresponding to any time step and a behavior point corresponding to a subsequent time step;

[0050] A feature vector generation module, configured to concatenate the plurality of forward dependencies and the plurality of backward dependencies to generate a feature vector; the feature vector is used to represent context information of the behavior sequence;

[0051] A sequence reconstruction module, used for reconstructing the feature vector to obtain a reconstructed behavior sequence;

[0052] A reconstruction error value calculation module, used to calculate the reconstruction error value between the reconstructed behavior sequence and the behavior sequence;

[0053] The sequence credibility judgment module is used to judge whether the behavior sequence to be evaluated is credible based on the anomaly score and reconstruction error value of the behavior sequence to be evaluated.

[0054] An embodiment of the third aspect of the present application provides an electronic device, which includes a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the medical resource utilization behavior evaluation method described in the first aspect above by executing the computer instructions.

[0055] An embodiment of the fourth aspect of the present application provides a computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions are used to enable a computer to execute the medical resource utilization behavior evaluation method described in the first aspect above.

[0056] Additional aspects and advantages of the present application will be given in part in the description below and in part will become apparent from the description below or learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present application. Throughout the accompanying drawings, the same reference numerals are used to denote the same components.

[0058] In the attached figure:

[0059] Figure 1 A flowchart of a medical resource utilization behavior evaluation method provided by an embodiment of the present application is shown;

[0060] Figure 2 A schematic diagram of a process for generating a 3D matrix according to an embodiment of the present application is shown;

[0061] Figure 3 A schematic diagram of the structure of a bidirectional GRU autoencoder provided in one embodiment of the present application is shown;

[0062] Figure 4 A schematic diagram of a model performance evaluation provided by an embodiment of the present application is shown;

[0063] Figure 5 A schematic diagram showing the anomaly score distribution effect of the trained sequence reshaping isolation forest model provided by an embodiment of the present application is shown;

[0064] Figure 6 The figure shows an ROC curve diagram drawn for the experimental results of the test samples in order to select a suitable confidence threshold provided by an embodiment of the present application;

[0065] Figure 7 A schematic diagram illustrating abnormal behavior operations for different types of users provided by an embodiment of the present application is shown;

[0066] Figure 8 A schematic diagram of the structure of a medical resource utilization behavior evaluation device provided in one embodiment of the present application is shown;

[0067] Figure 9 A schematic structural diagram of an electronic device provided in one embodiment of the present application is shown;

[0068] Figure 10 A schematic diagram of a storage medium provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0069] The following describes exemplary embodiments of the present application in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. Instead, these embodiments are provided to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0070] It should be noted that, unless otherwise specified, the technical or scientific terms used in this application should have the common meanings understood by those skilled in the art to which this application belongs.

[0071] The following describes the technical scenarios involved in the embodiments of this application.

[0072] The Internet of Healthcare Systems (IHS) is a smart healthcare service and management system based on high-speed communication networks and interconnected medical facilities, integrating healthcare big data and artificial intelligence technologies to achieve online and offline collaboration. With the development of the IHS, more and more healthcare institutions and participants are providing and receiving medical services through this network. However, the threats facing the IHS are also increasing. For example, patients may engage in fraudulent appointments, malicious medical treatments, upload false data, and illegally collect information, posing a threat to the health of patients. Furthermore, various types of medical personnel, such as fraudulent order fraud, illegal diagnosis and treatment, medical data tampering, and abuse of management rights, seriously endanger the safe operation of the IHS.

[0073] Currently, there is a lack of effective and targeted technical means to detect and manage the abuse of IoM service resources. The security, reliability, and effective user utilization of IoM service resources are fundamental to its stable operation. Resource abuse wastes IoM resources, impacts user privacy, and poses a serious threat to the normal operation of IoM services. Therefore, effectively measuring the trustworthiness of the behavior of diverse IoM user types is crucial to addressing these threats. Current mainstream research focuses on traffic monitoring and behavioral modeling for general users on general platforms, but there is currently no targeted analysis of the behavior of multi-role users in the IoM sector. Due to its complexity, IoM involves a diverse range of platform users, including patients, doctors, health consultants, nurses, inspectors, administrators, and third-party research institutions. These users exhibit significant differences in their access patterns and operations.

[0074] Mainstream research methods have insufficient attention to the business models of the medical network and the behavioral characteristics of multiple types of users, and have failed to fully combine the dynamic implicit correlation characteristics of multi-source, multi-channel, and multi-type behavioral data of the medical network. The embodiment of the present application designs a medical resource utilization behavior evaluation method for the medical network that integrates sequence features and multi-role behaviors. The window division and feature aggregation methods are independently designed to reshape the sample sequence, and the spatiotemporal distribution characteristics of the sequence are learned in combination with the isolation forest model; and a bidirectional gated recurrent unit autoencoder is introduced to improve the use of the sequence reconstruction error mean to measure the sequence reconstruction effect and reduce the impact of single-point random errors. In addition, a multi-role behavioral indicator analysis method for the medical network is independently designed, and differentiated behavioral indicators for different roles are designed and thresholds are calculated for evaluation. The embodiment of the present application combines behavioral profiling to effectively identify resource abuse behaviors, providing a solid technical guarantee for the stable operation of the medical network business and the security of service resources.

[0075] According to an embodiment of the present application, an embodiment of a method for evaluating medical resource utilization behavior is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0076] In this embodiment, a method for evaluating medical resource utilization behavior is provided. Figure 1 is a flow chart of a method for evaluating medical resource utilization behavior according to an embodiment of the present application. Figure 1 As shown, the process includes the following steps:

[0077] Step S101: Obtain a behavior sequence to be evaluated.

[0078] The behavior sequence includes a plurality of behavior points arranged in chronological order.

[0079] In an embodiment of the present application, the user behavior log stream is divided into multiple behavior sequences, and the behavior sequence to be evaluated is any one of the multiple behavior sequences.

[0080] Step S102: Divide the behavior sequence into multiple windows of equal length (e.g. Figure 2 ), and convert each behavior point in each window into the corresponding behavior label.

[0081] In the embodiment of the present application, the behavior sequence s is divided into W windows of equal length, and each behavior point in the window is converted into its corresponding behavior label. Assuming that the total number of behavior labels in each window is N, after window division, the behavior sequence s is initially converted into an N*W two-dimensional matrix, where any matrix element m(i, j) in the two-dimensional matrix represents the number of times the behavior label i appears in the length window j, as shown below:

[0082]

[0083] Among them, m 11 Indicates the number of times behavior label 1 appears in a length window of 1, m 12 Indicates the number of times behavior label 1 appears in length window 2, and the same applies to others.

[0084] For example, the above N*W two-dimensional matrix Figure 2 As shown in "2.2D matrix construction".

