Network security risk assessment method and system based on data model

Abstract

The invention discloses a network security risk assessment method and system based on a data model. The method comprises the following steps of: firstly, collecting equipment logs, operation records, medical data access records and alarm information from key nodes of a hospital network, such as network equipment, a server, safety equipment and a medical information system in multiple channels, cleaning, de-weighting and normalizing, and then analyzing network topology, equipment safety, data sensitivity and user behaviors; building a model by using K-means clustering and a support vector machine, and training and optimizing by using historical data; and combining an analytic hierarchy process, vulnerability scanning and time sequence analysis to calculate asset value, vulnerability score and threat possibility, and obtaining a risk level according to a risk matrix method. The system comprises multiple layers of architectures such as data acquisition, processing, model construction, risk assessment decision, display interaction and the like, and the layers cooperate with each other. The system accurately adapts to a hospital network, comprehensively considers medical data characteristics, builds a foundation for hospital network safety management, and protects medical services.

Description

Technical Field

[0001] The present invention relates to the field of hospital network security technology, and more specifically, to a network security risk assessment method and system based on a data model. Background Art

[0002] With the rapid development and widespread application of information technology, hospitals have made significant progress in their informatization efforts. Today, hospitals have extensively deployed a variety of information systems, including hospital information systems (HIS), electronic medical records (EMRs), picture archiving and communication systems (PACS), and laboratory information systems (LIS). The application of these systems has significantly improved hospital management efficiency and the quality of medical services, enabling the electronic storage, transmission, and sharing of medical data.

[0003] In daily hospital operations, these information systems accumulate vast amounts of patient data, including personal identification information, disease diagnoses, treatment plans, and test results. This data is not only a crucial basis for hospital medical decision-making but also a core component of patient privacy. Leakage, tampering, or loss of this data can cause serious harm to patients, potentially leading to privacy breaches, medical fraud, misdiagnosis, and treatment errors, while also damaging the hospital's reputation and credibility.

[0004] The hospital network environment is complex, connecting a large number of medical devices, information systems and end users, and faces multiple security threats from both internal and external sources.

[0005] From an external perspective, hacker attacks are one of the primary threats facing hospital networks. Hackers may exploit network vulnerabilities to infiltrate hospital networks and steal sensitive patient information for illegal transactions or extortion. For example, the global WannaCry ransomware attack in 2017 paralyzed the information systems of multiple hospitals, severely impacting medical services. Furthermore, with the increasing popularity of the internet, hospital networks are increasingly connected to external networks, making them more vulnerable to cyberattacks such as distributed denial of service (DDoS) attacks and man-in-the-middle attacks. These attacks can disrupt hospital network services and disrupt the normal operation of medical services.

[0006] Internally, hospital staff's lack of security awareness and misuse can also lead to security issues. Some employees may carelessly leak login passwords or access sensitive data without authorization. Furthermore, poor management of mobile devices within hospitals, such as employees unauthorizedly connecting to external networks or using unchecked mobile storage devices, can introduce viruses or malware into the hospital network, causing data leaks or system failures.

[0007] To ensure hospital network security, traditional network security risk assessment methods are mainly based on rules and experience, and detect and prevent security threats by setting fixed security policies and thresholds. However, these methods have many limitations.

[0008] On the one hand, traditional methods lack adaptability to the complex and dynamic environments of hospital networks. Equipment and systems within hospital networks are constantly being upgraded, new applications and services are constantly emerging, and the forms and methods of security threats are constantly changing. Traditional rules and thresholds struggle to keep pace with these changes, resulting in some security vulnerabilities remaining undetected and unfixed.

[0009] On the other hand, traditional approaches focus on security assessments of network devices and systems, overlooking the unique and critical nature of medical data. Medical data is highly sensitive and private, and its security requirements differ from those of general data. Traditional approaches often fail to comprehensively assess aspects of medical data, such as access control, encryption, and backup, making it difficult to meet hospitals' security requirements.

[0010] While some network security risk assessment technologies and tools exist, most of them focus on evaluating a single security factor. For example, network vulnerability scanning tools primarily focus on vulnerabilities in network devices and systems, while intrusion detection systems primarily detect abnormal network behavior. These technologies and tools lack comprehensive assessment capabilities for hospital network security and fail to fully consider the impact of multiple factors on network security, including network topology, device security status, data sensitivity, and user behavior patterns.

[0011] Furthermore, existing technologies have shortcomings in the calculation and analysis of risk assessment indicators. The calculation methods for some assessment indicators are overly simplistic, lack scientificity and accuracy, and fail to truly reflect the actual cybersecurity risk situation. Furthermore, existing technologies are also inadequate in terms of visualizing risk assessment results and providing decision support, making it difficult for hospital managers to intuitively understand the cybersecurity situation and make effective decisions.

