Privacy information protection method based on smart medical electronic seal

Abstract

The invention relates to the technical field of malicious software detection, in particular to a privacy information protection method based on an intelligent medical electronic seal, which comprises the following steps of: collecting operation records and behavior data of the electronic seal, and generating a behavior data set; according to the method, the operation record and behavior data of the electronic seal are collected to generate the behavior data set, and then behavior feature extraction is carried out, including key information such as access frequency and operation time period. The extracted behavior characteristics are finely analyzed through a decision tree algorithm, the deviation between the extracted behavior characteristics and a normal behavior mode is rapidly and clearly determined, abnormal behavior indexes are screened, and a solid foundation is provided for follow-up accurate identification of malicious activities. On the basis, the random forest algorithm is used for further analyzing the screened abnormal indexes, the potential malicious activities are quickly positioned, then the process isolation action is immediately executed, the malicious processes possibly threatening privacy security are suspended and isolated in time, and the risk of continuous leakage of sensitive data is effectively avoided.

Description

Technical Field

[0001] This invention relates to the field of malware detection technology, and in particular to a method for protecting privacy information based on smart medical electronic seals. Background Technology

[0002] Malware detection technology is an important branch of cybersecurity, primarily researching how to effectively detect, identify, and prevent various types of malware, including viruses, worms, Trojans, ransomware, and spyware. Meanwhile, privacy protection methods are mainly used to prevent the illegal collection, leakage, or misuse of user privacy information by malware.

[0003] Current technologies, lacking fine-grained analysis of specific use cases such as electronic seal operation behavior, are prone to missed detections, false alarms, or even complete failure when facing highly disguised and complex malware attacks. For example, when malware simulates normal access frequencies and operating habits, current technologies often fail to detect anomalies, allowing malware to remain dormant for extended periods, leading to serious consequences such as the continuous leakage of sensitive user information and privacy abuse. Therefore, improvements are needed. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a privacy information protection method based on smart medical electronic seals.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a method for protecting privacy information based on a smart medical electronic seal, comprising the following steps: Collect operation records and behavior data of electronic seals to generate a behavior dataset; extract features from the behavior dataset to extract behavior features including access frequency and operation time period, and generate extracted behavior features. Based on the extracted behavioral features, the deviation between the features and the normal pattern is analyzed using a decision tree algorithm to generate behavioral pattern analysis results; based on the behavioral pattern analysis results, behavioral features that are different from the normal pattern are selected to generate abnormal behavior indicators. The random forest algorithm is applied to analyze the abnormal behavior indicators to identify potential malicious activities and generate potential malicious activity analysis results. Based on the potential malicious activity analysis results, process isolation is performed to suspend and isolate malicious processes and generate a list of isolated malicious processes. The isolated list of malicious processes is reviewed, the behavior and impact of each process are analyzed, and malicious process analysis results are generated.

[0006] Preferably, the steps for obtaining the behavior dataset are as follows: Identify the frequency of use and operation time of electronic seals, record the log of each seal activity, including the operator's identity and operation time, and form a preliminary operation record set; Based on the preliminary operation record set, the time period and duration of the operation behavior are analyzed, and the environment and context of each operation are recorded to obtain a more complete behavior dataset; Based on the more complete behavioral dataset, data quality standardization and cleaning are performed to remove outliers and redundant data, resulting in a standardized behavioral dataset.

[0007] Preferably, the steps for obtaining the extracted behavioral features are as follows: Based on the behavioral dataset, the mean, variance, and frequency distribution are calculated to form the extracted behavioral features.

[0008] Preferably, the steps for obtaining the behavioral pattern analysis results are as follows: Based on the extracted behavioral features, the access frequency and operation time period are classified and stored, the distribution of access frequency in different time intervals is calculated, and the operation time period is time-series segmented and classified to obtain the behavioral feature matrix. Calculate the behavior pattern deviation index based on the behavior feature matrix; Based on the behavior pattern deviation index, a threshold range for normal patterns is set. The deviation index is compared with the threshold range to filter abnormal feature items, classify and record abnormal behavior patterns, and archive them to the corresponding behavior categories to generate behavior pattern analysis results.

[0009] Preferably, the steps for obtaining the abnormal behavior indicators are as follows: Based on the behavioral pattern analysis results, the abnormal deviation values ​​of all feature items are extracted, feature items with deviations exceeding the normal range are filtered, and the degree of deviation of feature items in different operation periods, operation durations and operation intervals is analyzed to generate a feature anomaly dataset. Calculate the abnormal behavior score based on the aforementioned feature anomaly score dataset; Based on the abnormal behavior score, all feature items are classified, abnormal types are marked, and the distribution of abnormal behavior feature items is recorded to generate abnormal behavior indicators.

[0010] Preferably, the steps for obtaining the potential malicious activity analysis results are as follows: The abnormal behavior indicators are selected as the training set. The number of trees, the maximum depth of each tree, and the randomness parameters of feature selection in the random forest model are configured using the training set. The model training process is then executed to obtain the trained model. The trained model is then used for analysis to generate analysis results on potential malicious activities.

[0011] Preferably, the step of obtaining the isolated malicious process list is as follows: Based on the analysis results of the potential malicious activities, the process identifiers marked as abnormal are extracted, and the running status, resource consumption and accessed system files of each process are recorded to generate a set of process behaviors to be analyzed. Calculate the process isolation priority based on the set of process behaviors to be analyzed; Based on the process isolation priority, the processes are sorted, a pause operation is performed, and the paused processes are marked as pending isolation, generating a list of isolated malicious processes.