[0085] Step S103 : generating a sample sequence corresponding to the behavior sequence based on the multiple windows of the behavior sequence and the multiple behavior labels in each window.

[0086] Wherein, any element m(x,y) in the sample sequence represents the number of times the behavior label x appears in the window y.

[0087] The sample sequence corresponding to the behavior sequence can be generated by flattening the behavior label and window of the sample sequence into a one-dimensional vector. This is illustrated by the following example:

[0088]

[0089] In some specific embodiments, when the user behavior log stream is divided into multiple behavior sequences, multiple two-dimensional matrices corresponding to the multiple behavior sequences can be combined to obtain a K*N*W three-dimensional matrix, where K represents the number of behavior sequences. The three-dimensional matrix is specifically shown as follows:

[0090] When K=2,

[0091]

[0092] Among them, M represents a three-dimensional matrix, m 123 Indicates the number of times behavior label 2 in behavior sequence 1 appears in a window of length 3, m 223 Indicates the number of times behavior label 2 in behavior sequence 2 appears in length window 3, and the same applies to the others.

[0093] The three-dimensional matrix is reshaped by dimensionality reduction to obtain a reshaped target two-dimensional matrix. The dimensionality reduction and reshaping refers to adjusting the behavior label and window of each behavior sequence into a one-dimensional vector. Any matrix element m(x, (yz)) in the target two-dimensional matrix represents the number of times the behavior label y in the behavior sequence x appears in the window z. The reshaped target two-dimensional matrix is specifically shown as follows:

[0094]

[0095] The target two-dimensional matrix includes multiple sample sequences corresponding to the multiple behavior sequences, and any sample sequence includes multiple matrix elements of corresponding rows in the target two-dimensional matrix, for example:

[0096] The above-mentioned target two-dimensional matrix M1 includes two sample sequences, namely:

[0097] Sample sequence 1 = [m 111 m 112 m 113 m 121 m 122 m 123 m 131 m 132 m 133 ]

[0098] Sample sequence 2 = [m 211 m 212 m 213 m 221 m 222 m 223 m 231 m 232 m 233 ]

[0099] For example Figure 2 Flattening in "3.3D Matrix and Flattening"

[0100] Among them, m 111 m 112 m 113 m 121 m 122 m 123 m 131 m 132 m 133 It can be understood as the various features of sequence 1.

[0101] The sample sequence corresponding to the behavior sequence to be evaluated is any one of the multiple sample sequences.

[0102] Step S104: Calculate an abnormality score of the behavior sequence based on the sample sequence.

[0103] In some specific embodiments, the above step S104 includes steps S1041 to S1043:

[0104] Step S1041: construct multiple isolation trees according to the sample sequence.

[0105] In the embodiment of the present application, when constructing a single isolated tree in the isolation forest, a fixed number of subsample batches are randomly selected from the training data set each time. When splitting the data, the sequence sample is divided into two sub-parts each time. The division criteria are based on the randomly selected segmentation attributes and their corresponding values. When the depth of the isolation tree reaches a preset threshold or all data points are isolated, the construction is completed. This is illustrated by an example:

[0106] Suppose the sample sequence is: [1,2,3,4,5,6,7,8,9,10], most of which are normal points, but 10 is an anomaly (because it deviates significantly from the other points).

[0107] Step 1: Assume that 5 is randomly selected as the split point.

[0108] Step 2: Divide the data into two parts: the part less than or equal to 5: [1, 2, 3, 4, 5], and the part greater than 5: [6, 7, 8, 9, 10];

[0109] Step 3: Recursively divide [1,2,3,4,5]:

[0110] Randomly select split point 3, dividing into [1,2,3] and [4,5].

[0111] Continue partitioning [1,2,3] and [4,5] until every point is isolated.

[0112] Continue to divide [6,7,8,9,10]:

[0113] Randomly select the split point 8, dividing it into [6,7,8] and [9,10].

[0114] Continue dividing until every point is isolated.

[0115] Step 4: When all data points are isolated or the depth of the tree reaches a preset threshold, the isolation tree is constructed.

[0116] Constructing multiple isolation trees

[0117] An isolation forest is typically composed of multiple isolated trees. Each tree is constructed independently, with different split attributes and values randomly selected each time. Assuming three isolated trees are constructed, the partitioning process for each tree is as follows:

[0118] Tree 1:

[0119] Split points: 5 → [1,2,3,4,5] and [6,7,8,9,10]

[0120] Continue dividing until every point is isolated.

[0121] Tree 2:

[0122] Split points: 7 → [1,2,3,4,5,6,7] and [8,9,10]

[0123] Continue dividing until every point is isolated.

[0124] Tree 3:

[0125] Split points: 3 → [1,2,3] and [4,5,6,7,8,9,10]

[0126] Continue dividing until every point is isolated.

[0127] In the embodiment of the present application, by constructing an isolation forest with a specified number of isolated trees, the isolation effect of sequence samples can be measured based on the average path length of the sequence samples in different trees, which can be quantified as the abnormality score of the sequence.

[0128] Step S1042: Calculate the average path length of each element in the sample sequence in the plurality of isolated trees.

[0129] In the embodiment of the present application, the calculation logic of the path length of each element in a single isolated tree is as follows:

[0130]

[0131] Here, e is the number of edges from the tree root to the leaf node where x is located, recorded as the number of splits. T.size represents the number of samples that share a leaf node with element x. Because the tree depth is set to the logarithm of the number of samples, the PathLength of most samples will be relatively close. Therefore, the algorithm introduces a correction value c(T.size) to significantly increase the difference in PathLength between abnormal and normal samples. c(T.size) mathematically represents the average path length of a binary tree constructed from T.size samples.

[0132] In some specific embodiments, the path length of each element in a single isolated tree may also be calculated in the following manner:

[0133] Starting from the root node of the tree, traverse down along the partition path until you reach a leaf node. The path length is the number of edges from the root node to the leaf node. If there are multiple samples in the leaf node, the path length needs to be added to the average path length of the subtree. To illustrate this, let's take an example:

[0134] Assume that the structure of a single isolated tree is as follows:

[0135]

[0136] The path length is the number of edges from the root node to the leaf node (that is, the number of splits passed).

[0137] Sample A(1,2):

[0138] Starting from the root node (feature 1 ≤ 4), enter the left subtree. Then, in the left subtree, enter the left subtree with feature 2 ≤ 3. Finally, reach leaf node A. Sample A path length = 2.

[0139] Sample B(3,4):

[0140] Starting from the root node (feature 1 ≤ 4), enter the left subtree. Then, in the left subtree, enter the right subtree with feature 2 > 3. Finally, reach leaf node B. Sample B path length = 2.