[0012] To sum up, in order to effectively respond to the security threats faced by hospital networks, ensure the security of medical data and the normal development of hospital business, there is an urgent need for a more scientific, accurate and comprehensive network security risk assessment method and system based on data models. Summary of the Invention

[0013] The present invention aims to address the shortcomings of the prior art and proposes a network security risk assessment method based on a data model, the method comprising the following steps:

[0014] S1, data collection and preprocessing stage:

[0015] Collect network device logs, system operation records, medical data access records, and security device alarm information from the hospital's network devices, servers, and security devices through log collection, interface calls, and data monitoring;

[0016] Clean the collected data to remove duplicate, erroneous and incomplete data; normalize the data. The normalization formula is:

[0017] Where x is the original data value, x min is the minimum value of the feature data, x max It is the maximum value of the feature data, which makes the data from different sources have a unified format and range; it deduplicates the data and eliminates redundant information;

[0018] S2, data model construction stage:

[0019] Analyze the hospital network topology to determine the connection relationship and importance of each node in the network; evaluate the security status of network equipment, including device vulnerabilities and configuration compliance; classify data sensitivity levels based on the type and purpose of medical data; analyze user behavior patterns through clustering algorithms in machine learning, and classify user behavior into normal and abnormal modes. The K-means clustering algorithm is used, whose goal is to minimize the sum of the squares of the distances from each data point to the center of its cluster. The formula is:

[0020] Where k is the number of clusters, C i is the i-th cluster, μ i is the center of the i-th cluster, and x is a data point;

[0021] A network security risk assessment data model is constructed using the support vector machine algorithm, with network topology, device security status, data sensitivity, and user behavior patterns as input features and network security risk level as output.

[0022] Support vector machines use the radial basis kernel function:

[0023] Among them, x i and x j is the input data point, and σ is the bandwidth parameter of the kernel function; the support vector machine model is trained and optimized using historical data, and the model parameters are adjusted to improve the accuracy of the prediction;

[0024] S3, risk assessment indicator calculation stage:

[0025] Based on the analytic hierarchy process, the asset value evaluation index system is determined, taking into account factors such as the procurement cost of hardware equipment, the development cost of the software system, and the privacy value of medical data. By constructing the judgment matrix A = (aij)n*n

[0026] Among them, a ij Indicates the importance of indicator i relative to indicator j, and calculates the value score of each asset; uses the characteristic root method to calculate the maximum characteristic root λ of the judgment matrix max And the corresponding eigenvector W, the normalized eigenvector W is the weight of each indicator;

[0027] Use vulnerability scanning tools to scan network devices and systems, and calculate vulnerability scores based on vulnerability severity information in the vulnerability database.

[0028] Where m is the number of vulnerabilities, w i is the weight of the i-th vulnerability, s i is the severity score of the i-th vulnerability;

[0029] Through time series analysis algorithms, the ARIMA (p, d, q) model is used to analyze historical security event data and network attack trends to predict threat potential;

[0030] The formula of the ARIMA model is, φ(B)(1-B) d y t =θ(B)∈ t

[0031] where φ(B)=1-φ1B-...-φ p B p is an autoregressive polynomial;

[0032] θ(B)=1+θ1B+.....+θ q B q is the moving average polynomial, B is the lag operator, and y t is the time series data, ∈ t It is white noise;

[0033] Based on the asset value A, vulnerability score V and threat probability T, the risk matrix method is used to calculate the risk level R = A*V*T;

[0034] S4, risk assessment report generation stage:

[0035] Based on the calculated risk assessment indicators, a detailed report is generated that includes network security status analysis, identification of major risk points, risk level distribution, and risk response recommendations; the report is visualized to present the assessment results in the form of charts and reports; and the report export and printing functions are supported.

[0036] Preferably, in the data collection and preprocessing stage, log collection adopts a timed task method to collect log data from network devices and servers at preset time intervals; interface calls obtain system operation records and medical data access records by calling the API interface of the hospital information system; data monitoring adopts network sniffing technology to monitor data packets in the network in real time and extract security device alarm information.

[0037] Preferably, in the data model construction stage, the clustering algorithm adopts the K-means clustering algorithm, and updates the cluster center through iteration until the cluster center no longer changes or the maximum number of iterations is reached; the support vector machine algorithm adopts the radial basis kernel function as the kernel function to improve the nonlinear fitting ability of the model.

[0038] Preferably, in the risk assessment index calculation stage, the hierarchical analysis method compares the relative importance of each asset value assessment index by constructing a judgment matrix and using the consistency index and random consistency ratio To test the consistency of the judgment matrix, n is the order of the judgment matrix, and RI is the average random consistency index; the vulnerability scanning tools use Nmap and Nessus tools to perform comprehensive vulnerability scans on network devices and systems; the time series analysis algorithm uses the ARIMA model, and the order p, d, and q of the model are determined by the autocorrelation function (ACF) and partial autocorrelation function (PACF).