[0012] Preferably, the steps for obtaining the malicious process analysis results are as follows: Based on the isolated list of malicious processes, the behavior patterns of each process are analyzed to assess the potential threat to system security, analyze the relationships between processes and their access to critical system resources, identify patterns that match known malicious behaviors, and obtain the results of abnormal process behavior analysis. Based on the abnormal process behavior analysis results, the degree of malice of the process is determined, the impact of each process is analyzed, the threat to system stability and user data security is assessed, and malicious process analysis results are generated.

[0013] Compared with the prior art, the advantages and positive effects of the present invention are as follows: This invention collects operation records and behavioral data from electronic seals to generate a behavioral dataset, then extracts behavioral features, including key information such as access frequency and operation time periods. The extracted behavioral features are then meticulously analyzed using a decision tree algorithm to quickly identify deviations from normal behavioral patterns and filter out abnormal behavioral indicators, providing a solid foundation for accurate identification of malicious activities. Based on this, a random forest algorithm is used to further analyze the filtered abnormal indicators, quickly locating potential malicious activities. Process isolation is then immediately implemented to promptly suspend and isolate malicious processes that may threaten privacy and security, effectively preventing the risk of continuous leakage of sensitive data. The isolated malicious process list undergoes further detailed review and behavioral analysis, further enhancing the accuracy and efficiency of malicious activity identification and significantly improving the level of privacy protection. Overall, it demonstrates outstanding advantages such as high identification accuracy, fast response speed, and strong effectiveness in handling malicious behavior, thereby effectively curbing the potential damage caused by malicious software illegally collecting and abusing privacy information. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of the steps of the present invention. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0016] Please see Figure 1 This invention provides a technical solution: a method for protecting privacy information based on a smart medical electronic seal, comprising the following steps: Collect operation records and behavior data of electronic seals to generate a behavior dataset; extract features from the behavior dataset, including access frequency and operation time period, and generate the extracted behavior features. Based on the extracted behavioral features, the deviation between the features and the normal pattern is analyzed using a decision tree algorithm to generate behavioral pattern analysis results; based on the behavioral pattern analysis results, behavioral features that are different from the normal pattern are selected to generate abnormal behavior indicators. The random forest algorithm is applied to analyze abnormal behavior indicators, identify potential malicious activities, and generate potential malicious activity analysis results. Based on the potential malicious activity analysis results, process isolation is performed to suspend and isolate malicious processes, and generate a list of isolated malicious processes. The list of isolated malicious processes is reviewed, the behavior and impact of each process are analyzed, and malicious process analysis results are generated.

[0017] The steps to obtain the behavior dataset are as follows: Identify the frequency of use and operation time of electronic seals, record the log of each seal activity, including the operator's identity and operation time, and form a preliminary operation record set; Based on the initial set of operation records, the time period and duration of the operation behavior are analyzed, and the environment and context of each operation are recorded to obtain a more complete behavior dataset; Based on a more complete behavioral dataset, data quality standardization and cleaning are performed to remove outliers and redundant data, resulting in a standardized behavioral dataset.

[0018] Specifically, by deploying agentless data acquisition probes at the application layer and operating system kernel layer of the smart healthcare electronic seal system, API calls and system events related to the electronic seal client process are monitored in real time. When a preset seal operation event is detected, such as when a user performs actions like "opening a document to be signed," "drag in a seal," "enter a signing password," "confirm signing," and "close the document," the acquisition probe immediately captures and structurally records detailed information about the activity. The recorded fields include the operator's unique identifier extracted from the system user session, a system timestamp accurate to milliseconds, the client IP address and physical MAC address that initiated the operation, and the details of the document being operated on. The system records the complete path, filename, file hash, and document size of the document. It also encodes the triggered operation event type (e.g., "open document", "apply seal", "verify signature"), such as "open document" as 1 and "apply seal" as 2. This process does not involve reading or analyzing the document content itself, but only focuses on metadata and behavioral events. Each captured event generates an independent log record containing all the above fields. These log records are continuously fed into a centralized log repository in a time-series manner. After continuous accumulation and aggregation, a set containing all raw, unfiltered seal activity log records is formed, which is the initial operation log set.

[0019] Based on the initial set of operation records, the system initiates a batch processing analysis task. First, it calculates the operation duration through correlation analysis. Specifically, the system groups records according to the operator's identifier and document hash value, sorts each group in ascending order of timestamp, and then identifies paired "open document" and "close document" events. The duration of the document processing is obtained by subtracting the timestamps of the two events. If an "open document" event is found but no corresponding "close document" event is found, a timeout threshold is introduced. This threshold is calculated by the 95th percentile of the duration of all complete sessions in historical data. For example, if historical data shows that 95% of signing operations are completed within 30 minutes, the timeout threshold is set to 30 minutes. Unclosed sessions exceeding this time will be marked as abnormal timeouts and assigned a 30-minute duration. Next, the system analyzes the time periods of the operation behavior, mapping the operation time points to specific time period categories according to preset business rules. For example, 9:00 AM to 6:00 PM from Monday to Friday is defined as "working hours," the rest of the time is defined as "non-working hours," Saturday and Sunday are defined as "weekends," and statutory holidays are defined as "non-working hours." Holidays are defined as "holidays" using pre-set calendar data. Each record is assigned a time period label. The system then further records and enriches the environment and context of each operation. By requesting real-time snapshots from the client's data collection probe, it obtains the client's system environment information at the time of the operation, including operating system version, CPU load, memory usage, currently running process list, and network environment information, such as whether a VPN connection is used, network latency, and packet loss rate. Simultaneously, the context of the operation is recorded. By analyzing the metadata of documents, such as whether the filename contains keywords like "contract," "finance," or "medical record," documents are classified as "highly sensitive," "medium sensitive," or "low sensitive." This list of keywords and their corresponding sensitivity levels are pre-configured according to the data security management regulations of medical institutions. Finally, the calculated operation duration, the classified operation time period, the collected environmental information, and the context information are merged with the original records in the initial operation record set to form a more comprehensive and multi-dimensional behavioral data set, resulting in a more complete behavioral dataset.