[0141] Sample C(5,6):

[0142] Start from the root node (feature 1 > 4), enter the right subtree. In the right subtree, enter the left subtree with feature 1 ≤ 6. Arrive at leaf node C. Path length = 2.

[0143] Sample D(7,8):

[0144] Start from the root node (feature 1 > 4), enter the right subtree. In the right subtree, enter the right subtree with feature 1 > 6. Arrive at leaf node D. Path length = 2.

[0145] After the path length of each element in a single isolated tree is calculated, the average path length of each element in the multiple isolated trees can be obtained based on the average of multiple path lengths of each element in the multiple isolated trees.

[0146] Step S1043 : determining an abnormality score of a behavior sequence corresponding to the sample sequence according to multiple average path lengths corresponding to multiple elements in the sample sequence and the average path length of all trees.

[0147] In an embodiment of the application, after calculating the average path length of each element in multiple isolated trees, the anomaly score of any element can be calculated based on the average path length of the element in multiple isolated trees and the average path length of all trees; then, the anomaly scores of all elements in the sample sequence are counted, and the highest anomaly score is used as the anomaly score of the behavior sequence.

[0148] For any element x in the sample sequence, its anomaly score in the isolation forest algorithm is calculated as shown in formula (1). The anomaly score is calculated based on the average path length E(p(x)) of element x in all trees and normalized to the interval [0,1], where m(n) is the average path length of all trees.

[0149]

[0150] Analyzing the distribution range of anomaly scores, when the average path length E(p(x)) is close to the average length m(n), the anomaly score approaches 0.5, and the resource utilization behavior sequence is relatively credible. When E(p(x)) approaches 0, the anomaly score approaches 1, and the degree of isolation is the highest, that is, the possibility of resource abuse behavior sequence is the highest. When E(p(x)) is greater than m(n) and infinitely approaches n-1, the anomaly score approaches 0, and the degree of isolation is the lowest, and the behavior sequence is more credible.

[0151] The present application embodiment designs an isolation forest model module based on sequence reshaping to learn the spatiotemporal distribution characteristics of behavior sequences. Medical network users will generate differentiated fixed patterns when accessing different services, and the behavior points in different resource utilization behavior sequences therefore have different spatiotemporal distribution characteristics. For example, when a patient receives a remote medical consultation, the operation process usually includes logging in, making an appointment, registering and paying, starting the consultation, ending the consultation, paying for medication, and picking up the medication online. The behavior sequence of illegal data collection is manifested as rapid page switching, refreshing, and continuous data downloading. Because many platform behaviors are repetitive and regular, resource utilization behaviors with the same or similar business logic often have a high degree of similarity in spatiotemporal distribution. Therefore, the distribution of trustworthy behavior sequences usually contains more similar samples, while untrustworthy abuse behaviors show significant differences. The present application identifies untrustworthy behavior sequences based on the differences in spatiotemporal distribution characteristics. Isolation forest is an unsupervised anomaly detection algorithm based on a tree structure. It constructs multiple isolation trees by randomly selecting features and split points, and detects abnormal distribution points by using the difference in the difficulty of isolating abnormal points and normal points in the tree structure. The embodiment of the present application reconstructs the behavior sequence into a behavior point feature matrix under a fixed-length window, performs feature aggregation and dimensionality reduction on the feature matrix, and uses the isolation forest algorithm to detect sequence window segments with a high degree of isolation after reconstructing, so as to monitor the spatiotemporal distribution characteristics of abnormal behavior sequences in a manner that is more in line with business granularity and quantify them into anomaly scores.

[0152] Step S105 , capturing multiple forward dependencies and multiple backward dependencies of the behavior sequence.

[0153] Wherein, any forward dependency represents the dependency between the behavior point corresponding to any time step and the behavior point corresponding to the previous time step, and the backward dependency represents the dependency between the behavior point corresponding to any time step and the behavior point corresponding to the subsequent time step. The forward dependency can be understood as the forward hidden state below, and the backward dependency can be understood as the reverse hidden state below.

[0154] In the embodiment of the present application, the forward dependency and the backward dependency are captured by a bidirectional GRU (Bi-GRU) autoencoder. Figure 3 As shown: The Bi-GRU autoencoder includes an embedding layer (Embedding), an encoder layer (Encoder), a decoder layer (Decoder) and a reconstruction output layer (Reconstruction Seq)

[0155] The embedding layer is used to vectorize the trusted behavior sequence of fixed length N. Assuming that there are L types of behavior labels, one-hot encoding is used to convert the behavior sequence into an N*L vector embedding matrix E∈R N×L, the vector embedding matrix is sent to the encoder for learning. The encoding layer is composed of multiple layers of the same Bi-GRU unit. Given a behavior sequence X processed vector matrix S i =[e1,e2,...,e n ], the forward hidden state of the Bi-GRU unit at time t is expressed as The reverse hidden state is The calculation process is as shown in formula (2):

[0156]

[0157] Among them, GRU forward Represents the forward GRU unit, GRU reverse represents the reverse GRU unit, e t represents the behavior embedding vector at time t, represents the forward hidden state at time t-1, represents the reverse hidden state at time t+1. The flow state summary at time step t is expressed as The model is based on stacking multiple Bi-GRU units to learn the contextual dynamic association features of resource utilization behavior sequences. At time step t, the forward and reverse hidden states of the i-th layer can be calculated by formula (3), where is the flow state output of the i-1th layer.

[0158]

[0159] Step S106 : Concatenate the multiple forward dependency relationships and the multiple backward dependency relationships to generate a feature vector; the feature vector is used to represent context information of the behavior sequence.

[0160] In the embodiment of the present application, the forward and reverse hidden states of each layer output are aggregated to form the feature vector v output by the encoder. e , used to represent the contextual information of the entire behavior sequence, where F is the number of Bi-GRU layers in the encoder.

[0161]

[0162] Step S107: reconstruct the feature vector to obtain a reconstructed behavior sequence.

[0163] In the embodiment of the present application, the decoding layer also uses a multi-layer Bi-GRU network as the basic network unit. e is the input of the decoder. At time step t, the forward and reverse hidden states of the decoder output are and The calculation process is shown in formula (5):

[0164]

[0165] Then, by aggregating and reconstructing multiple forward hidden states with multiple reverse hidden states, a dry reconstructed behavior sequence is output.

[0166] Step S108: Calculate the reconstruction error value between the reconstructed behavior sequence and the behavior sequence.

[0167] In the embodiment of the present application, the reconstruction error value can be calculated in the following way:

[0168] First, calculate the probability distribution corresponding to the reconstructed behavior sequence using formula (6);

[0169]

[0170] represents the probability of outputting label i at time step t, θ k ,1≤k≤K obtains the optimal value corresponding to the task during the training process; θ i Represents the weight vector of label i, which is multiplied by the reconstructed behavior sequence x and then added with the bias b i , used to calculate the score of label i. represents θ i The transpose of x represents the sequence of reconstructed behaviors. i represents the bias term for label i, which is used to adjust the score. exp represents the exponential function, which is used to convert the score to a positive number. The denominator is the exponential sum of all label scores, which is used for normalization to ensure that the sum of all label probabilities is 1.