[0039] A network security risk assessment system based on a data model, the system comprising:

[0040] Data collection module: collects network device logs, system operation records, medical data access records and security device alarm information from network devices, servers and security devices in the hospital network through log collection, interface calls and data monitoring;

[0041] Data processing module: cleans, removes duplicates and normalizes the collected data using the formula Normalize the data; store the processed data in a database; the database uses a relational database, such as MySQL or PostgreSQL, to facilitate data management and query;

[0042] Data model building module: Analyze the hospital network topology, equipment security status, data sensitivity and user behavior patterns, and use the support vector machine algorithm to build a network security risk assessment data model. The support vector machine uses the radial basis kernel function K-means clustering algorithm is used to analyze user behavior patterns, with the goal of minimizing Use historical data to train and optimize the model.

[0043] Risk assessment calculation module: Calculate asset value based on the hierarchical analysis method, construct the judgment matrix A = (aij)n*n, and use the characteristic root method to calculate the maximum characteristic root λ max And the corresponding eigenvector W determines the indicator weight; use the vulnerability scanning tool to calculate the vulnerability score Through the time series analysis algorithm, the ARIMA (p, d, q) model φ (B) (1-B) is used d y t =θ(B)∈ t Predict threat likelihood; use risk matrix method to calculate risk level R=A*V*T;

[0044] Report generation module: Generates detailed reports based on risk assessment indicators, including network security status analysis, identification of major risk points, risk level distribution, and risk response recommendations; visualizes the reports and supports report export and printing functions.

[0045] Preferably, in the data acquisition module, the log collection submodule collects log data from network devices and servers in a timed task manner; the interface call submodule obtains system operation records and medical data access records by calling the API interface of the hospital information system; the data monitoring submodule uses network sniffing technology to monitor data packets in the network in real time and extract security device alarm information.

[0046] Preferably, in the data model construction module, the cluster analysis submodule adopts K-means clustering algorithm to analyze user behavior patterns; the support vector machine modeling submodule adopts radial basis kernel function as kernel function to construct a network security risk assessment data model.

[0047] Preferably, in the risk assessment calculation module, the hierarchical analysis submodule determines the weight of the asset value assessment index by constructing a judgment matrix, and uses the consistency index and random consistency ratio To test the consistency of the judgment matrix; the vulnerability scanning submodule uses Nmap and Nessus tools to scan vulnerabilities of network devices and systems; the time series analysis submodule uses the ARIMA model to model and predict historical security event data, and determines the order p, d, and q of the model through the autocorrelation function (ACF) and partial autocorrelation function (PACF).

[0048] Preferably, in the report generation module, the visualization submodule uses the Echarts or Highcharts library to visualize the report and display the evaluation results in the form of charts and reports; the export and printing submodule supports exporting the report to PDF, Excel and other formats, and supports printing function.

[0049] Preferably, the system also includes a data storage module for storing collected raw data, processed data, model training data and risk assessment results; the data storage module adopts a distributed file system, such as Hadoop Distributed File System (HDFS), to improve the reliability and scalability of data storage.

[0050] Compared with the existing technology, the beneficial effects of the present invention are:

[0051] 1. Comprehensive and Accurate Data Acquisition: The patented system uses a variety of methods, including log collection, interface calls, and data monitoring, to collect data from multiple sources, including network devices, servers, and security devices within the hospital network. This data collection includes network device logs, system operation records, medical data access records, and security device alarm information. This comprehensive data collection method can fully and accurately reflect the operational status and security status of the hospital network, avoiding risk assessment bias caused by missing data.

[0052] 2. Efficient data preprocessing: Clean, normalize and remove duplicates from the collected data. Cleaning removes duplicate, erroneous and incomplete data to ensure data quality; normalization uses the formula The format and scope of data from different sources are unified to make the data more comparable; the deduplication operation eliminates redundant information, reduces the complexity and computational complexity of data processing, and improves the efficiency of subsequent analysis and modeling.

[0053] 3. Accurate user behavior analysis: Use K-means clustering algorithm to analyze user behavior patterns, and minimize the formula This data-driven analysis method categorizes user behavior into normal and abnormal patterns. It accurately identifies abnormal user behavior and promptly detects potential security threats, such as illegal operations by insiders or infiltration activities by external attackers using legitimate user accounts.

[0054] 4. Powerful nonlinear fitting capability: using support vector machine algorithm and radial basis kernel function The construction of a cybersecurity risk assessment data model effectively addresses the nonlinear relationships inherent in cybersecurity issues. The model uses multi-dimensional information such as network topology, device security status, data sensitivity, and user behavior patterns as input features to output an accurate cybersecurity risk level, improving the accuracy and reliability of risk assessments.

[0055] 5. Scientific asset value assessment: Determine the asset value assessment index system based on the hierarchical analysis method, construct the judgment matrix A = (aij)n*n and use the characteristic root method to calculate the maximum characteristic root λ maxand the corresponding eigenvector W to determine the indicator weights. This approach fully considers multiple factors, including the procurement cost of hardware equipment, the development cost of software systems, and the privacy value of medical data, making asset value assessment more scientific and reasonable and providing accurate basic data for subsequent risk assessments.