[0020] Based on a more complete behavioral dataset, a data cleaning and standardization process is initiated. First, redundant data is processed. The system traverses the dataset, combining the operator's identifier, event type, document hash value, and operation timestamp (accurate to the second) into a unique key. If a record with the exact same unique key is found, it is considered a duplicate record, and only the first one is retained. This eliminates redundant data caused by network retransmissions or system jitter. Next, outlier removal is performed. This process employs different strategies for different data fields. For numerical features such as "operation duration," an interquartile range (IQR)-based method is used for detection. Specifically, the first quartile (Q1) and third quartile (Q3) of all values ​​in this field are calculated, and then the IQR (IQR = Q3 - Q1) is calculated. Any value less than (Q1 - 1.5 × IQR) or greater than (Q3 + 1.5 × IQR) is considered an outlier. The duration value of IQR is considered an outlier. For example, if Q1 is calculated to be 5 seconds and Q3 to be 60 seconds, then the IQR is 55 seconds. Any duration record less than -77.5 seconds (0 in practice) or greater than 142.5 seconds will be marked as an outlier and removed from the dataset. The multiplier of 1.5 is a standard statistical convention for identifying mild outliers. For missing values, if key fields such as "operator identifier" or "timestamp" are missing, the record is discarded. For missing non-key numerical fields such as "network latency," the median latency of the operator's 10 most recent valid operations is used for padding. Then, data standardization is performed to map numerical features of different dimensions and ranges to a similar scale space. For numerical features such as "operation duration" and "CPU load," a min-max normalization method is used to linearly scale them to [0, ...]. [1] The interval is calculated by subtracting the minimum value of the feature column in which each value is located, and then dividing by the difference between the maximum and minimum values ​​in that column. For classification features such as "operation time period" (e.g., working hours, non-working hours, weekends) and "document sensitivity" (e.g., high, medium, low), one-hot encoding is used to transform each category into a sparse binary vector. For example, the feature "operation time period" will be transformed into three new binary features: "whether it is working hours", "whether it is non-working hours", and "whether it is a weekend". Each operation only takes a value of 1 on the corresponding feature and 0 on the rest. After completing the above cleaning, filling and transformation steps, the final dataset is the normalized behavior dataset.

[0021] The steps for obtaining the extracted behavioral features are as follows: Based on the behavioral dataset, the mean, variance, and frequency distribution are calculated to form the extracted behavioral features.

[0022] Specifically, based on a standardized behavior dataset, the system extracts and calculates a series of statistical features for each operator's identity identifier and each combination of operation event types. Specifically, for continuous numerical features such as "operation duration," "CPU load," and "network latency," the system calculates their average value within a preset time window. This time window is set to the past 24 hours to reflect recent behavioral trends. Simultaneously, the system calculates the variance of these values ​​to quantify the stability or volatility of the behavior. A larger variance indicates more unstable behavior. For example, if an operator's average signature operation duration over the past 24 hours is 35 seconds, with a variance of 225 squared seconds, the table... The typical fluctuation of operation time around the mean is ±15 seconds. For discrete classification features such as "operation time period" and "document sensitivity", the frequency distribution is calculated. That is, the number of times each category appears and its proportion of the total number of operations are counted within the same 24-hour window. For example, it is found that an operator's operations account for 85% during "working hours", 10% during "non-working hours", and 5% during "holidays". These statistics, including the mean, variance and the frequency of each category, are combined into a multi-dimensional vector. Each vector represents the behavioral profile of a specific entity within a specific time window. All these vectors are aggregated to form the extracted behavioral features.

[0023] The steps for obtaining the behavioral pattern analysis results are as follows: Based on the extracted behavioral features, access frequency and operation time periods are classified and stored. The distribution of access frequency in different time intervals is calculated, and the operation time periods are segmented and classified in time sequence to obtain the behavioral feature matrix. Based on the behavioral feature matrix, the behavioral pattern deviation index is calculated using the following formula: ; in, Representing the Behavioral pattern deviation index of each feature item Representing the The frequency of access to each feature item during data observation. Representing the Reference access frequency of each feature item in normal mode. Representing the The length of the operation period for each feature item during data observation. Representing the The operation interval for each feature item during data observation Representing the The median operation time of each feature in normal mode Representing the Minimum operation time for each feature term Representing the The maximum operation time for each feature term It is a very small positive number to prevent the denominator from being zero; Based on the behavioral pattern deviation index, a threshold range for normal patterns is set. By comparing the deviation index with the threshold range, abnormal feature items are filtered, abnormal behavioral patterns are classified and recorded, and archived into the corresponding behavioral categories to generate behavioral pattern analysis results.

[0024] Specifically, based on the extracted behavioral features, the system performs refined classification, storage, and analysis of the feature values ​​representing access frequency. First, it creates composite keys based on three dimensions: operator identity identifier, operation event type, and document sensitivity level, and stores the corresponding access frequency data in a hash mapping structure for fast retrieval. Next, to analyze the temporal distribution characteristics of the frequency, the system divides a 24-hour day into four fixed time intervals: midnight (0:00 to 6:00), morning (6:00 to 12:00), afternoon (12:00 to 18:00), and evening (18:00 to 24:00). Then, it iterates through the behavioral dataset of the past 30 days, counting the total number of operations for each composite key within these four time intervals, thus obtaining the access frequency distribution of each specific behavior in different time intervals. Simultaneously, it analyzes the operation... The time period is segmented into time sequences, treating each operator's continuous operation records as a time series. Sessions are segmented by setting an inactivity time threshold. This threshold is dynamically determined by analyzing the median of all operation intervals in historical data and multiplying it by a coefficient (e.g., 2.0). If the interval between two consecutive operations exceeds this threshold, the session containing the previous operation is considered to have ended, and a new session begins. For example, if the calculated inactivity threshold is 45 minutes, any silent period exceeding 45 minutes will be segmented into sessions. After segmentation, each session is categorized, and its total duration, total number of operations, proportion of operations on highly sensitive documents, and other attributes are calculated. Finally, these categorized access frequency, time interval distribution data, and session categorization attributes are integrated into a structured two-dimensional table, which yields the behavioral feature matrix.

