Medical anti-statistic behavior monitoring method based on deep learning

Abstract

The invention relates to the technical field of medical data supervision and safety. The medical anti-statistic behavior monitoring method based on deep learning comprises the following steps: performing multi-source heterogeneous data acquisition on hospital anti-statistic system data, database audit data and access control data to obtain an original operation log set; performing feature fusion and standardization processing based on the original operation log set to generate a multi-dimensional time sequence feature matrix; constructing a deep belief network model based on the multi-dimensional time sequence feature matrix, and generating a statistical behavior risk scoring model through hierarchical pre-training and fine tuning; performing cross validation and dynamic parameter adjustment by using the annotation data set based on the statistical behavior risk scoring model, and generating an optimized risk grading model; and deploying the optimized risk grading model to a hospital database auditing system, and generating a real-time monitoring and early warning signal so as to achieve the technical effects of improving the monitoring efficiency and accuracy and preventing privacy leakage.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of medical data supervision and security, and particularly relates to a medical anti-uniform prescription behavior monitoring method based on deep learning. BACKGROUND

[0002] With the continuous development of artificial intelligence, medical data security plays an increasingly important role in the daily operation of medical institutions. The supervision of uniform prescription behavior is one of the key steps and is also the focus and difficulty of medical field research. The purpose of effective uniform prescription behavior supervision is to protect the safety of medical insurance funds and the privacy of patients.

[0003] In the traditional technology, the anti-uniform prescription supervision mainly relies on manual auditing of database operation logs and prescription records, but this method has the problems of low efficiency, high missed detection rate and insufficient data processing capacity. Furthermore, some schemes attempt to detect risks through rule engines or shallow neural networks, but the runtime performance will decrease as attack methods continue to change. In addition, traditional technologies often ignore privacy protection issues, which may leak patient privacy or doctor prescription habits when cross-hospital data is jointly trained. SUMMARY

[0004] Therefore, it is necessary to provide a deep learning medical anti-uniform prescription behavior monitoring method to improve monitoring efficiency and accuracy and prevent privacy leakage in view of the above technical problems.

[0005] The present application provides a medical anti-uniform prescription behavior monitoring method based on deep learning, comprising:

[0006] Multi-source heterogeneous data collection is performed on hospital anti-uniform prescription system data, database audit data and access control data to obtain an original operation log set;

[0007] Feature fusion and standardization processing are performed based on the original operation log set to generate a multi-dimensional time series feature matrix;

[0008] A deep belief network model is constructed based on the multi-dimensional time series feature matrix, and a uniform prescription behavior risk scoring model is generated through hierarchical pre-training and fine-tuning;

[0009] Based on the uniform prescription behavior risk scoring model, cross-validation and dynamic parameter adjustment are performed using a labeled data set to generate an optimized risk grading model;

[0010] The optimized risk grading model is deployed to the hospital database audit system to generate real-time monitoring and early warning signals.

[0011] Further, the optimized risk grading model is deployed to the hospital database audit system to generate real-time monitoring and early warning signals, comprising:

[0012] The optimized risk grading model is converted by a lightweight inference engine to generate an embedded monitoring module;

[0013] Based on the embedded monitoring module, the database operation log stream of the hospital database audit system is captured in real time by a bypass monitoring method to generate a risk score signal;

[0014] Based on the risk score signal, a hierarchical alarm is triggered to generate a real-time monitoring and early warning signal.

[0015] Further, based on the risk score signal, a hierarchical alarm is triggered to generate a real-time monitoring and early warning signal, comprising:

[0016] The high-risk scoring operation in the risk score signal generates an operation trajectory graph, which is used to trigger a high-risk operation interception instruction;

[0017] The medium-risk scoring operation in the risk score signal triggers a secondary identity authentication process to generate a dynamic verification token;

[0018] The low-risk scoring operation in the risk score signal generates an audit summary report;

[0019] Based on the operation trajectory graph, the dynamic verification token and the audit summary report, a real-time monitoring and early warning signal is generated.

[0020] Further, based on the unified behavior risk scoring model, cross-validation and dynamic parameter adjustment are performed using a labeled data set to generate an optimized risk grading model, comprising:

[0021] Based on the historical event label, a training set and a validation set are divided to generate a stratified sampling data set;

[0022] Based on the stratified sampling data set, the accuracy and recall rate of the unified behavior risk scoring model are calculated by ten-fold cross-validation to generate performance evaluation indicators;

[0023] Based on the performance evaluation indicators, the number of hidden layer nodes and the learning rate parameters are dynamically adjusted to generate an optimized risk grading model.