[0056] 6. Accurate vulnerability and threat assessment: Use vulnerability scanning tools combined with severity information in the vulnerability database to Calculate the vulnerability score; use the ARIMA (p, d, q) model φ (B) (1-B) d y t =θ(B)∈ t Analyze historical security incident data and network attack trends to predict threat likelihood. These methods can accurately assess the vulnerability of network devices and systems and the level of threats they face, providing comprehensive and accurate information for risk assessment.

[0057] 7. Reasonable risk level calculation: Based on the asset value A, vulnerability score V, and threat likelihood T, the risk level R = A*V*T is calculated using the risk matrix method. This multi-factor risk calculation method can more accurately reflect the actual situation of network security risks and help hospital managers develop targeted risk response strategies.

[0058] 8. Intuitive Risk Display: Generates a detailed report that includes a current network security analysis, identification of key risk points, risk level distribution, and risk response recommendations. The report is then visualized, presenting the assessment results in the form of charts and tables. This intuitive display allows hospital managers to quickly and clearly understand the network security status and promptly identify potential security risks.

[0059] 9. Effective Decision Support: The risk response recommendations in the risk assessment report provide hospital managers with a clear basis for decision-making, helping them formulate appropriate security strategies and measures, such as strengthening access control, updating security patches, and implementing network isolation. Furthermore, the decision support module provides a decision simulation function, enabling managers to simulate different response strategies and assess their impact on network security risks, thereby selecting the optimal decision-making plan and improving the efficiency and effectiveness of hospital network security management.

[0060] 10. High Scalability and Reliability: The system uses a distributed file system (such as HDFS) to store data, improving its reliability and scalability, enabling it to cope with the ever-increasing data volumes and business demands of hospital networks. Furthermore, data exchange and communication between system layers is achieved through interfaces, resulting in a well-designed modular design that facilitates system upgrades and maintenance.

[0061] 11. Real-time monitoring and early warning: The risk warning module sets different levels of risk warning thresholds. When the risk value exceeds the threshold, it can trigger the corresponding level of warning in a timely manner, such as system message prompts, SMS notifications, audio and visual alarms, and emergency email notifications. At the same time, it monitors risk trends in real time. When the risk value rises sharply in a short period of time, it issues an early warning signal in advance, helping hospital managers take timely measures to reduce safety risks.

[0062] 12. User-friendly interactive experience: The display and interaction layer provides a visual display module and a user interaction module. Users can view risk assessment results, submit feedback, query historical data, download risk assessment reports, etc. through an intuitive interface. At the same time, the system provides user login and permission management functions to ensure that users with different permissions have different operation permissions, thus ensuring system security and data confidentiality. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 This is an architecture diagram of a network security risk assessment system based on a data model proposed by the present invention;

[0064] Figure 2 This is a flow chart of a network security risk assessment method based on a data model proposed by the present invention. DETAILED DESCRIPTION

[0065] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0066] Referring to the figure, this embodiment provides a network security risk assessment method based on a data model, the method comprising the following steps:

[0067] S1, data collection and preprocessing stage:

[0068] Collect network device logs, system operation records, medical data access records, and security device alarm information from the hospital's network devices, servers, and security devices through log collection, interface calls, and data monitoring;

[0069] Clean the collected data to remove duplicate, erroneous and incomplete data; normalize the data. The normalization formula is:

[0070] Where x is the original data value, x min is the minimum value of the feature data, x max It is the maximum value of the feature data, which makes the data from different sources have a unified format and range; it deduplicates the data and eliminates redundant information;

[0071] S2, data model construction stage:

[0072] Analyze the hospital network topology to determine the connection relationship and importance of each node in the network; evaluate the security status of network equipment, including device vulnerabilities and configuration compliance; classify data sensitivity levels based on the type and purpose of medical data; analyze user behavior patterns through clustering algorithms in machine learning, and classify user behavior into normal and abnormal modes. The K-means clustering algorithm is used, whose goal is to minimize the sum of the squares of the distances from each data point to the center of its cluster. The formula is:

[0073] Where k is the number of clusters, C i is the i-th cluster, μ i is the center of the i-th cluster, and x is a data point;

[0074] A network security risk assessment data model is constructed using the support vector machine algorithm, with network topology, device security status, data sensitivity, and user behavior patterns as input features and network security risk level as output.

[0075] Support vector machines use the radial basis kernel function:

[0076] Among them, x i and x j is the input data point, and σ is the bandwidth parameter of the kernel function; the support vector machine model is trained and optimized using historical data, and the model parameters are adjusted to improve the accuracy of the prediction;

[0077] S3, risk assessment indicator calculation stage:

[0078] Based on the analytic hierarchy process, the asset value evaluation index system is determined, taking into account factors such as the procurement cost of hardware equipment, the development cost of the software system, and the privacy value of medical data. By constructing the judgment matrix A = (aij)n*n

[0079] Among them, a ij Indicates the importance of indicator i relative to indicator j, and calculates the value score of each asset; uses the characteristic root method to calculate the maximum characteristic root λ of the judgment matrix max And the corresponding eigenvector W, the normalized eigenvector W is the weight of each indicator;

[0080] Use vulnerability scanning tools to scan network devices and systems, and calculate vulnerability scores based on vulnerability severity information in the vulnerability database.