[0171] Then, the cross entropy loss X of multiple behavior labels in each time step is calculated based on the probability distribution t Finally, the cross entropy loss of all time steps is averaged to obtain the reconstruction error S of the entire behavior sequence X X , as shown in formula (7).

[0172]

[0173] Among them, S X represents the average cross entropy loss, n represents the number of behavior points in the behavior sequence, X t represents the cross entropy loss of multiple behavior labels within time step t, L represents the total number of labels, and L i Represents the indicator function of the i-th label. If sample t belongs to category i, then L i =1, otherwise L i =0.

[0174] In the embodiment of the present application, the reconstruction error S of the behavior sequence XIt is used to characterize the credibility of the behavior sequence. The lower the reconstruction error, the more the sequence fits the credible features learned by the model, and the more likely the sequence is to be credible.

[0175] Step S109 : judging whether the behavior sequence to be evaluated is credible based on the anomaly score and the reconstruction error value of the behavior sequence to be evaluated.

[0176] In an embodiment of the present application, the anomaly score and the reconstruction error value are input into a trained prediction model, and a first judgment result of the behavior sequence to be evaluated is output; the first judgment result includes a credible label or an uncredible label;

[0177] The prediction model is trained by following steps a1 to a3:

[0178] Step a1: obtain a normal sequence and an abnormal sequence, and set a corresponding trusted label for the normal sequence and a corresponding untrusted label for the abnormal sequence;

[0179] Step a2: the initial model learns a first relationship between the abnormality score and reconstruction error value of the normal sequence and the credible label, and learns a second relationship between the abnormality score and reconstruction error value of the abnormal sequence and the uncredible label;

[0180] Step a3: Adjust the model parameters of the initial model according to the first relationship and the second relationship to obtain the trained prediction model.

[0181] In the embodiment of the present application, during the model training process, the abnormality score S of each behavior sequence is calculated. i and reconstruction error S X As features, a new feature matrix is constructed. Each row represents a sequence and the abnormality score S of the sequence i and reconstruction error S X The logistic regression model is trained using the credible labels (credible or uncredible) of the labeled samples as the target variable and the constructed feature matrix as the input. During training, the logistic regression model learns the relationship between the anomaly score, the reconstruction error, and the credibility of the behavior sequence. By adjusting the model parameters, the model can predict the anomaly labels of the behavior sequence as accurately as possible.

[0182] More specifically, the trained prediction model will perform anomaly scoring on the input features (i.e., the anomaly score S calculated by the isolation forest model and the Bi-GRU autoencoder, i.e., the anomaly score S i and reconstruction error S X) outputs a probability value, indicating the probability that the behavior sequence is a credible sequence. This probability value can be considered a credibility score. A higher credibility score indicates that the model is more likely to consider the sequence credible; conversely, a lower credibility score indicates that the model is more likely to consider the sequence anomalous and unreliable. By using the ROC curve to select an appropriate credibility threshold, and then comparing the credibility threshold with the credibility score, the credibility of the behavior sequence is ultimately determined.

[0183] This application provides a specific embodiment, namely:

[0184] When the new user behavior data stream (a1, a2, ..., a i ,...) arrives, it is divided into multiple behavior sequences, input into the iForest model (isolation forest model) and the autoencoder model evaluation, if the iForest model is good for the sequence X=[a1,a2,...,a j ,...,a m ]The calculated anomaly score is S i , the reconstruction error value S calculated by the bidirectional GRU autoencoder model X， This pair of scores is fed into the trained prediction model for prediction calculation, and the final comprehensive credibility of sequence X is obtained as S LR :

[0185] S LR =LR(S i ,S X ) (8)

[0186] Finally, the credible threshold g and S determined by the experiment are used LR Compare and determine whether sequence X is a trusted resource utilization behavior sequence. The judgment formula is as follows:

[0187]

[0188] If the comprehensive credibility S LR is greater than the credibility threshold g, it means that the behavior sequence X is credible; on the contrary, if the comprehensive credibility S LR If it is less than or equal to the credibility threshold g, it means that the behavior sequence X is not credible.

[0189] In some specific embodiments, the method further comprises:

[0190] Step b1: for any window among the multiple windows of the behavior sequence, obtain the behavior statistical indicator value in the window.

[0191] In the embodiment of the present application, in order to characterize the user behavior portrait from multiple angles, the resource utilization behavior characteristics and multiple types of scenarios of medical network users are fully analyzed, and 18 behavioral statistical indicators are determined, including average login frequency, cumulative timeout number, number of unauthorized requests, number of payment cancellations, number of refund applications, number of appointment cancellations, number of medical treatment violations, number of online medication collections, number of file downloads, number of resource destructions, number of data uploads, number of doctor evaluations, number of account modifications, number of patients treated, number of medical record modifications, number of medical record updates, modification of nursing records, and modification of anesthesia records. The characteristics of the resource utilization behavior of multiple types of users are characterized. The detailed description of the behavioral statistical indicators is shown in Table 1:

[0192] Table 1

[0193]

[0194]

[0195] The statistical features in Table 1 characterize the resource utilization behaviors of various user types from different dimensions, forming a multidimensional statistical profile of user behavior. For example, in real-world medical networking scenarios, when patients have short average behavior intervals and a high number of unauthorized requests, they are likely to frequently attempt to access resources beyond their authorized access rights. When users download large amounts of data from the medical networking platform within a certain time window, they are likely engaging in resource abuse, such as illegal data collection. When doctors complete a large number of patient treatment orders within a fixed time window, they are likely engaging in fraudulent order-padding violations. Based on these statistical characteristics, we can describe the resource utilization behaviors of medical networking users from a variety of perspectives.

[0196] Step b2: comparing the statistical indicator value of each behavior in the window with the corresponding statistical indicator threshold, and determining a second judgment result of the behavior sequence to be evaluated according to the comparison result.

[0197] In an embodiment of the present application, a corresponding statistical indicator threshold is set in advance for each behavioral statistical indicator. When any behavioral statistical indicator value of a user in a certain time window is greater than the corresponding statistical indicator threshold, it means that the behavior sequence will be judged as an abnormal behavior sequence or an untrustworthy sequence.