[0024] Further, based on the multi-dimensional time series feature matrix, a deep belief network model is constructed, and a unified behavior risk scoring model is generated by hierarchical pre-training and fine-tuning, comprising:

[0025] Based on the multi-dimensional time series feature matrix, a deep belief network initial model including multiple layers of restricted Boltzmann machines is constructed;

[0026] The deep belief network initial model is pre-trained by the contrastive divergence algorithm to generate a pre-trained model;

[0027] A Softmax classifier is added to the top layer of the pre-trained model, and supervised fine-tuning is performed through the back-propagation algorithm to generate a unified behavior risk scoring model.

[0028] Furthermore, the initial model of the deep belief network is unsupervisedly pre-trained using the contrastive divergence algorithm to generate a pre-trained model, which also includes:

[0029] Based on the initial model of the deep belief network, the weight matrix between the input layer and the first hidden layer is initialized with Gaussian distribution to generate an initial weight matrix;

[0030] Based on the initialized weight matrix, the neuron states of the visible layer and the hidden layer are iteratively updated through Gibbs sampling until the reconstruction error converges and the converged weight coefficient is generated;

[0031] Freeze the trained layer weights based on the converged weight coefficients, and stack new restricted Boltzmann machines layer by layer to generate a pre-trained model.

[0032] Furthermore, feature fusion and standardization are performed based on the original operation log set to generate a multi-dimensional time series feature matrix, including:

[0033] Perform data cleansing on the original operation log set, removes duplicate logs and invalid fields, fills in missing values, and generates a cleaned log set;

[0034] Based on the cleaned log set, the unstructured text operation description is standardized and encoded to generate vectorized features;

[0035] Based on vectorized features, the association between user roles, operation types and access content is analyzed to generate a multi-dimensional time series feature matrix.

[0036] Furthermore, we conduct correlation analysis between user roles, operation types, and access content based on vectorized features to generate a multi-dimensional time series feature matrix, including:

[0037] Define an operation behavior whitelist based on user role permissions and generate role-operation mapping rules;

[0038] The operation sequence of continuous time periods is intercepted by sliding windows to generate time series correlation features;

[0039] The role-operation mapping rules and the time series correlation features are matrix concatenated to generate a multi-dimensional time series feature matrix.

[0040] Furthermore, we collected multi-source heterogeneous data from the hospital's anti-prescription system data, database audit data, and access control data to obtain a set of original operation logs, including:

[0041] Obtain historical suspected unified prescription behavior records and processed event label data from the hospital's anti-unified prescription system to generate a first data subset;

[0042] Based on the first data subset, the drug consumption access log is extracted from the database audit system to generate a second data subset;

[0043] Based on the first data subset and the second data subset, the user role permission and device authentication information are collected from the access control system to generate a third data subset;

[0044] The first data subset, the second data subset and the third data subset are merged to generate an original operation log set.

[0045] Further, the method further comprises:

[0046] Based on the federated learning framework, the optimized risk grading model of the multiple hospital nodes is jointly trained to generate a global monitoring model.

[0047] The technical scheme provided by the present application includes the following technical effects: by providing a medical anti-unified prescription behavior monitoring method based on deep learning, including: collecting hospital anti-unified prescription system data, database audit data and access control data to obtain an original operation log set; based on the original operation log set, feature fusion and standardization processing are performed to generate a multi-dimensional time series feature matrix; based on the multi-dimensional time series feature matrix, a deep belief network model is constructed, and a unified prescription behavior risk scoring model is generated through hierarchical pre-training and fine-tuning; based on the unified prescription behavior risk scoring model, a labeled data set is used for cross-validation and dynamic parameter adjustment to generate an optimized risk grading model; the optimized risk grading model is deployed to the hospital database audit system to generate real-time monitoring and early warning signals, so as to improve the monitoring efficiency and accuracy and prevent privacy leakage. BRIEF DESCRIPTION OF DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed in the embodiment or related art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creating any creative labor.

[0049] Figure 1 A flowchart of a medical anti-unified prescription behavior monitoring method based on deep learning in an embodiment of the present application;

[0050] Figure 2 A flowchart for generating real-time monitoring and early warning signals based on risk score signal triggered grading alarm in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the above-mentioned purposes, features and advantages of the present application more apparent, specific embodiments of the present application are described in detail below with reference to the accompanying drawings. In the following description, a large number of specific details are set forth in order to provide a sufficient understanding of the present application. However, the present application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without departing from the scope of the application, so the present application is not limited to the specific embodiments disclosed below.

[0052] As shown in Figure 1 The present application provides a medical anti-uniform prescription behavior monitoring method based on deep learning, comprising:

[0053] S101: Multi-source heterogeneous data collection is performed on hospital anti-uniform prescription system data, database audit data and access control data to obtain an original operation log set.

[0054] Specifically, hospital anti-uniform prescription system data collection: connect the anti-uniform prescription system inside the hospital, access the database through the data interface or directly, obtain the historical suspected uniform prescription behavior records, including operation time, operator, operation content and other detailed information, collect the label data of the processed events at the same time, which are used as annotation information for subsequent model training, and arrange the above data into a first data subset. Database audit data collection: access the database audit system of the hospital, extract the drug use access log from it, which records the query and use of the drug use by doctors or other medical personnel when prescribing, including access time, access identity, accessed drug information and use, etc., and take these data as a second data subset.