[0025] formula: The advantage of this formula lies in its ability to more accurately identify potential abnormal behaviors that deviate from the norm. Instead of viewing abnormal access frequency in isolation, it innovatively combines frequency deviation with the dynamic temporal characteristics of the behavior (operation duration and interval). This design results in significantly higher deviation indices for high-frequency, long-duration operations within a short period, effectively amplifying signals of "brute-force" or "persistent" attacks. The denominator incorporates the square root of the square of the median, maximum, and minimum durations under normal conditions, constructing a robust normalization factor that reflects the normal time span of the behavior. This allows for a fair comparison of BPI values ​​across different types and time scales of behavior, avoiding the inherently higher deviation values ​​of longer-duration behaviors. Ultimately, this formula can distinguish between normal business peaks and potentially risky abnormal activities, improving the accuracy and sensitivity of the privacy protection system.

[0026] Representing the The frequency of access to a feature item during data observation quantifies the specific number of times a particular behavior occurs within the current monitoring period. The acquisition process involves the system first defining a sliding time window as the observation period, such as the most recent hour. Then, the system filters from the behavior feature matrix the access frequency of the feature item. All records that are completely matched, feature terms It's a specific behavioral description, such as "a department chief physician accesses highly sensitive electronic medical records outside of working hours." The system counts the filtered records, and the total number obtained is the result. This value is calculated in real time and reflects the latest activity status. For example, if the system sets the observation window to 6 PM to 7 PM, and by retrieving the behavioral feature matrix, it finds that the behavior of "the doctor with ID DR007 accessing 'infectious disease' category medical records within this window" occurred 10 times, then for this feature item... , The value is 10.

[0027] Representing the The reference access frequency for each feature item in normal mode provides a baseline for determining whether the current access frequency is abnormal. The process involves the system retrieving all historical behavior data from the past 90 days, excluding known security events or system maintenance periods, and then analyzing the data for each feature item. This method extracts access frequency data for each similar time window (e.g., all historical Wednesday afternoons from 6 PM to 7 PM) to form a frequency data sequence. The average of this sequence is then calculated and used as the reference access frequency for that feature. This method, based on long-term, similar historical data, smooths out occasional business fluctuations and forms a statistically significant, stable benchmark for normal behavior. For example, for a feature... The system analyzes data from 12 Wednesdays over the past 90 days that match the criteria for accessing 'infectious diseases' medical records between 6 PM and 7 PM. The frequency sequence is {2, 1, 0, 2, 1, 3, 1, 2, 0, 1, 2, 1}, with an average value of 1.33. Therefore... The value is set to 1.33.

[0028] Representing the The duration of the operation for each feature term during data observation, measured in seconds. This parameter measures the persistence of the current anomalous behavior and is obtained by comparing it with... Within the same observation window, the system identifies all items belonging to the feature term. The system records user actions and extracts the "action duration" for each record from the normalized behavior dataset. It then calculates the average of these durations as the currently observed average action duration. This value reflects the average time spent by a user performing a specific action and is one of the important time dimensions for evaluating behavioral patterns. For example, within the observation window, the action durations of the doctor with ID DR007's 10 visits to "infectious disease" category medical records are {125, 130, 110, 145, 120, 150, 105, 115, 135, 125} seconds, with an average of 126 seconds. The value is 126.

[0029] Representing the The operation interval for each feature item during data observation, measured in seconds, describes the density of the current action. It is obtained by the system analyzing all data belonging to the feature item within the same observation window. The operation records are sorted in ascending order by timestamp. Then, the time difference between any two adjacent operations is calculated, forming an interval time series. Finally, the average value of this series is calculated as the observed average operation interval time. The smaller this value, the more frequent the operations. For example, the doctor with ID DR007's 10 operations generated 9 time intervals, {30, 45, 25, 50, 35, 20, 40, 30, 25} seconds, so the average interval is 33.33 seconds. The value is 33.33.

[0030] Representing the The median of operation time in normal mode, measured in seconds, provides a measure of the central tendency of operation time under normal conditions. Compared to the mean, the median is less sensitive to extreme outliers and is more robust. Its acquisition process is similar to... Similarly, the system retrieves historical normal data from the past 90 days and filters out all data belonging to the characteristic items. The operation records are analyzed, and their "operation duration" values ​​are extracted to form a historical duration dataset. All values ​​in this dataset are sorted from smallest to largest, and the value in the middle is the median. For example, for feature terms... There were 501 operations in history. The 251st operation after sorting took 45 seconds. The value is 45.

[0031] Representing the The minimum operation time for each feature, in seconds. This parameter defines the lower limit of the normal behavior duration, and it is obtained by comparing it with... Within the same historical normal dataset, find the minimum value among all "Operation Duration" values. This value represents the time required to complete the fastest operation under normal circumstances. For example, in historical data, the minimum value for completing a feature item... The fastest record for the corresponding operation is 15 seconds. The value is 15.