[0081] Where m is the number of vulnerabilities, w iis the weight of the i-th vulnerability, s i is the severity score of the i-th vulnerability;

[0082] Through time series analysis algorithms, the ARIMA (p, d, q) model is used to analyze historical security event data and network attack trends to predict threat potential;

[0083] The formula of the ARIMA model is, φ(B)(1-B) d y t =θ(B)∈ t

[0084] where φ(B)=1-φ1B-...-φ p B p is an autoregressive polynomial;

[0085] θ(B)=1+θ1B+.....+θ q B q is the moving average polynomial, B is the lag operator, and y t is the time series data, ∈ t It is white noise;

[0086] Based on the asset value A, vulnerability score V and threat probability T, the risk matrix method is used to calculate the risk level R = A*V*T;

[0087] S4, risk assessment report generation stage:

[0088] Based on the calculated risk assessment indicators, a detailed report is generated that includes network security status analysis, identification of major risk points, risk level distribution, and risk response recommendations; the report is visualized to present the assessment results in the form of charts and reports; and the report export and printing functions are supported.

[0089] Furthermore, in the data collection and preprocessing stage, log collection adopts a scheduled task method to collect log data from network devices and servers at preset time intervals; interface calls obtain system operation records and medical data access records by calling the API interface of the hospital information system; data monitoring adopts network sniffing technology to monitor data packets in the network in real time and extract security device alarm information.

[0090] Furthermore, in the data model construction phase, the clustering algorithm adopts the K-means clustering algorithm, which updates the cluster center through iteration until the cluster center no longer changes or the maximum number of iterations is reached; the support vector machine algorithm adopts the radial basis kernel function as the kernel function to improve the nonlinear fitting ability of the model.

[0091] Furthermore, in the risk assessment index calculation stage, the hierarchical analysis method constructs a judgment matrix to compare the relative importance of each asset value assessment index and uses the consistency index to and random consistency ratio To test the consistency of the judgment matrix, n is the order of the judgment matrix, and RI is the average random consistency index; the vulnerability scanning tools use Nmap and Nessus tools to perform comprehensive vulnerability scans on network devices and systems; the time series analysis algorithm uses the ARIMA model, and the order p, d, and q of the model are determined by the autocorrelation function (ACF) and partial autocorrelation function (PACF).

[0092] A network security risk assessment system based on a data model, the system comprising:

[0093] Data collection module: collects network device logs, system operation records, medical data access records and security device alarm information from network devices, servers and security devices in the hospital network through log collection, interface calls and data monitoring;

[0094] Data processing module: cleans, removes duplicates and normalizes the collected data using the formula Normalize the data; store the processed data in a database; the database uses a relational database, such as MySQL or PostgreSQL, to facilitate data management and query;

[0095] Data model building module: Analyze the hospital network topology, equipment security status, data sensitivity and user behavior patterns, and use the support vector machine algorithm to build a network security risk assessment data model. The support vector machine uses the radial basis kernel function K-means clustering algorithm is used to analyze user behavior patterns, with the goal of minimizing Use historical data to train and optimize the model.

[0096] Risk assessment calculation module: Calculate asset value based on the hierarchical analysis method, construct the judgment matrix A = (aij)n*n, and use the characteristic root method to calculate the maximum characteristic root λ max And the corresponding eigenvector W determines the indicator weight; use the vulnerability scanning tool to calculate the vulnerability score Through the time series analysis algorithm, the ARIMA (p, d, q) model φ (B) (1-B) is used d y t =θ(B)∈ t Predict threat likelihood; use risk matrix method to calculate risk level R=A*V*T;

[0097] Report generation module: Generates detailed reports based on risk assessment indicators, including network security status analysis, identification of major risk points, risk level distribution, and risk response recommendations; visualizes the reports and supports report export and printing functions.

[0098] Furthermore, in the data acquisition module, the log collection submodule uses a scheduled task method to collect log data from network devices and servers; the interface call submodule obtains system operation records and medical data access records by calling the API interface of the hospital information system; the data monitoring submodule uses network sniffing technology to monitor data packets in the network in real time and extract security device alarm information.

[0099] Furthermore, in the data model construction module, the cluster analysis submodule adopts K-means clustering algorithm to analyze user behavior patterns; the support vector machine modeling submodule adopts radial basis kernel function as kernel function to construct network security risk assessment data model.

[0100] Furthermore, in the risk assessment calculation module, the hierarchical analysis submodule determines the weight of the asset value assessment index by constructing a judgment matrix, using the consistency index and random consistency ratio To test the consistency of the judgment matrix; the vulnerability scanning submodule uses Nmap and Nessus tools to scan vulnerabilities of network devices and systems; the time series analysis submodule uses the ARIMA model to model and predict historical security event data, and determines the order p, d, and q of the model through the autocorrelation function (ACF) and partial autocorrelation function (PACF).