[0055] Access control data collection: collect user role permissions and device authentication information from the access control system of the hospital, and clearly define the roles, permission ranges and device authentication records of different users, combine this part of data with the above two parts of data to generate a third data subset. Data merging and preliminary processing: merge the first data subset, the second data subset and the third data subset, and preliminarily arrange the merged data, such as unifying the data format, checking the data integrity, etc., and then obtain the original operation log set, which provides basic data for subsequent feature fusion and standardization processing.

[0056] S102: Feature fusion and standardization processing based on the original operation log set to generate a multi-dimensional time series feature matrix.

[0057] Specifically, the original operation log set is cleaned to remove duplicate log entries and invalid fields, such as logs missing key information, while reasonable filling of missing values is performed, such as using the mean, median or predicted value based on other related features, to generate a cleaned log set. Based on the cleaned log set, for unstructured text operation descriptions such as operation notes, doctor's diagnosis and other text information, standardization coding is performed, which can use natural language processing techniques to convert them into vectorized features, such as through bag-of-words model, TF-IDF or text embedding method, to generate corresponding numerical feature vectors. Based on the vectorized features, association analysis of user roles, operation types and access content is performed.

[0058] According to the user role permission, an operation behavior whitelist is defined to clearly define the normal operation range of different roles, and a role-operation mapping rule is generated. Then, the operation sequence in a continuous time period is intercepted through the sliding window technology to capture the time sequence correlation of the operation behavior, and a time sequence correlation feature is generated. Then, the role-operation mapping rule and the time sequence correlation feature are processed by matrix splicing, and the features of different dimensions are arranged and combined in time sequence to form a complete multi-dimensional time sequence feature matrix, wherein each row represents the operation features of a time point, and each column represents a specific feature dimension, such as user role feature, operation type feature, access content feature, etc., to comprehensively depict the multi-dimensional time sequence characteristics of medical operation behavior and provide structured feature input for subsequent deep learning model training.

[0059] S103: Construct a deep belief network model based on the multi-dimensional time sequence feature matrix, and generate a unified behavior risk scoring model through hierarchical pre-training and fine-tuning.

[0060] Specifically, based on the multi-dimensional time sequence feature matrix, a deep belief network initial model containing multiple layers of restricted Boltzmann machines is constructed, each layer of restricted Boltzmann machine is composed of a visible layer and a hidden layer, and the neurons are fully connected, the initial weight matrix is randomly initialized through Gaussian distribution, which lays a foundation for model training. The contrast divergence algorithm is used to pre-train the deep belief network initial model in an unsupervised manner, and the network parameters are trained layer by layer.

[0061] First, fix the parameters of the previous layer, train the weight matrix of the current layer, and update the neuron states of the visible layer and the hidden layer through Gibbs sampling to minimize the reconstruction error until the model converges, obtaining a pre-trained model. This process can effectively extract high-level feature representations from the data. Add a softmax classifier on the top layer of the pre-trained model to convert the entire model into a supervised learning model. Then, use the labeled data set to fine-tune the model parameters through the backpropagation algorithm. Adjust the weights and biases in the network to enable the model to output a probability distribution corresponding to the unified behavior risk. Then generate a unified behavior risk scoring model for risk assessment of new operation logs. During the fine-tuning process, continuously monitor performance indicators such as accuracy, recall rate, and F1 score, and adjust and optimize the model structure or training parameters as needed to ensure the model has good generalization ability and risk prediction accuracy to meet the actual application requirements of medical anti-unified behavior monitoring.

[0062] S104: Based on the unified behavior risk scoring model, cross-validation and dynamic parameter adjustment are performed using the labeled data set to generate an optimized risk classification model.

[0063] Specifically, based on historical event labels, the labeled data set is divided into a training set and a validation set. A stratified sampling strategy is used to ensure that samples of each risk level are proportionally distributed in the training set and the validation set, generating a stratified sampling data set to prepare for subsequent cross-validation. Based on the stratified sampling data set, the ten-fold cross-validation method is used to divide the data set into ten parts. Each time, one of them is used as the validation set, and the remaining nine are used as the training set. The unified behavior risk scoring model is trained and validated. This process is repeated ten times, each time using a different validation set. The accuracy and recall rate of the model in each validation are calculated, and the average value is taken to generate performance evaluation indicators to comprehensively measure the performance of the model. According to the performance evaluation indicators, the number of hidden layer nodes and the learning rate parameters of the model are dynamically adjusted. For example, if the accuracy is low and the recall rate is high, the number of hidden layer nodes can be increased to improve the model's expression ability. If the model is overfitting, the learning rate can be appropriately reduced to stabilize the training process. Through continuous trial and error and validation, an optimized risk classification model is generated to achieve the best performance in the risk prediction task and improve the accuracy and reliability of the monitoring.