[0198] In some specific embodiments, a large number of statistical characteristic index values of trusted users within a unit time window are analyzed in the early stage, and the index threshold is selected as an important part of the user behavior profile. The user behavior is further quantitatively evaluated from the perspective of statistical characteristics based on the index threshold. Resource utilization behavior sequence S = {b1, b2, ..., b n The evaluation process starts when the timer arrives. The time window partitioning module divides the behavior flow into behavior clusters w in different time windows using a fixed time window T. t ={bi ,b i+1 ,...,b j}, then the behavior sequence S is divided into , the behavior statistics indicator calculation module obtains each behavior cluster w t The indicator evaluation module compares the statistical indicator value of each behavior cluster with the corresponding threshold θ one by one I When the user's behavior statistics in a certain time window exceed the normal threshold, there is an I k >θ I When the resource utilization behavior sequence is detected, it will be judged as an abnormal behavior sequence and reported as an untrustworthy user in a timely manner.

[0199] Step b3: determining whether the behavior sequence to be evaluated is credible based on the first judgment result and the second judgment result of the behavior sequence to be evaluated.

[0200] In this embodiment of the present application, the first judgment result is determined by the trained prediction model based on the anomaly score of the behavior sequence to be evaluated and the reconstruction error value, and the second judgment result is determined by comparing the statistical indicator value of each behavior within each window in the behavior sequence to be evaluated with the corresponding statistical indicator threshold. When both the first judgment result and the second judgment result determine that the behavior sequence to be evaluated is unreliable, the behavior sequence to be evaluated is ultimately determined to be an unreliable behavior sequence or an abnormal behavior sequence.

[0201] In some specific embodiments, whether the behavior sequence to be evaluated is credible can also be determined based on the first judgment result and the second judgment result in the following manner: when at least one of the first judgment result and the second judgment result determines that the behavior sequence to be evaluated is not credible, the behavior sequence to be evaluated is ultimately determined to be an untrustworthy behavior sequence or an abnormal behavior sequence.

[0202] The present application also provides corresponding experiments and result analysis, which are as follows:

[0203] Experimental dataset

[0204] In this experiment, we used version 4.2 of the CMU-CERT Insider Threat Dataset and combined it with a log dataset from a real-world production environment at a community hospital within the IoM system to construct a comprehensive and rich experimental dataset. The CMU-CERT dataset is the only publicly available dataset of system employee behavior. Version 4.2 contains over 3.22 million employee behavior logs, covering activities such as logins, device usage, file operations, HTTP requests, and emails. This data includes not only six CSV-formatted log files but also an LDAP folder containing detailed information such as employee name, ID, address, position, and department, as well as 7,423 flagged malicious operation logs. Given the CMU-CERT dataset's limitations in terms of IoM system feature data, this study collected de-identified user behavior logs from an IoM hospital. This data includes 1,462 user activity records within the IoM system, 79 of which contain annotated anomalous operations. Before entering the model, we rigorously preprocessed both the IoM logs and the CERT dataset, including data cleaning, missing value handling, and normalization, to ensure data quality and consistency. This study uses the processed CERT4.2 dataset to verify the effectiveness of the sequence feature evaluation model constructed in this paper on a public dataset. The desensitized user dataset of the medical network hospital is used to verify the actual effect of the behavioral statistical indicator evaluation method proposed in this study.

[0205] Model performance testing

[0206] The sequence feature evaluation model focuses on the behavioral data of ordinary system users for validity verification and determines the data subsets for model training and testing. The dataset contains 26,842 records of credible behavior sequences and 4,719 records of abuse behavior sequences. 15,062 credible sequences and 2,532 abuse sequences were sampled as the training set, and 1,032 and 476 sequences were selected from the remaining data as the validation set. After each training iteration of the model, the model performance is evaluated. Finally, 976 behavioral sequence data were selected from the dataset as the test set, including 692 credible sequences and 284 abuse sequences. This designed dataset and sampling method ensure the reliability of the model performance evaluation.

[0207] The IF-BGA model proposed in this paper fully integrates the ability of isolation forest to identify sequence distribution characteristics and the ability of bidirectional GRU autoencoder to learn related features when reconstructing sequences. In order to verify the effectiveness of the IF-BGA sequence evaluation model in the task of detecting user behavior sequences, this study used Python language for prototype testing. The CPU of the test environment is Inteli9-11900K@3.5GHz, the memory is 16GB, the hard disk is a 1TB solid-state drive, and the graphics card is NVIDIAGeForce RTX 3090. A comparative analysis experiment was conducted between IF-BGA and three mainstream models of sequence evaluation - Bio-Inspired Models, MFC and LSTM Autoencoder. The IF-BGA model first trains a bidirectional GRU autoencoder model based on labeled credible sequence data, and uses its average reconstruction error of the sequence as the Loss function for learning optimization. The initial learning rate is set to 1e-4. The entire training process lasted for 120 epochs. After every 5 epochs, the performance of the model was evaluated on the validation set. Figure 4 From the analysis, we can see that after 95 iterations, the average reconstruction error of the model is stable at around 0.13.

[0208] Then, the credible and uncredible labeled samples are combined in a ratio of 98:2, and the samples are further processed into a matrix form based on time window segmentation. The matrix data points are input into the isolation forest model to further obtain the anomaly score distribution, where the number of base estimators of the isolation forest is set to 100, the anomaly point ratio is set to 0.2, and the number of samples for each base estimator is set to 256. The trained isolation forest model has learned the ability to detect abnormal distribution sequences. The trained sequence reshapes the anomaly score distribution effect of the isolation forest model as shown below. Figure 5 shown.

[0209] After the Isolation Forest Model and the Bidirectional GRU Model are learned, the full amount of labeled training data, totaling 17,594 entries, is used to input the two models. The obtained anomaly scores and reconstruction error scores are used to train the downstream logistic regression model. After sufficient training, the logistic regression model can learn the characteristics of the positive and negative sample score pairs. At this point, the IF-BGA model training is completed. In order to select the appropriate classification threshold of the logistic regression model, the ROC curve is plotted for the experimental results of the test samples, as shown in the figure below. Figure 6 shown.

[0210] Considering the low tolerance for both false positives and false negatives in sequence evaluation tasks, we ultimately selected a threshold g of 0.782 as the threshold for determining anomaly score pairs based on the strategy of maximizing the TPR-FPR value while minimizing the FPR. To comprehensively evaluate the model's performance, we conducted comparative experiments using key metrics such as precision, recall, and F1 score. The results are shown in Table 2.