[0032] Representing the The maximum operation time for each feature, in seconds, defines the upper limit of normal behavior duration. It is obtained by comparing it with... Within the same historical normal dataset, find the maximum value among all "Operation Duration" values. This value represents the time required to complete a most time-consuming operation under normal circumstances. For example, in historical data, the maximum value for completing a feature item... The slowest recorded time for the corresponding operation is 120 seconds. The value is 120.

[0033] It is an extremely small positive number to prevent the denominator from being zero, therefore The value is 0.000001.

[0034] Calculation process: Based on the parameter acquisition steps described above, we will now calculate the feature terms for a specific scenario. The doctor with ID DR007 accessed the 'Infectious Diseases' category of medical records between 6 p.m. and 7 p.m. on Wednesday.

[0035] The obtained parameter values ​​are as follows: ; ; Second; Second; Second; Second; Second; ; Substitute the above values ​​into the formula: ; ; ; ; ; ; ; The results indicate that for the specific behavior of "the doctor with ID DR007 accessing 'infectious disease' category medical records between 6 PM and 7 PM on Wednesdays", the calculated behavioral pattern deviation index is 12.0931. This value is much greater than 1, which intuitively reflects the significant deviation between the current behavior and the established normal pattern. The value is directly related to the severity of the deviation.

[0036] Based on the calculated behavioral pattern deviation index of each feature item, the system initiates a threshold comparison and anomaly screening process. First, for each feature item... A dynamic threshold for its specific normal pattern is set. This threshold is determined by retrieving all calculated historical behavioral pattern deviation index values ​​for that feature within the past 90-day normal cycle, forming a historical deviation index distribution set. Then, the threshold is determined using the percentile method, specifically taking the 99.5th percentile of this distribution set as the judgment criterion. For example, for feature item... The historical deviation index distribution is concentrated, with 99.5% of the values ​​being less than 5.8. Therefore, the threshold for its normal mode is set to 5.8. This method of dynamically setting thresholds for each feature can adapt to the different fluctuations inherent in different behaviors, improving the accuracy of judgment. After setting the threshold, the system compares the latest behavior pattern deviation index calculated within the current observation window with the corresponding threshold one by one. If the behavior pattern deviation index of a feature is greater than its threshold, for example, the calculated value is 12.09 while the threshold is 5.8, then the feature is filtered out and marked as abnormal. Then, all features marked as abnormal are classified and recorded. The classification is based on the feature. The records are categorized by their inherent attributes, such as by operation time period ("non-working time anomaly"), by access frequency and interval characteristics ("high-frequency intensive operation anomaly"), or by document sensitivity ("highly sensitive data anomaly access"). Finally, all filtered and categorized anomaly records are structured and archived. Each archived record includes a feature description, a calculated behavior pattern deviation index, its violation threshold, anomaly classification label, and the timestamp of occurrence. This information is then summarized to generate behavior pattern analysis results.

[0037] The steps for obtaining abnormal behavior indicators are as follows: Based on the behavioral pattern analysis results, the abnormal deviation values ​​of all feature items are extracted, feature items with deviations exceeding the normal range are filtered, and the degree of deviation of feature items in different operation periods, operation durations and operation intervals is analyzed to generate a feature anomaly dataset. Based on the feature anomaly score dataset, the anomalous behavior score is calculated using the following formula: ; in, Representing the Abnormal behavior scores for each feature item, Representing the The current observation value of each feature term, Representing the The reference mean of each feature term in normal mode. Representing the The standard deviation of each feature term in the normal mode Representing the The length of the operation period for each feature item during data observation. Representing the The median operation time of each feature in normal mode Representing the The operation interval of each feature item It is an adjustable weighting coefficient; Based on the abnormal behavior score, all feature items are classified, abnormal types are labeled, and the distribution of abnormal behavior feature items is recorded to generate abnormal behavior indicators.

[0038] Specifically, based on the behavioral pattern analysis results generated in the previous stage, the system first iterates through all the feature items marked as abnormal in the results and directly extracts their behavioral pattern deviation index as the initial abnormal deviation value. Then, the system filters these deviation values, comparing each deviation value with its corresponding normal range threshold set based on the 99.5 percentile of historical data. Only feature items whose deviation values ​​clearly exceed their specific thresholds are retained for the next step of in-depth analysis. For each filtered abnormal feature item, the system performs a source analysis of its deviation composition to quantify its degree of abnormality in different dimensions. Specifically, for deviations during operating time periods, the system maps them to a preset quantitative risk table. For example, if the normal pattern is "working hours" and the observation occurs during "non-working hours," the time period deviation is assigned a value of 0.6; if it occurs in the early morning, then... The value is assigned to 0.9. If it occurs on a "statutory holiday", the value is assigned to 1.0. For the deviation of operation duration, the system calculates the relative deviation of the observed average operation time period length from the median operation time in normal mode. That is, the observed time period is subtracted from the median time period, and the difference is divided by the median time period. The absolute value is taken as the duration deviation. For the deviation of operation interval time, the system calculates the relative deviation of the observed average operation interval time from the average interval time in normal mode. The normal interval is subtracted from the observed interval, and the difference is divided by the normal interval. The ratio is taken as the interval time deviation. The larger the value, the more intensive the operation. The identifier of each abnormal feature item, its original abnormal deviation value, and the calculated time period deviation, duration deviation and interval time deviation are recorded together to form a structured dataset containing multi-dimensional abnormal quantitative indicators, which is the feature abnormality dataset.