[0064] S105: Deploy the optimized risk classification model to the hospital database audit system to generate real-time monitoring and early warning signals.

[0065] Specifically, the optimized risk grading model is converted by a lightweight inference engine, the model structure is simplified, redundant parameters and calculation layers are removed, and an efficient embedded monitoring module is generated, which can quickly respond to real-time data processing needs while ensuring the compatibility and portability of the model in new environments. Based on the embedded monitoring module, a bypass monitoring method is used to capture the database operation log stream of the hospital database audit system in real time. The captured operation log data is preprocessed according to the model input requirements, including data format adjustment, feature extraction, etc., and then input into the risk grading model to quickly generate a risk score signal, reflecting the risk level of the current operation in real time. According to the numerical value of the risk score signal, the corresponding graded alarm mechanism is triggered according to the preset risk level threshold. For high-risk score operations, an operation trajectory map is generated to record detailed information such as the operation process, involved objects, and associated personnel, which serves as the basis for triggering high-risk operation interception instructions; for medium-risk score operations, a secondary identity authentication process is started to generate a dynamic verification token, enhancing the security of the operation; for low-risk score operations, an audit summary report is generated to facilitate subsequent audits and analysis. Then, the operation trajectory map, dynamic verification token, and audit summary report are integrated to form a complete real-time monitoring and early warning signal, which is fed back to the relevant management personnel and security system of the hospital, achieving real-time monitoring and rapid response to unified prescription behavior risks.

[0066] The technical scheme provided by the present application includes the following technical effects: by providing a medical anti-unified prescription behavior monitoring method based on deep learning, including: collecting multi-source heterogeneous data of hospital anti-unified prescription system data, database audit data and access control data to obtain an original operation log set; performing feature fusion and standardization processing based on the original operation log set to generate a multi-dimensional time series feature matrix; constructing a deep belief network model based on the multi-dimensional time series feature matrix, and generating a unified prescription behavior risk scoring model through hierarchical pre-training and fine-tuning; using a labeled data set to perform cross-validation and dynamic parameter adjustment based on the unified prescription behavior risk scoring model to generate an optimized risk grading model; deploying the optimized risk grading model to the hospital database audit system to generate real-time monitoring and early warning signals, thereby achieving the technical effects of improving monitoring efficiency and accuracy and preventing privacy leakage.

[0067] Further, the optimized risk grading model is deployed to the hospital database audit system to generate real-time monitoring and early warning signals, including:

[0068] Converting the optimized risk grading model by a lightweight inference engine to generate an embedded monitoring module;

[0069] Based on the embedded monitoring module, the database operation log stream of the hospital database audit system is captured in real time through a bypass monitoring method to generate a risk score signal;

[0070] Based on the risk score signal, a hierarchical alarm is triggered, and a real-time monitoring and early warning signal is generated.

[0071] Specifically, the optimized risk grading model is converted by a lightweight inference engine, the model structure is simplified, redundant parameters and calculation layers are removed, and an efficient embedded monitoring module is generated to ensure the compatibility and portability of the model in a new environment. Based on the embedded monitoring module, a bypass monitoring method is used to capture the database operation log stream of the hospital database audit system in real time. The captured operation log data is preprocessed according to the model input requirements, including data format adjustment, feature extraction, etc., and then input into the risk grading model to quickly generate a risk score signal, which reflects the risk level of the current operation in real time. According to the numerical value of the risk score signal, a corresponding hierarchical alarm mechanism is triggered according to the preset risk level threshold. For high-risk score operations, an operation trajectory atlas is generated to record detailed information such as operation process, involved objects and associated personnel, which serves as the basis for triggering high-risk operation interception instructions; for medium-risk score operations, a secondary identity authentication process is started to generate a dynamic verification token to enhance the security of the operation; for low-risk score operations, an audit summary report is generated to facilitate subsequent audit and analysis. Then, the operation trajectory atlas, dynamic verification token and audit summary report are integrated to form a complete real-time monitoring and early warning signal, which is fed back to the relevant management personnel and security system of the hospital in a timely manner, realizing real-time monitoring and rapid response to unified behavior risk.

[0072] In one embodiment, as shown in FIG. 1, based on the risk score signal, a hierarchical alarm is triggered, and a real-time monitoring and early warning signal is generated, including: Figure 2

[0073] S201: Generating an operation trajectory atlas for high-risk score operations in the risk score signal, and the operation trajectory atlas is used to trigger high-risk operation interception instructions.