[0211] Table 2

[0212] Model Accuracy Recall F1 score DBLOF 0.72 0.85 0.87 IDTE 0.86 0.88 0.90 RAP-Net 0.83 0.81 0.87 IF 0.84 0.82 0.88 CNN-Attentional BiGRU 0.83 0.82 0.87 IF-BGA 0.90 0.91 0.92

[0213] Comparative experimental results show that the IF-BGA model outperforms competing models such as DBLOF, IDTE, RAP-Net, IF, and CNN-Attentional BiGRU in accuracy, recall, and precision. The IF-BGA model's advantage lies in its integrated learning of the distributional and hyponymous features of sequence data, and its rational serialization ensures that each behavioral sequence retains sufficiently complete features. The use of isolation forests to identify sequence distribution features combined with the time window's ability to reshape sequence features effectively ensures the model's joint learning of distributional features within different time windows. Furthermore, the IF-BGA model optimizes the unit structure of the autoencoder and utilizes Bi-GRU as the basic building block of the encoder and decoder, leveraging its ability to model long sequences. This structure effectively learns bidirectional contextual information within the sequence while effectively alleviating the vanishing gradient problem. In the task of trustworthy assessment of medical network resource utilization behavior, the IF-BGA model designed in this study can effectively identify untrustworthy implicit behavioral sequence features from behavioral sequences, effectively compensating for the shortcomings of explicit behavioral indicator evaluation models.

[0214] Behavioral statistical indicator experiment

[0215] In order to verify the effectiveness of the method of evaluating user behavior based on statistical features in multi-role portraits, the behavioral logs of medical network users were processed and analyzed, and the time window evaluation method of this study was used for experimental verification. A total of 953 behavioral log records of three types of trusted users, namely patients, doctors, and administrators, were extracted from the user behavior logs of the medical network, including 335 doctor behavior records, 472 patient behavior records, and 146 administrator behavior records. Each user behavior record only retained the user's behavior data for the most recent month. The user behavior data was then divided into behavior clusters within each time window using a time window of T = 30 minutes. The statistical indicator values corresponding to each window behavior cluster were then calculated based on the 19 user behavior statistical indicators defined in this study. Finally, the boundary values of each type of user statistical indicator were calculated to obtain the threshold corresponding to the indicator. The medical network behavior log records of three types of marked abnormal users were then extracted, with two abnormal samples for each user role. The same time window was used to divide the behavior records and calculate the statistical features. The window with the largest corresponding value was retained for each indicator. The statistical results are as follows: Figure 7 As shown:

[0216] like Figure 7As shown in the analysis table, the data marked in gray show that the numerical details of the indicators are higher than the corresponding thresholds, indicating that different types of users will show one or more behavioral statistical indicators that significantly exceed the threshold when performing obvious abnormal behavior operations. This phenomenon further proves that the statistical feature threshold judgment can effectively discover the obvious untrustworthy behavior of medical network users, indicating that the statistical feature threshold as a user portrait label can clearly characterize the normal behavior characteristics of users, reveal the significant differences between the trustworthy behavior and resource abuse behavior patterns of different types of users, and based on this, significantly distinguish untrustworthy users. Based on the above experimental results, we can further explore the mathematical relationship between more behavioral statistical indicators in order to build a more accurate and effective quantitative evaluation model. This will help the system and administrators better understand and evaluate user resource utilization behavior, so as to make more informed decisions in practical applications.

[0217] The embodiment of the present application proposes a medical network resource utilization behavior evaluation model based on user behavior profiles. By combining the IF-BGA model's ability to learn multiple features of behavior sequences and an evaluation method based on behavioral statistical indicators, a multi-role resource utilization behavior profile of the medical network is jointly constructed, and a resource utilization behavior evaluation method based on sequence features and statistical features is implemented. Experimental results show that the trustworthy evaluation method proposed in this study has high accuracy and practicality in the task of evaluating medical network resource utilization behavior, providing a new perspective for user behavior analysis in the medical network. The study uses an isolation forest based on sequence reshaping to learn the distribution characteristics of behavior sequences, and quantifies the abnormal distribution characteristics as the abnormal score output of the isolation forest; uses the optimized Bi-GRU autoencoder structure to learn the contextual association features of the behavior sequence, and measures the credibility of the resource utilization behavior sequence based on the encoder's reconstruction error of the sequence. Finally, a logistic regression model is combined to learn the binary distribution of the abnormal score and the reconstruction error score, and then detects untrustworthy sequences based on the score difference between credible and untrustworthy sequence samples. Based on the statistical characteristics of multi-role user behavior, we construct statistical indicators for profiling, evaluating resource utilization behavior using a behavioral measurement method that is more closely aligned with the business characteristics of the medical network. Finally, we effectively integrate behavioral statistical feature evaluation and sequence feature evaluation methods to form a trustworthy assessment method for medical network resource utilization behavior based on user behavior profiling. Experiments demonstrate that this research method can effectively achieve rapid assessment of user behavior sequences, providing a technical foundation for long-term tracking and analysis of user resource utilization behavior, which is particularly important in the medical network, a field that relies heavily on data accuracy and reliability. In summary, this model is not only theoretically innovative but also demonstrates good performance in practical applications. Its superior performance in the task of trustworthy assessment of medical network resource utilization behavior sequences provides a strong guarantee for the security and efficiency of the medical network and also provides new ideas and methods for research in related fields.

[0218] Corresponding to the implementation of the above medical resource utilization behavior evaluation method, the embodiment of the present application also provides a medical resource utilization behavior evaluation device for executing the medical resource utilization behavior evaluation method described in the above embodiment. Figure 8 As shown, the medical resource utilization behavior assessment device includes:

[0219] A sequence acquisition module is used to acquire a behavior sequence to be evaluated; the behavior sequence includes a plurality of behavior points arranged in chronological order;

[0220] A window division module, configured to divide the behavior sequence into a plurality of windows of equal time length, and convert each behavior point in each window into a corresponding behavior label;

[0221] A sample sequence generation module is configured to generate a sample sequence corresponding to the behavior sequence based on multiple windows of the behavior sequence and multiple behavior labels in each window; any element m(x, y) in the sample sequence represents the number of times the behavior label x appears in window y;

[0222] an anomaly score calculation module, configured to calculate an anomaly score of the behavior sequence based on the sample sequence;

[0223] A dependency capture module, configured to capture multiple forward dependencies and multiple backward dependencies of the behavior sequence; any forward dependency represents a dependency between a behavior point corresponding to any time step and a behavior point corresponding to a previous time step, and any backward dependency represents a dependency between a behavior point corresponding to any time step and a behavior point corresponding to a subsequent time step;

[0224] A feature vector generation module, configured to concatenate the plurality of forward dependencies and the plurality of backward dependencies to generate a feature vector; the feature vector is used to represent context information of the behavior sequence;

[0225] A sequence reconstruction module, used for reconstructing the feature vector to obtain a reconstructed behavior sequence;

[0226] A reconstruction error value calculation module, used to calculate the reconstruction error value between the reconstructed behavior sequence and the behavior sequence;

[0227] The sequence credibility judgment module is used to judge whether the behavior sequence to be evaluated is credible based on the anomaly score and reconstruction error value of the behavior sequence to be evaluated.