[0039] formula: The advantage of the formula lies in the first part of the formula. The standard score (Z-score) is a standardized measure of deviation from a specific observation (such as visit frequency), eliminating the influence of different metrics and allowing different types of anomalies to be compared on the same scale. The second part of the formula... The system innovatively introduces a logarithmic function to handle anomalies in operation duration. This not only penalizes excessively long operation times, but the slowing growth of the logarithmic function also effectively smooths out the impact of extremely long operation times, preventing the score from being dominated by a few extreme outliers. The revised third part... By processing the ratio of the observation operation interval to the normal reference interval, the relative density of the operation is quantified. The smaller the ratio in the denominator (i.e. the more intensive the operation), the larger the value of this term, thereby amplifying the risk signal of intensive attack behaviors such as automated script attacks or brute-force attacks.

[0040] Representing the The current observed value of each feature item. This parameter is the core raw data for anomaly scoring. It specifically refers to the quantified value of a particular behavioral indicator within the current observation window. In this method, Specifically defined as a feature term The frequency of visits, compared with the frequency used in the previous steps when calculating the behavioral pattern deviation index. These are the same concept and value, obtained by real-time statistics and feature items within a sliding time window (e.g., 1 hour) set by the system. (For example, the total number of occurrences of all action events related to "Doctor ID DR007 accessing 'Infectious Diseases' category medical records between 6 PM and 7 PM on Wednesdays"). This statistic is derived directly from the raw, normalized behavioral dataset without any transformation, ensuring the timeliness and accuracy of the data. For instance, based on the previous example, the system detected 10 instances of the behavior "Doctor ID DR007 accessing 'Infectious Diseases' category medical records" within the observation window. Therefore, The value is taken 10 times.

[0041] Representing the The reference mean of each feature item in normal mode provides a central benchmark for assessing the degree of deviation of the current observation. It is correlated with the reference access frequency used in the previous step when calculating the behavioral pattern deviation index. These are the same concept and value, obtained through statistical analysis of long-term historical data. The system retrieves "clean" behavioral data from the past 90 days, after removing all known abnormal periods (such as system failures and security drills), and targets specific features. Extract its access frequency across all similar time windows (e.g., all past Wednesdays from 6 PM to 7 PM) to form a historical frequency sequence, then calculate the average of this sequence, which is set as the mean. This method ensures that the baseline value reflects the typical occurrence level of the behavior in normal business activities. For example, based on the previous example, characteristic terms are calculated by analyzing historical data. The average reference access frequency is 1.33 times, therefore, The value is 1.33.

[0042] Representing the The standard deviation of each feature term under normal mode, this parameter is used to quantify the range of fluctuation in normal behavior, and is the key denominator of the standardized deviation. Its acquisition method is similar to... Closely related, after calculating the reference mean Based on the same historical frequency sequence used, the system further calculates the standard deviation of the sequence. The standard deviation is calculated using a standard statistical formula: the square root of the average of the squares of the differences between each value in the sequence and the mean. This value reflects the dispersion of the access frequency around its mean under normal circumstances, providing a basis for judging whether the current deviation is statistically significant. For example, based on the historical frequency sequence {2, 1, 0, 2, 1, 3, 1, 2, 0, 1, 2, 1} given in the previous example, its mean is 1.33, and the calculated sample standard deviation is approximately 0.8876. Therefore, The value is 0.8876.

[0043] Representing the The length of the operation period for each feature item during data observation, in seconds. This parameter is the same as the one used in the previous step when calculating the behavioral pattern deviation index. It is the same concept and value, reflecting the average duration of the currently evaluated behavior. It is obtained by identifying all features within the current observation window. The operation records are analyzed, and the "operation duration" value for each record is extracted from the normalized behavior dataset. The average of these values ​​is then calculated, and the result is the final value. For example, based on the previous example, the average duration of the 10 operations occurring within the observation window is 126 seconds. Therefore, The value is 126.

[0044] Representing the The median duration of each feature in normal mode, in seconds. This parameter is the same as the one used in the previous step when calculating the behavior pattern deviation index. It refers to the same concept and value, providing a robust central trend benchmark for assessing the anomalies of current operation durations. This benchmark is obtained by the system filtering all data belonging to the characteristic from normal historical data over the past 90 days. The operation records are analyzed, and their "operation duration" is extracted. These duration values ​​are then sorted, and the value in the middle position is taken as the median. For example, based on the previous example, the median of historical normal operation duration is 45 seconds. Therefore... The value is 45.

[0045] Representing the The operation interval for each feature item, in seconds, is the same parameter used in the previous step when calculating the behavioral pattern deviation index. It refers to the same concept and numerical value used to quantify the intensity of the current operation. It is obtained by, within the current observation window, identifying all elements belonging to the feature term. The operation records are sorted by timestamps. The time difference between any two consecutive operations is calculated, and then the average of these time differences is calculated. The result is the output. For example, based on the previous example, the observed average operation interval time is 33.33 seconds, therefore, The value is 33.33.

[0046] Representing the The reference operation interval time for each feature in normal mode, in seconds. This parameter was introduced to correct dimensional errors in the formula. It provides a benchmark for evaluating the relative density of the current operation interval, and its acquisition method is the same as... Similarly, the system retrieves normal historical data from the past 90 days and filters out all data belonging to the characteristic items. The operation records are analyzed, and the time intervals between all adjacent operations are calculated to form a historical interval time series. Then, the average value of this series is calculated, and this average value is the result. For example, for feature terms The system analyzes historical normal operations, obtaining an interval time series of {125, 150, 95, 110, 130} seconds. The calculated average is 122 seconds. Therefore, The value is 122.