[0074] Specifically, for operations in the risk score signal that are judged to be high-risk score, a detailed operation trajectory atlas is automatically generated. The atlas comprehensively records the entire process of high-risk operations, including the initiator of the operation, the operation time, the involved database tables, fields, and specific operation content, and other key information. By analyzing the operation trajectory atlas, the entire process of high-risk operations can be clearly restored, providing a strong basis for subsequent safety analysis and responsibility tracing. At the same time, the operation trajectory atlas directly triggers high-risk operation interception instructions, and the hospital database audit system receives the instructions and immediately takes measures to intercept the ongoing high-risk operations, preventing possible unified behavior from posing a serious threat to the safety of medical insurance funds and patient privacy.

[0075] ​S202: Trigger a secondary identity authentication process for the medium risk score in the risk score signal, and generate a dynamic verification token.

[0076] Specifically, for the operation with a medium risk score in the risk score signal, a secondary identity authentication process is triggered. In this process, the operator needs to provide additional identity verification information to further confirm the legitimacy and authenticity of the operation, and generate a dynamic verification token. This token is unique and time-limited, usually generated using encryption algorithms to ensure it is difficult to crack and counterfeit. The operator must enter this dynamic verification token, and only after verification is passed can the relevant operation continue, effectively reducing the potential risks of medium-risk operations and enhancing the security of the operation.

[0077] S203: Generate an audit summary report for the low-risk score operation in the risk score signal.

[0078] Specifically, for the low-risk score operation in the risk score signal, an audit summary report is generated. The audit summary report summarizes the key information of the low-risk operation, such as the operator, operation time, operation type, and data range involved, so that subsequent auditors can quickly understand and review the basic situation of the above operation. Although low-risk operations have a low risk level, generating an audit summary report can still effectively record and supervise these operations, ensuring that all operations are traceable and further improving the medical prescription behavior monitoring system.

[0079] S204: Based on the operation trajectory graph, dynamic verification token and audit summary report, generate real-time monitoring and early warning signals.

[0080] Specifically, after completing the corresponding processing of high-risk, medium-risk and low-risk operations, integrate operation trajectory graph, dynamic verification token and audit summary report, etc. to generate the final real-time monitoring and early warning signal. This early warning signal contains detailed information about various risk operations in the current database operation log stream and the corresponding measures taken, and is presented to the relevant management personnel and security system of the hospital in an intuitive manner. Through real-time monitoring and early warning signals, the hospital can timely grasp the overall risk situation of database operations, quickly respond and make decisions, achieve dynamic monitoring and effective management of prescription behavior risks, and effectively protect the safety of medical insurance funds and the confidentiality of patient privacy.

[0081] Further, based on the prescription behavior risk scoring model, cross-validation and dynamic parameter adjustment are performed using the labeled data set to generate an optimized risk grading model, including:

[0082] Based on the historical event label, the training set and the validation set are divided to generate a stratified sampling data set;

[0083] Based on the stratified sampling dataset, the accuracy and recall of the unified party behavior risk score model are calculated through ten-fold cross-validation to generate performance evaluation indicators;

[0084] Based on the performance evaluation indicators, the number of hidden layer nodes and the learning rate parameters are dynamically adjusted to generate an optimized risk classification model.

[0085] Specifically, based on historical event labels, the labeled dataset is divided into a training set and a validation set, and a stratified sampling strategy is used to ensure that samples of each risk level are proportionally distributed in the training set and the validation set, generating a stratified sampling dataset to prepare for subsequent cross-validation. Based on the stratified sampling dataset, the ten-fold cross-validation method is used to divide the dataset into ten parts, each time using one as the validation set and the remaining nine as the training set to train and validate the unified party behavior risk score model. The process is repeated ten times, each time using a different validation set to calculate the accuracy and recall of the model in each validation, and then taking the average to generate performance evaluation indicators to comprehensively measure the performance of the model. According to the performance evaluation indicators, the number of hidden layer nodes and the learning rate parameters of the model are dynamically adjusted. For example, if the accuracy is low and the recall is high, the number of hidden layer nodes can be increased to improve the model's expression ability; if the model is overfitting, the learning rate can be appropriately reduced to stabilize the training process. Through continuous trial and error and verification, an optimized risk classification model is generated to achieve the best performance in the risk prediction task, improving the accuracy and reliability of monitoring.

[0086] Further, based on the multi-dimensional time series feature matrix, a deep belief network model is constructed, and a unified party behavior risk score model is generated through stratified pre-training and fine-tuning, including:

[0087] Based on the multi-dimensional time series feature matrix, a deep belief network initial model including multiple layers of restricted Boltzmann machines is constructed;

[0088] The deep belief network initial model is pre-trained unsupervisedly through the contrastive divergence algorithm to generate a pre-trained model;

[0089] Based on the pre-trained model, a Softmax classifier is added to the top layer, and supervised fine-tuning is performed through the backpropagation algorithm to generate a unified party behavior risk score model.