[0228] Optionally, the device further includes: the method further includes:

[0229] A two-dimensional matrix generation module is used to divide the user behavior log into multiple behavior sequences; for any behavior sequence in the multiple behavior sequences, based on the multiple windows corresponding to the behavior sequence and the multiple behavior labels in each window, a two-dimensional matrix corresponding to the behavior sequence is generated; any matrix element m(i, j) in the two-dimensional matrix represents the number of times the behavior label i appears in the length window j;

[0230] A three-dimensional matrix generation module is configured to generate a three-dimensional matrix based on the multiple two-dimensional matrices corresponding to the multiple behavior sequences; the three-dimensional matrix is an array composed of multiple two-dimensional matrices, and any matrix element m(a, b, c) in the three-dimensional matrix represents the number of times the behavior label b in the behavior sequence a appears in the length window c;

[0231] A target two-dimensional matrix generation module is used to reduce the dimension of the three-dimensional matrix and reshape it to obtain a reshaped target two-dimensional matrix; wherein the dimensionality reduction and reshaping refers to adjusting the behavior label and window of each behavior sequence into a one-dimensional vector; any matrix element m(x,(yz)) in the target two-dimensional matrix represents the number of times the behavior label y in the behavior sequence x appears in the window z; the target two-dimensional matrix includes multiple sample sequences corresponding to the multiple behavior sequences, and any sample sequence includes multiple matrix elements of corresponding rows in the target two-dimensional matrix; wherein the sample sequence corresponding to the behavior sequence to be evaluated is any one of the multiple sample sequences.

[0232] Optionally, the anomaly score calculation module is further used to construct multiple isolated trees based on the sample sequence; calculate the average path length of each element in the sample sequence in the multiple isolated trees; and determine the anomaly score of the behavior sequence corresponding to the sample sequence based on multiple average path lengths corresponding to multiple elements in the sample sequence and the average path length of all trees.

[0233] Optionally, the sequence credibility judgment module is also used to input the anomaly score and the reconstruction error value into a trained prediction model, and output a first judgment result of the behavior sequence to be evaluated; the first judgment result includes a credible label or an untrustworthy label; wherein, the prediction model is trained through the following steps: obtaining a normal sequence and an abnormal sequence, and setting a corresponding credible label for the normal sequence, and setting a corresponding untrustworthy label for the abnormal sequence; the initial model learns the first relationship between the anomaly score and reconstruction error value of the normal sequence and the credible label, and learns the second relationship between the anomaly score and reconstruction error value of the abnormal sequence and the untrustworthy label; the model parameters of the initial model are adjusted according to the first relationship and the second relationship to obtain the trained prediction model.

[0234] Optionally, the device further comprises:

[0235] a behavior statistical indicator value acquisition module, configured to acquire, for any one of the multiple windows of the behavior sequence, a behavior statistical indicator value within the window; the behavior statistical indicator value comprising at least one of the following: average login frequency, cumulative number of timeouts, number of unauthorized requests, and number of payment cancellations;

[0236] a comparison module, configured to compare the statistical indicator value of each behavior in the window with the corresponding statistical indicator threshold, and determine a second judgment result of the behavior sequence to be evaluated according to the comparison result;

[0237] The sequence credibility judgment module is used to determine whether the behavior sequence to be evaluated is credible according to the first judgment result and the second judgment result of the behavior sequence to be evaluated.

[0238] The medical resource utilization behavior evaluation device provided in the above-mentioned embodiment of the present application and the medical resource utilization behavior evaluation method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0239] The present application also provides an electronic device to perform the above-mentioned medical resource utilization behavior evaluation method. Figure 9 , which shows a schematic diagram of an electronic device provided by some embodiments of the present application. Figure 9 As shown, the electronic device 9 includes: a processor 900, a memory 901, a bus 902 and a communication interface 903, and the processor 900, the communication interface 903 and the memory 901 are connected via the bus 902; the memory 901 stores a computer program that can be run on the processor 900, and when the processor 900 runs the computer program, it executes the medical resource utilization behavior evaluation method provided in the aforementioned embodiment of the present application.

[0240] The memory 901 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage. The system network element and at least one other network element are connected via at least one communication interface 903 (which may be wired or wireless), and may utilize the Internet, a wide area network, a local area network, a metropolitan area network, or the like.

[0241] Bus 902 can be an ISA bus, a PCI bus, or an EISA bus. The bus can be divided into an address bus, a data bus, a control bus, etc. Memory 901 is used to store programs, and processor 900 executes the programs upon receiving execution instructions. The medical resource utilization behavior assessment method disclosed in the aforementioned embodiments can be applied to processor 900 or implemented by processor 900.

[0242] The processor 900 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by hardware integrated logic circuits in the processor 900 or by software instructions. The above processor 900 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly implemented and executed by a hardware decoding processor, or by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium mature in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in the memory 901 , and the processor 900 reads the information in the memory 901 and completes the steps of the above method in combination with its hardware.

[0243] The electronic device provided in the embodiment of the present application and the medical resource utilization behavior evaluation method provided in the embodiment of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, operated or implemented by them.

[0244] The present application also provides a computer-readable storage medium corresponding to the medical resource utilization behavior evaluation method provided in the above embodiment. Figure 10 The computer-readable storage medium shown is a CD 30, on which a computer program (i.e., a program product) is stored. When the computer program is run by the processor, it will execute the medical resource utilization behavior evaluation method provided by any of the aforementioned embodiments.

[0245] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0246] The computer-readable storage medium provided in the above-mentioned embodiments of the present application and the medical resource utilization behavior evaluation method provided in the embodiments of the present application are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0247] It should be noted that:

[0248] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known structures and technologies are not shown in detail so as not to obscure the understanding of this description.

[0249] Similarly, it should be understood that in order to streamline the present application and aid in understanding one or more of the various inventive aspects, in the above description of the exemplary embodiments of the present application, various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following schematic diagram: the claimed application requires more features than the features expressly recited in each claim. Rather, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims following the detailed description are hereby expressly incorporated into the detailed description, with each claim itself serving as a separate embodiment of the present application.