[0047] This is an adjustable weighting coefficient used to adjust the importance of operation intensity in the overall anomaly score. Its setting is not a fixed value, but rather dynamically determined based on the data being operated on and the risk profile of the operator. The rationale is that information with higher sensitivity carries a greater risk of being accessed intensively, thus requiring a higher weight. The setting method is as follows: First, set a base risk score for all document sensitivity levels (e.g., "High," "Medium," "Low") and operator roles (e.g., "Chief Physician," "Intern," "Administrator"). For example, a "Highly Sensitive" document risk score is 10, and a "Chief Physician" role risk score is 3. Then… The calculation formula is: ,in This is the system's base weight, for example, set to 10. It is the document sensitivity risk score. It is the reciprocal of the operator's role risk score. For example, in a scenario where a "chief physician" accesses a "highly sensitive" medical record, its... .

[0048] Calculation process: Continuing with the previous example, the characteristic term The doctor with ID DR007 (as a chief physician) accessed the 'Infectious Diseases' category of medical records (highly sensitive) between 6 PM and 7 PM on Wednesday.

[0049] The obtained parameter values ​​are as follows: ; ; ; Second; Second; Second; Second; ; Substitute the above values ​​into the corrected formula: ; ; ; ; ; ; The results show that the final abnormal behavior score for this feature is 39.2159, which is a quantitative risk value that integrates frequency deviation, abnormal operation duration, and relative operation density. The higher the score, the higher the degree of abnormality and potential risk of the behavior. The revised formula, because it more scientifically measures the operation density (the observation interval is much smaller than the normal interval), has obtained a significantly higher score. This score will be used as one of the core abnormal behavior indicators.

[0050] Based on the calculated abnormal behavior scores of all feature items, the system classifies these feature items into risk levels and finely labels the abnormal types. First, the system classifies each feature item according to preset scoring thresholds. These thresholds are determined based on the analysis of historical security event data. For example, by reviewing confirmed malicious activity cases, it was found that their abnormal behavior scores were generally higher than 20, while some minor violations scored between 10 and 20. Therefore, the system sets the thresholds as follows: scores below 10 are labeled as "low risk," scores between 10 and 20 are labeled as "medium risk," and scores above 20 are labeled as "high risk." Next, the system performs anomaly attribution analysis on each feature item labeled as medium or high risk to label its specific abnormal type. This is done by tracing back the three components of the abnormal behavior scoring formula: the standardized deviation term, the duration anomaly, and the other two. The system calculates the percentage contribution of each item and interval anomaly to the total score. If the contribution of the standardized deviation item exceeds 50%, it is marked as "frequency / numerical anomaly". If the duration anomaly contributes the most, it is marked as "duration anomaly". If the interval anomaly contributes the most, it is marked as "operation-intensive anomaly". A behavior can be assigned multiple anomaly type labels. Then, the system summarizes these classification and labeling results and records the distribution of feature items of different risk levels and different anomaly types for each operator, each operation time period, and each document sensitivity. For example, it generates a statistical report showing that "User A generated 3 high-risk 'operation-intensive anomalies' during non-working hours". All these scores, risk levels, anomaly type labels, and distribution statistics are integrated to form a rich and structured dataset, which is the final abnormal behavior index.

[0051] The steps to obtain the results of potential malicious activity analysis are as follows: Select abnormal behavior indicators as the training set, use the training set to configure the number of trees in the random forest model, the maximum depth of each tree, and the randomness parameters of feature selection, execute the model training process, and obtain the trained model. The trained model is used for analysis to generate analysis results of potential malicious activities.

[0052] Specifically, the initial training set uses abnormal behavior indicators that include historical security incident review results and have been manually annotated. Each data record contains a feature vector consisting of abnormal behavior score, risk level, abnormality type, operation time deviation, operation duration deviation, and operation interval time deviation, as well as a binary label determined by security analysis experts (1 represents malicious activity, 0 represents normal or benign abnormality). First, the hyperparameters of the random forest model are automatically optimized through a combination of grid search and five-fold cross-validation. Specifically, a search range is set for the "number of trees," for example, from 100 to 500, with a step size of 50, to balance the complexity and computational cost of the model. A search range is set for the "maximum depth of each tree," for example, from 10 to 40, with a step size of 5, to control the overfitting risk of individual decision trees. The randomness parameter for feature selection is set to "sqrt", meaning that at each split, the square root of the total number of features is randomly selected for evaluation. In each iteration of the grid search, a given set of hyperparameters is used to randomly divide the training set into five non-overlapping subsets. The model is trained on four subsets in turn and validated on the remaining subset. The evaluation metric is the F1 score, which can evenly evaluate the precision and recall of the model on imbalanced class data. After cross-validation of all hyperparameter combinations, the hyperparameter combination with the highest average F1 score is selected as the optimal configuration. Finally, the model is retrained on the complete training set using this optimal set of hyperparameters until all decision trees are built. The final ensemble model structure and the node parameters of all decision trees are serialized and stored to obtain the trained model.

[0053] Real-time generated, unlabeled anomalous behavior indicators are used as input data and analyzed using the model trained in the previous step. Each new anomalous behavior indicator record has the same data structure as the feature vector used during training. It is first fed into each decision tree in the random forest. Within each tree, starting from the root node, the record is traversed layer by layer downwards according to the node's splitting rules (e.g., whether the anomalous behavior score is greater than 15.5) until a leaf node is reached. This leaf node provides a preliminary classification judgment (malicious or normal) based on its learning during training. After all decision trees in the forest have completed this process, the system collects the judgments from all trees and performs a vote. The final classification result is determined by the category with the most votes. For example, if 120 trees vote for "malicious" and 80 trees vote for "normal," the behavior is ultimately judged as malicious. In addition to the final classification label, the model also outputs a confidence probability, which is equal to the proportion of trees voting for the "malicious" category out of the total number of trees in the forest (in this example, 120 / 200 = 120 / 200). (0.6), this final classification label and confidence probability are attached to the original abnormal behavior indicator record to form a complete analysis record. All these records judged by the model are aggregated to generate the potential malicious activity analysis results.