[0101] Furthermore, in the report generation module, the visualization submodule uses the Echarts or Highcharts library to visualize the report and display the evaluation results in the form of charts and reports; the export and printing submodule supports exporting the report to PDF, Excel and other formats, and supports printing functions.

[0102] Furthermore, the system also includes a data storage module for storing collected raw data, processed data, model training data and risk assessment results; the data storage module adopts a distributed file system, such as Hadoop Distributed File System (HDFS), to improve the reliability and scalability of data storage.

[0103] The application cases of the above embodiment in this hospital are as follows:

[0104] 1. System Architecture Expansion and Distributed Data Collection

[0105] Lai* City People's Hospital is a comprehensive, Class-A, Grade-A hospital integrating medical care, teaching, scientific research, emergency care, rehabilitation, and healthcare. It has developed a distributed architecture for a cybersecurity risk assessment system based on data models. A central control center is equipped with a cluster of high-performance servers for centralized management and data aggregation and analysis. Each server is equipped with 64GB of memory, a 16-core CPU, and 10TB of hard disk storage, interconnected by a high-speed fiber optic network. Independent edge computing nodes are deployed in each department, equipped with hardware resources similar to those used in the small and medium-sized specialized hospital described in Example 1. These nodes are responsible for local data collection and preliminary processing.

[0106] At the data collection level, the data collection agent devices of the edge computing nodes of each department establish connections with various heterogeneous network devices, more than 100 network routers, 200 switches, 500 servers, and various brands of medical equipment (such as CT machines with networking capabilities, testing equipment, etc.) within the department through a more complex multi-protocol adaptation mechanism. In addition to the collection method in Example 1, for medical equipment, special data such as equipment operating status, fault information, remote control logs, etc. are collected in real time through the dedicated SDK provided by the equipment manufacturer. The collection frequency varies from 15 minutes to 2 hours depending on the criticality and stability requirements of the equipment. At the same time, a dedicated VPN tunnel is used across departments to ensure the secure transmission of data to the main control center.

[0107] 2. Multi-level Data Processing and Fusion Model Construction

[0108] The data collected by each department is first cleaned, deduplicated, and normalized at the local edge computing node. The processing flow is similar to that of Example 1, but differentiated outlier detection thresholds and data normalization parameters are set based on the network characteristics and business differences of different departments. For example, for departments with large fluctuations in network traffic, the outlier detection thresholds for traffic data are set relatively loosely to accommodate the traffic changes caused by their normal business peaks and troughs. Part of the processed data is stored in the department's local MySQL database as a local backup, and the other part is synchronized in real time to the HDFS of the control center.

[0109] At the central control center, data from various departments undergoes secondary fusion processing. Using clustering algorithms from machine learning, data of the same type from different departments is clustered and analyzed to identify common and differentiating features, further removing redundant cross-departmental information. Simultaneously, based on the network topology and business processes of the entire department, a higher-dimensional feature engineering approach is reconstructed, comprehensively considering factors such as network interconnectivity between departments and the frequency of data interaction. Over 10 new features are added for model construction. On this basis, a hybrid model is constructed using convolutional neural networks (CNNs) in deep learning combined with long-short-term memory networks (LSTMs) to adapt to the nonlinear and temporal security risk characteristics of large-scale, multi-departmental complex network environments. The model training process uses the Adam optimization algorithm, trained on six months of historical data from all departments. After multiple rounds of hyperparameter tuning, the learning rate is determined to be 0.001, the number of iterations is 500, and the batch size is 128.

[0110] III. Refined Risk Assessment and Collaborative Early Warning

[0111] Risk assessment and decision-making are run in a unified manner at the central control center. Asset value assessment uses a more sophisticated hierarchical analysis method to construct a 5×5 judgment matrix, incorporating more considerations, such as the differences in business importance between different departments and the sensitivity of cross-departmental sharing of medical data, to redefine asset value weights. Vulnerability score calculations rely not only on local vulnerability scanning but also on a department-wide vulnerability intelligence sharing platform to obtain the latest vulnerability information in real time and comprehensively assess the vulnerability of the entire hospital's network equipment and systems. Threat probability predictions are based on a joint historical security event database across multiple departments, using an improved ARIMA-GARCH model that takes into account the volatility and clustering of security events to more accurately predict potential threats. Finally, a unified risk level for the entire department is calculated using the risk matrix method.

[0112] The risk warning module has established a cross-department collaborative warning mechanism. In addition to the warning method in Example 1, when a high-risk event occurs in a department, the warning information will not only notify the relevant personnel of the department, but will also be pushed to the information department and emergency management team of other departments, so that risk information can be shared throughout the hospital. In addition, differentiated emergency response plans are formulated based on the emergency response capabilities and resource allocation of different departments. For example, for main departments with stronger technical strength, preliminary risk investigation and emergency response measures are required to be completed within 1 hour; and for sub-departments with relatively weak technology, the main control center can remotely assist and guide emergency operations to ensure that the network security risks of the entire hospital are responded to in a timely and effective manner.