[0250] Furthermore, those skilled in the art will appreciate that although some embodiments described herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of this application and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0251] The above description is merely a preferred embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for evaluating medical resource utilization behavior, characterized in that: The method comprises: Obtaining a behavior sequence to be evaluated; the behavior sequence is a medical resource utilization behavior sequence, and the behavior sequence includes multiple behavior points arranged in chronological order; Dividing the behavior sequence into a plurality of windows of equal time length, and converting each behavior point in each window into a corresponding behavior label; Based on the multiple windows of the behavior sequence and the multiple behavior labels in each window, a sample sequence corresponding to the behavior sequence is generated; any element m(x, y) in the sample sequence represents the number of times the behavior label x appears in the window y; Calculating an anomaly score of the behavior sequence based on the sample sequence; Capturing multiple forward dependencies and multiple backward dependencies of the behavior sequence; any of the forward dependencies represents a dependency between a behavior point corresponding to any time step and a behavior point corresponding to a previous time step, and the backward dependencies represent a dependency between a behavior point corresponding to any time step and a behavior point corresponding to a subsequent time step; Splicing the multiple forward dependency relationships and the multiple backward dependency relationships to generate a feature vector; the feature vector is used to represent context information of the behavior sequence; Reconstructing the feature vector to obtain a reconstructed behavior sequence; Calculating a reconstruction error value between the reconstructed behavior sequence and the behavior sequence; Based on the anomaly score and the reconstruction error value of the behavior sequence to be evaluated, it is determined whether the behavior sequence to be evaluated is credible.

2. The method according to claim 1, characterized in that The method further comprises: Divide user behavior logs into multiple behavior sequences; For any behavior sequence among the multiple behavior sequences, based on the multiple windows corresponding to the behavior sequence and the multiple behavior labels of each window, a two-dimensional matrix corresponding to the behavior sequence is generated; any matrix element m(i, j) in the two-dimensional matrix represents the number of times the behavior label i appears in the length window j; Generate a three-dimensional matrix based on the multiple two-dimensional matrices corresponding to the multiple behavior sequences; the three-dimensional matrix is an array composed of multiple two-dimensional matrices, and any matrix element m(a, b, c) in the three-dimensional matrix represents the number of times the behavior label b in the behavior sequence a appears in the length window c; The three-dimensional matrix is reshaped by dimensionality reduction to obtain a reshaped target two-dimensional matrix; wherein the dimensionality reduction and reshaping refers to adjusting the behavior label and window of each behavior sequence into a one-dimensional vector; any matrix element m(x,(yz)) in the target two-dimensional matrix represents the number of times the behavior label y in the behavior sequence x appears in the window z; the target two-dimensional matrix includes multiple sample sequences corresponding to the multiple behavior sequences, and any sample sequence includes multiple matrix elements of corresponding rows in the target two-dimensional matrix; wherein the sample sequence corresponding to the behavior sequence to be evaluated is any one of the multiple sample sequences.

3. The method according to claim 1, characterized in that Calculating an anomaly score of the behavior sequence based on the sample sequence includes: constructing a plurality of isolation trees according to the sample sequences; Calculating the average path length of each element in the sample sequence in the plurality of isolated trees; An abnormality score of a behavior sequence corresponding to the sample sequence is determined according to a plurality of average path lengths corresponding to a plurality of elements in the sample sequence and an average path length of all trees.

4. The method according to claim 1, wherein Determining whether the behavior sequence to be evaluated is credible based on the anomaly score and the reconstruction error value of the behavior sequence to be evaluated includes: Inputting the anomaly score and the reconstruction error value into a trained prediction model, and outputting a first judgment result of the behavior sequence to be evaluated; the first judgment result includes a credible label or an uncredible label; The prediction model is trained by the following steps: Obtain a normal sequence and an abnormal sequence, and set a corresponding trusted label for the normal sequence, and set a corresponding untrusted label for the abnormal sequence; The initial model learns a first relationship between the abnormality score and the reconstruction error value of the normal sequence and the credible label, and learns a second relationship between the abnormality score and the reconstruction error value of the abnormal sequence and the uncredible label; The model parameters of the initial model are adjusted according to the first relationship and the second relationship to obtain the trained prediction model.

5. The method according to claim 4, characterized in that The method further comprises: For any window in the plurality of windows of the behavior sequence, obtaining a behavior statistical indicator value in the window; the behavior statistical indicator value includes at least one of the following: average login frequency, cumulative timeout number, number of unauthorized requests, and number of payment cancellations; Comparing the statistical indicator value of each behavior in the window with the corresponding statistical indicator threshold, and determining a second judgment result of the behavior sequence to be evaluated according to the comparison result; It is determined whether the behavior sequence to be evaluated is credible according to the first judgment result and the second judgment result of the behavior sequence to be evaluated.

6. The method according to claim 1, characterized in that Capturing multiple forward dependencies and multiple backward dependencies of the behavior sequence, including: Among them, GRU forward Represents the forward GRU unit of the autoencoder, GRU reverse represents the reverse GRU unit of the autoencoder, e t represents the behavior embedding vector corresponding to the behavior sequence at time t, represents the forward hidden state at time t-1, represents the reverse hidden state at time t+1; the flow state summary at time step t is expressed as in, represents the forward hidden state of the i-th layer at time step t; represents the backward hidden state of the i-th layer at time step t, is the flow state output of the i-1th layer.

7. The method according to claim 6, characterized in that Splicing the multiple forward dependency relationships and the multiple backward dependency relationships to generate a feature vector includes: Among them, V e represents a feature vector used to characterize the contextual information of the behavior sequence; F is the number of Bi-GRU layers in the encoder.

8. A medical resource utilization behavior evaluation device, characterized in that: The device comprises: A sequence acquisition module is used to acquire a behavior sequence to be evaluated; the behavior sequence includes a plurality of behavior points arranged in chronological order; A window division module, configured to divide the behavior sequence into a plurality of windows of equal time length, and convert each behavior point in each window into a corresponding behavior label; A sample sequence generation module is configured to generate a sample sequence corresponding to the behavior sequence based on multiple windows of the behavior sequence and multiple behavior labels in each window; any element m(x, y) in the sample sequence represents the number of times the behavior label x appears in window y; an anomaly score calculation module, configured to calculate an anomaly score of the behavior sequence based on the sample sequence; A dependency capture module, configured to capture multiple forward dependencies and multiple backward dependencies of the behavior sequence; any forward dependency represents a dependency between a behavior point corresponding to any time step and a behavior point corresponding to a previous time step, and any backward dependency represents a dependency between a behavior point corresponding to any time step and a behavior point corresponding to a subsequent time step; A feature vector generation module, configured to concatenate the plurality of forward dependencies and the plurality of backward dependencies to generate a feature vector; the feature vector is used to represent context information of the behavior sequence; A sequence reconstruction module, used for reconstructing the feature vector to obtain a reconstructed behavior sequence; A reconstruction error value calculation module, used to calculate the reconstruction error value between the reconstructed behavior sequence and the behavior sequence; The sequence credibility judgment module is used to judge whether the behavior sequence to be evaluated is credible based on the anomaly score and reconstruction error value of the behavior sequence to be evaluated.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the medical resource utilization behavior evaluation method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the medical resource utilization behavior evaluation method according to any one of claims 1 to 7.

Images