[0090] Specifically, based on the multi-dimensional time series feature matrix, a deep belief network initial model containing multiple layers of restricted Boltzmann machines is constructed, each layer of restricted Boltzmann machines consists of a visible layer and a hidden layer, and the neurons are fully connected. The initial weight matrix is randomly initialized through Gaussian distribution, laying a foundation for model training. The deep belief network initial model is pre-trained unsupervisedly through the contrastive divergence algorithm to train network parameters layer by layer.

[0091] First, fix the parameters of the previous layer, train the weight matrix of the current layer, and update the neuron states of the visible layer and the hidden layer through Gibbs sampling to minimize the reconstruction error until the model converges to obtain a pre-trained model. This process can effectively extract high-level feature representations from the data. Add a softmax classifier on the top layer of the pre-trained model to convert the entire model into a supervised learning model. Then, use the labeled data set to fine-tune the model parameters through the backpropagation algorithm. Adjust the weights and biases in the network to enable the model to output a probability distribution corresponding to the unified behavior risk. Then generate a unified behavior risk scoring model for risk assessment of new operation logs. During the fine-tuning process, continuously monitor performance indicators such as accuracy, recall rate, and F1 score, and adjust and optimize the model structure or training parameters as needed to ensure the model has good generalization ability and risk prediction accuracy to meet the actual application requirements of medical anti-unified behavior monitoring.

[0092] Further, the initial model of the deep belief network is pre-trained unsupervisedly through the contrastive divergence algorithm to generate a pre-trained model, which further comprises:

[0093] Based on the initial model of the deep belief network, the weight matrix between the input layer and the first hidden layer is initialized with a Gaussian distribution to generate an initialized weight matrix.

[0094] Based on the initialized weight matrix, the neuron states of the visible layer and the hidden layer are iteratively updated through Gibbs sampling until the reconstruction error converges to generate a converged weight coefficient.

[0095] Based on the converged weight coefficient, the trained layer weights are frozen, and new restricted Boltzmann machines are stacked layer by layer to generate a pre-trained model.

[0096] Specifically, based on the initial model of the deep belief network, the weight matrix between the input layer and the first hidden layer is initialized with a Gaussian distribution to generate an initialized weight matrix, providing initial parameters for model training. Based on the initialized weight matrix, the neuron states of the visible layer and the hidden layer are iteratively updated through Gibbs sampling. In each iteration, the neuron states of the visible layer and the hidden layer are updated according to the current weight matrix until the reconstruction error converges to generate a converged weight coefficient, which can effectively extract high-level feature representations from the data. Based on the converged weight coefficient, the trained layer weights are frozen, and new restricted Boltzmann machines are stacked layer by layer to generate a pre-trained model, laying the foundation for subsequent supervised fine-tuning.

[0097] Further, feature fusion and standardization processing are performed on the original operation log set to generate a multi-dimensional time series feature matrix, which includes:

[0098] Data cleaning is performed on the original operation log set to remove duplicate logs and invalid fields, fill in missing values, and generate a cleaned log set;

[0099] Based on the cleaned log set, the non-structured text operation description is standardized and encoded to generate a vectorized feature;

[0100] Based on the vectorized feature, the association analysis of user role, operation type and access content is performed to generate a multi-dimensional time sequence feature matrix.

[0101] Specifically, the original operation log set is cleaned to remove duplicate log entries and invalid fields, and the missing values are reasonably filled in to generate a cleaned log set. Based on the cleaned log set, the non-structured text operation description is standardized and encoded to generate a vectorized feature. Based on the vectorized feature, the association analysis of user role, operation type and access content is performed to generate a multi-dimensional time sequence feature matrix.

[0102] Further, based on the vectorized feature, the association analysis of user role, operation type and access content is performed to generate a multi-dimensional time sequence feature matrix, including:

[0103] Based on the user role permission, the operation behavior whitelist is defined to generate a role-operation mapping rule;

[0104] The operation sequence of continuous time period is intercepted by sliding window to generate time sequence association feature;

[0105] The role-operation mapping rule and time sequence association feature are matrix splicing processed to generate a multi-dimensional time sequence feature matrix.

[0106] Specifically, based on the user role permission, the operation behavior whitelist is defined to determine the operation types allowed to be performed by different roles in the system, and a role-operation mapping rule is generated to provide a benchmark for subsequent operation behavior analysis. The operation sequence of continuous time period is intercepted by sliding window technology to generate time sequence association feature. Sliding window can help capture the continuity and association of operation behavior in time, reflecting the operation mode and its trend of change of users at different time points. The role-operation mapping rule and time sequence association feature are matrix splicing processed to generate a multi-dimensional time sequence feature matrix. Matrix splicing integrates features of different dimensions into a unified matrix, so that the operation behavior at each time point can be described and characterized from multiple angles, providing rich feature input for subsequent deep learning model training, which helps to improve the recognition ability and prediction accuracy of the model for unified party behavior risk.