[0113] 4. Department-wide visualization and interactive decision support

[0114] The display and interaction layer creates a unified visualization platform for the entire department. Using a visualization interface developed with the Highcharts library, network security risk views can be switched in real time across different departments, departments, and systems. For example, a map visualizes the risk heat distribution of each department, allowing managers to intuitively see which department has the highest risk. For key medical business processes, such as remote consultations and surgical anesthesia information management systems, detailed business process risk maps are drawn, marking the risk points and risk levels for each link. Interactive risk investigation tools are also provided, allowing managers to click on risk points to view detailed risk assessment basis, relevant data details, and recommended response strategies.

[0115] In terms of user interaction, a unified user identity authentication and permission management system is implemented throughout the hospital. Managers, medical staff, and technical personnel at all levels are assigned different permissions based on their job roles. Senior hospital leaders can use a customized mobile app to receive key risk warning information from all departments anytime, anywhere. They can hold video conferences with a single click, communicate and coordinate remotely with emergency response teams in each department, and quickly make decisions and deploy risk response actions. Lower-level technical personnel can receive detailed task work orders on their computers, such as vulnerability remediation instructions and equipment inspection tasks. Upon completion, they can provide online feedback. The system automatically records task execution and generates operation and maintenance reports, providing data support for subsequent network security management optimization.

[0116] The above specific embodiments further illustrate the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, can make equivalent replacements or changes based on the technical solutions and inventive concepts of the present invention, which should be covered by the scope of protection of the present invention.

[0117] In addition, in the description of the present invention, it should be understood that the terms indicating orientation or positional relationships are based on the orientation or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0118] Furthermore, in the present invention, unless otherwise expressly specified or limited, terms such as "mounted," "connected," "connect," and "fixed" should be understood broadly. For example, they may refer to fixed or detachable connections, or integration; mechanical or electrical connections; direct or indirect connections through an intermediate medium; and internal communication between two components or interaction between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.

Claims

1. A network security risk assessment method based on a data model, characterized in that: The method comprises the following steps: S1, data collection and preprocessing stage: Collect network device logs, system operation records, medical data access records, and security device alarm information from the hospital's network devices, servers, and security devices through log collection, interface calls, and data monitoring; Clean the collected data to remove duplicate, erroneous and incomplete data; normalize the data. The normalization formula is: Where x is the original data value, x min is the minimum value of the feature data, x max It is the maximum value of the feature data, which makes the data from different sources have a unified format and range; it deduplicates the data and eliminates redundant information; S2, data model construction stage: Analyze the hospital network topology to determine the connection relationship and importance of each node in the network; evaluate the security status of network equipment, including device vulnerabilities and configuration compliance; classify data sensitivity levels based on the type and purpose of medical data; analyze user behavior patterns through clustering algorithms in machine learning, and classify user behavior into normal and abnormal modes. The K-means clustering algorithm is used, whose goal is to minimize the sum of the squares of the distances from each data point to the center of its cluster. The formula is: Where k is the number of clusters, C i is the i-th cluster, μ i is the center of the i-th cluster, and x is a data point; A network security risk assessment data model is constructed using the support vector machine algorithm, with network topology, device security status, data sensitivity, and user behavior patterns as input features and network security risk level as output. Support vector machines use the radial basis kernel function: Among them, x i and x j is the input data point, and σ is the bandwidth parameter of the kernel function; the support vector machine model is trained and optimized using historical data, and the model parameters are adjusted to improve the accuracy of the prediction; S3, risk assessment indicator calculation stage: Based on the analytic hierarchy process, the asset value evaluation index system is determined, taking into account factors such as the procurement cost of hardware equipment, the development cost of the software system, and the privacy value of medical data. By constructing the judgment matrix A = (aij)n*n Among them, a ij Indicates the importance of indicator i relative to indicator j, and calculates the value score of each asset; uses the characteristic root method to calculate the maximum characteristic root λ of the judgment matrix max And the corresponding eigenvector W, the normalized eigenvector W is the weight of each indicator; Use vulnerability scanning tools to scan network devices and systems, and calculate vulnerability scores based on vulnerability severity information in the vulnerability database. Where m is the number of vulnerabilities, w i is the weight of the i-th vulnerability, s i is the severity score of the i-th vulnerability; Through time series analysis algorithms, the ARIMA (p, d, q) model is used to analyze historical security event data and network attack trends to predict threat potential; The formula of the ARIMA model is, φ(B)(1-B) d y t =θ(B)∈ t where φ(B)=1-φ1B-...-φ p B p is an autoregressive polynomial; θ(B)=1+θ1B+.....+θ q B q is the moving average polynomial, B is the lag operator, and y t is the time series data, ∈ t It is white noise; Based on the asset value A, vulnerability score V and threat probability T, the risk matrix method is used to calculate the risk level R = A*V*T; S4, risk assessment report generation stage Based on the calculated risk assessment indicators, a detailed report is generated that includes network security status analysis, identification of major risk points, risk level distribution, and risk response recommendations; the report is visualized to present the assessment results in the form of charts and reports; and the report export and printing functions are supported.

2. The network security risk assessment method based on data model according to claim 1 is characterized in that: During the data collection and preprocessing stage, log collection adopts a scheduled task method to collect log data from network devices and servers at preset time intervals; interface calls obtain system operation records and medical data access records by calling the API interface of the hospital information system; data monitoring adopts network sniffing technology to monitor data packets in the network in real time and extract security device alarm information.

3. The network security risk assessment method based on data model according to claim 1 is characterized in that: During the data model construction phase, the clustering algorithm adopts the K-means clustering algorithm, and the cluster center is updated through iteration until the cluster center no longer changes or the maximum number of iterations is reached; the support vector machine algorithm adopts the radial basis kernel function as the kernel function to improve the nonlinear fitting ability of the model.

4. The network security risk assessment method based on data model according to claim 1 is characterized in that: In the risk assessment index calculation stage, the hierarchical analysis method compares the relative importance of each asset value assessment index by constructing a judgment matrix and using the consistency index and random consistency ratio To test the consistency of the judgment matrix, n is the order of the judgment matrix, and RI is the average random consistency index; the vulnerability scanning tools use Nmap and Nessus tools to perform comprehensive vulnerability scans on network devices and systems; the time series analysis algorithm uses the ARIMA model, and the order p, d, and q of the model are determined by the autocorrelation function (ACF) and partial autocorrelation function (PACF).

5. A network security risk assessment system based on a data model, characterized in that: The system comprises: Data collection module: collects network device logs, system operation records, medical data access records and security device alarm information from network devices, servers and security devices in the hospital network through log collection, interface calls and data monitoring; Data processing module: cleans, removes duplicates and normalizes the collected data using the formula Normalize the data; store the processed data in a database; the database adopts a relational database to facilitate data management and query; Data model building module: Analyze the hospital network topology, equipment security status, data sensitivity and user behavior patterns, and use the support vector machine algorithm to build a network security risk assessment data model. The support vector machine uses the radial basis kernel function K-means clustering algorithm is used to analyze user behavior patterns, with the goal of minimizing Use historical data to train and optimize models; Risk assessment calculation module: Calculate asset value based on the hierarchical analysis method, construct the judgment matrix A = (aij)n*n, and use the characteristic root method to calculate the maximum characteristic root λ max And the corresponding eigenvector W determines the indicator weight; use the vulnerability scanning tool to calculate the vulnerability score Through the time series analysis algorithm, the ARIMA (p, d, q) model φ (B) (1-B) is used d y t =θ(B)∈ t Predict threat likelihood; use risk matrix method to calculate risk level R=A*V*T; Report generation module: Generates detailed reports based on risk assessment indicators, including network security status analysis, identification of major risk points, risk level distribution, and risk response recommendations; visualizes the reports and supports report export and printing functions.

6. The network security risk assessment system based on data model according to claim 5 is characterized in that: In the data acquisition module, the log collection submodule collects log data from network devices and servers in a timed task manner; the interface call submodule obtains system operation records and medical data access records by calling the API interface of the hospital information system; The data monitoring submodule uses network sniffing technology to monitor data packets in the network in real time and extract alarm information from security devices.

7. The network security risk assessment system based on data model according to claim 5, characterized in that: In the data model construction module, the cluster analysis submodule adopts K-means clustering algorithm to analyze user behavior patterns; the support vector machine modeling submodule adopts radial basis kernel function as kernel function to construct a network security risk assessment data model.

8. The network security risk assessment system based on data model according to claim 5, characterized in that: In the risk assessment calculation module, the hierarchical analysis submodule determines the weight of the asset value assessment index by constructing a judgment matrix and using the consistency index and random consistency ratio To verify the consistency of the judgment matrix; the vulnerability scanning submodule uses Nmap and Nessus tools to scan vulnerabilities of network devices and systems; The time series analysis submodule uses the ARIMA model to model and predict historical security event data, and determines the order p, d, and q of the model through the autocorrelation function (ACF) and partial autocorrelation function (PACF).

9. The network security risk assessment system based on data model according to claim 5, characterized in that: In the report generation module, the visualization submodule uses the Echarts or Highcharts library to visualize the report and present the evaluation results in the form of charts and reports; the export and printing submodule supports exporting the report to PDF, Excel and other formats, and supports printing function.

10. The data model-based network security risk assessment system according to any one of claims 5 to 9, characterized in that: The system also includes a data storage module for storing collected raw data, processed data, model training data and risk assessment results; the data storage module adopts a distributed file system to improve the reliability and scalability of data storage.

Images