[0107] Further, multi-source heterogeneous data collection is performed on the hospital anti-unified party system data, database audit data and access control data to obtain an original operation log set, including:

[0108] acquire historical suspected unified prescription behavior records and processed event label data from the hospital anti-unified prescription system to generate a first data subset;

[0109] Based on the first data subset, extract drug consumption access logs from the database audit system to generate a second data subset;

[0110] Based on the first data subset and the second data subset, collect user role permissions and device authentication information from the access control system to generate a third data subset;

[0111] Merge and process the first data subset, the second data subset and the third data subset to generate an original operation log set.

[0112] Specifically, the anti-unified prescription system inside the hospital is connected, and through a data interface or direct access to the database, historical suspected unified prescription behavior records are acquired, including operation time, operator, operation content and other detailed information. At the same time, the label data of the processed events is collected, which is used as annotation information for subsequent model training. The above data is arranged into a first data subset. The database audit system of the hospital is accessed to extract drug consumption access logs. These logs record the query and use of drug consumption by doctors or other medical personnel when prescribing, including access time, visitor identity, accessed drug information and consumption, etc. These data are taken as a second data subset. User role permissions and device authentication information are collected from the access control system of the hospital to determine the roles, permission ranges and device authentication records of different users. This part of data is combined with the previous two parts of data to form a third data subset. The first data subset, the second data subset and the third data subset are merged, and the merged data is preliminarily arranged, such as unified data format, checking data integrity, etc. After that, an original operation log set is obtained, which provides basic data for subsequent feature fusion and standardization processing.

[0113] Further, the method further comprises:

[0114] Based on the federated learning framework, the optimized risk classification model of the multi-hospital node is jointly trained to generate a global monitoring model.

[0115] Specifically, a federated learning framework is constructed, and multiple hospital nodes are included in the framework as participants, each of which has its own optimized risk stratification model. On each hospital node, the local medical data is used to further train the respective optimized risk stratification model, improve the performance of the model on the local data, and extract key parameters of the model such as weight matrix, bias term, etc., which will be used for subsequent joint training. In order to protect the privacy of data and the security of model parameters, each hospital node encrypts the extracted local model parameters using advanced encryption technologies such as homomorphic encryption to ensure that sensitive information is not leaked during parameter transmission and aggregation. Then, the encrypted model parameters are uploaded to the federated learning server. After receiving the encrypted model parameters uploaded by each hospital node, the federated learning server aggregates the above parameters using federated learning aggregation algorithms such as federated averaging. This algorithm will perform a weighted average of the model parameters of each node, and the weights are usually determined according to the data volume or data quality of each node, thereby obtaining the parameters of the global monitoring model.

[0116] Using the aggregated global model parameters, a global monitoring model is generated. Then, the global monitoring model is distributed to each hospital node to replace or update the original risk stratification model of each node, so that each hospital node can use the more comprehensive and more generalizable global model for medical counterparty behavior monitoring, further improving the accuracy and efficiency of monitoring, while ensuring that patient privacy or doctor prescription habits are not leaked during cross-hospital data joint training.

[0117] It should be understood that although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the direction of the arrow, these steps are not necessarily executed in the order indicated by the arrow. Unless otherwise specified herein, there is no strict order limitation for the execution of these steps, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be alternately or alternately executed with at least part of other steps or steps or stages in other steps.

[0118] For the device embodiment, since it basically corresponds to the method embodiment, the relevant part can be seen from the part of the method embodiment. The device embodiment described above is only schematic, wherein the components shown as separate components can or can not be physically separate, and the components shown as a unit can or can not be a physical unit, i.e., can be located in one place, or can be distributed to multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the present disclosure. Those skilled in the art can understand and implement without creative labor.

[0119] The above-described embodiments only express several implementation manners of the present application, which are described in detail, but should not be understood as a limitation on the patent scope of the application. It should be pointed out that, for those skilled in the art, without departing from the concept of the present application, several modifications and improvements can be made, which are all within the protection scope of the present application.

Claims

1. A method for monitoring medical countermeasures behavior based on deep learning, characterized in that, The method comprises: Collect multi-source heterogeneous data from the hospital's anti-prescription system data, database audit data, and access control data to obtain the original operation log set; Perform feature fusion and standardization processing based on the original operation log set to generate a multi-dimensional time series feature matrix; A deep belief network model is constructed based on the multi-dimensional time series feature matrix, and a unified behavior risk scoring model is generated through layered pre-training and fine-tuning; Based on the unified behavior risk scoring model, cross-validation and dynamic parameter adjustment are performed using the labeled data set to generate an optimized risk grading model; The optimized risk grading model is deployed to the hospital database audit system to generate real-time monitoring and early warning signals. 2.The medical anti-unified prescription behavior monitoring method based on deep learning according to claim 1, wherein, The optimized risk grading model is deployed to the hospital database audit system to generate real-time monitoring and early warning signals, including: Performing lightweight inference engine conversion on the optimized risk grading model to generate an embedded monitoring module; Based on the embedded monitoring module, the database operation log stream of the hospital database audit system is captured in real time through bypass monitoring to generate a risk scoring signal; A graded alarm is triggered based on the risk score signal to generate the real-time monitoring and early warning signal. 3.The medical anti-unified prescription behavior monitoring method based on deep learning according to claim 2, characterized in that, The triggering of graded alarms based on the risk score signal and generating the real-time monitoring and early warning signal includes: generating an operation trajectory map for the high-risk score operation in the risk score signal, wherein the operation trajectory map is used to trigger a high-risk operation interception instruction; triggering a secondary identity authentication process for a medium risk score operation in the risk score signal and generating a dynamic verification token; generating an audit summary report for low risk score operations in the risk score signal; The real-time monitoring and early warning signal is generated based on the operation trajectory map, the dynamic verification token and the audit summary report. 4.The medical anti-unified prescription behavior monitoring method based on deep learning according to claim 1, wherein, The method of performing cross-validation and dynamic parameter adjustment based on the unified behavior risk scoring model using the labeled data set to generate an optimized risk grading model includes: Divide the training set and validation set based on historical event labels to generate a stratified sampling dataset; Based on the stratified sampling data set, the accuracy and recall of the unified prescription behavior risk scoring model are calculated through ten-fold cross validation to generate performance evaluation indicators; The number of hidden layer nodes and the learning rate parameters are dynamically adjusted based on the performance evaluation index to generate the optimized risk grading model.

5. The medical anti-uniform behavior monitoring method based on deep learning according to claim 1, characterized in that, The deep belief network model is constructed based on the multi-dimensional time series feature matrix, and the unified behavior risk scoring model is generated through layered pre-training and fine-tuning, including: Constructing a deep belief network initial model including a multi-layer restricted Boltzmann machine based on the multi-dimensional time series feature matrix; Performing unsupervised pre-training on the initial model of the deep belief network using a contrastive divergence algorithm to generate a pre-trained model; A Softmax classifier is added to the top layer of the pre-trained model, and supervised fine-tuning is performed through the back-propagation algorithm to generate the unified behavior risk scoring model.

6. The medical anti-uniform behavior monitoring method based on deep learning according to claim 5, characterized in that, The method of performing unsupervised pre-training on the initial model of the deep belief network by using a contrastive divergence algorithm to generate a pre-trained model further includes: Based on the deep belief network initial model, a Gaussian distribution initialization is performed on a weight matrix between an input layer and a first hidden layer to generate an initialized weight matrix; Based on the initialized weight matrix, a Gibbs sampling is performed on neuron states of a visible layer and a hidden layer to iteratively update the neuron states until a reconstruction error converges, to generate a converged weight coefficient; Based on the converged weight coefficient, a trained layer weight is frozen, and a new restricted Boltzmann machine is stacked layer by layer to generate the pre-training model.

7. The medical anti-uniform behavior monitoring method based on deep learning according to claim 1, characterized in that, The feature fusion and standardization processing based on the original operation log set to generate a multi-dimensional time sequence feature matrix includes: Data cleaning is performed on the original operation log set to remove duplicate logs and invalid fields, fill in missing values, and generate a cleaned log set; Based on the cleaned log set, unstructured text operation descriptions are standardized and encoded to generate vectorized features; Based on the vectorized features, an association analysis of user roles, operation types, and access content is performed to generate the multi-dimensional time sequence feature matrix. 8.The medical anti-unification behavior monitoring method based on deep learning according to claim 7, wherein, The association analysis of user roles, operation types, and access content based on the vectorized features to generate the multi-dimensional time sequence feature matrix includes: Based on user role permission definition, an operation behavior white list is generated to generate a role-operation mapping rule; Through a sliding window, operation sequences in a continuous time period are intercepted to generate time sequence association features; The role-operation mapping rule and the time sequence association features are subjected to matrix splicing processing to generate the multi-dimensional time sequence feature matrix. 9.The medical anti-unification behavior monitoring method based on deep learning according to claim 1, wherein, The multi-source heterogeneous data collection of hospital anti-uniform system data, database audit data, and access control data to obtain an original operation log set includes: From the hospital anti-uniform system, historical suspected uniform behavior records and processed event label data are obtained to generate a first data subset; Based on the first data subset, drug consumption access logs are extracted from a database audit system to generate a second data subset; Based on the first data subset and the second data subset, user role permissions and device authentication information are collected from an access control system to generate a third data subset; The first data subset, the second data subset, and the third data subset are subjected to merging processing to generate the original operation log set. 10.The medical anti-unification behavior monitoring method based on deep learning according to claim 1, wherein, The method further includes: Based on a federated learning framework, the optimized risk grading model of multiple hospital nodes is jointly trained to generate a global monitoring model.

Images