[0054] The steps to obtain the list of isolated malicious processes are as follows: Based on the analysis results of potential malicious activities, process identifiers marked as abnormal are extracted, and the running status, resource consumption and accessed system files of each process are recorded to generate a set of process behaviors to be analyzed. Based on the set of process behaviors to be analyzed, the process isolation priority is calculated using the following formula: ; in, The isolation priority for the z-th process. Let z be the number of abnormal behaviors of the z-th process. This represents the average number of abnormal behaviors in a normal process. and The weighting coefficients for resource consumption and system activities are respectively, satisfying... ; The normalized resource consumption score, The normalized system activity score is calculated as follows: ; ; Here, This represents the CPU utilization (%) of the z-th process. This represents the memory usage percentage (%) of the z-th process. This represents the number of disk I / O operations performed by the z-th process. This represents the number of network connection requests made by the z-th process. This represents the system call frequency (e.g., times / second) of the z-th process. This represents the number of file accesses by the z-th process. This represents the number of threads created in the z-th process. These represent the average or preset baseline values ​​of CPU utilization, memory utilization, disk I / O operation count, network connection request count, system call frequency, file access count, and thread creation count for various processes under normal conditions. Based on process isolation priority, processes are sorted, paused, and paused processes are marked as pending isolation, generating a list of isolated malicious processes.

[0055] Specifically, based on the potential malicious activity analysis results generated in the previous stage, the system initiates a screening and information collection process. First, a confidence threshold is set, which is determined by the risk preference of the security policy. For example, to pursue a high recall rate (better to kill the innocent than let the guilty go free), the threshold can be set to 0.5; if the pursuit is high accuracy (to avoid interference with normal business operations), the threshold is set to 0.85. Here, it is set to 0.75. The system iterates through all analysis results, filtering out records that are marked as "malicious" by the model and whose confidence probability is greater than 0.75. For each filtered record, the system parses its associated original logs, extracting the unique identifier (PID) of the process that performed the abnormal operation. Then, for each extracted PID, the system calls the operation... The system kernel interface and performance monitoring tools immediately collect a detailed snapshot of the process's current status. The recorded content includes the process's running status (e.g., running, sleeping, zombie), resource usage, specifically CPU utilization (percentage), physical memory usage (megabytes), total disk read / write operations in the past minute, and detailed information on all network connections currently established by the process (local address, remote address, status). At the same time, by analyzing system audit logs or using tools like lsof, a complete list of all files currently opened by the process is obtained. Each PID and all its associated real-time collected running status, resource usage, and file access data are integrated into a structured record. The collection of all these records is the set of process behaviors to be analyzed.

[0056] formula: , , ; The advantage of this formula lies in its combination of two dimensions: qualitative historical behavior and quantitative real-time status. This enables a comprehensive and dynamic assessment of process risk. The first part of the formula uses a logarithmic function to process the difference between the number of historical anomalous behaviors and the normal baseline. This significantly amplifies anomalous behaviors that have suddenly appeared (e.g., from 0 to 1 times) while smoothing out differences between extremely high-frequency anomalous behaviors, preventing the over-amplification of historical blemishes and making the assessment more robust. The second part of the formula, through resource consumption analysis… and system activity The weighted sum of square roots are used to construct a comprehensive measure of system influence. This method is similar to calculating Euclidean distance in a multidimensional feature space, and can comprehensively reflect the overall pressure of the process on the system at the current moment. (Weight coefficients are also mentioned.) and The introduction of this technology allows security strategies to flexibly adjust their focus based on the current primary threat type (e.g., whether it is a resource exhaustion attack or a data theft attack). Ultimately, by multiplying historical behavioral risks with real-time system impact, a process with a clean history but currently exhibiting abnormal behavior, or a process with a questionable history but currently dormant, can be reasonably assessed, improving the accuracy and timeliness of response decisions.

[0057] The parameter represents the number of anomalous behaviors of the z-th process. This parameter quantifies the frequency with which a specific process has been associated with malicious activity recently. It is obtained by using the process identifier as an index for the process z to be evaluated, backtracking through the analysis results of potential malicious activities generated in the past 24 hours, and counting the total number of events associated with that process identifier and marked as "malicious" by the random forest model. This count is the number of anomalous behaviors. This parameter directly reflects the historical suspiciousness of a process at the behavioral level. For example, for process PID 5432, if the system's analysis of the past 24 hours found three malicious electronic seal operations initiated by it, then... The value of is 3.

[0058] This parameter represents the average number of abnormal behaviors of a normal process. It provides a benchmark for determining whether a process's abnormal behavior is significant. It is obtained by first maintaining a whitelist of known benign processes, including core operating system processes and critical business application processes, such as wininit.exe and lsass.exe. The system continuously monitors the behavior of all processes in this whitelist over the past 30 days and counts the number of times each process was misclassified as "malicious" by the model. Then, it calculates the overall average of the daily misclassifications for all these whitelisted processes over the 30-day period. This value is the average of the average number of misclassifications per day. Because the model has a false positive rate, this value is usually a very small positive number. For example, statistically, the whitelist process is falsely identified an average of 0.05 times per day. The value is 0.05.

[0059] and These are the weighting coefficients for resource consumption and system activity, respectively. These two parameters are used to adjust the importance of different types of system impact in the final priority calculation. Their settings are based on the medical institution's security strategy and the main types of threats it currently faces. If the current focus is mainly on attacks that consume large amounts of system resources, such as ransomware, then these weighting coefficients should be increased. The weight of [the attack] should be increased; conversely, if the main focus is on covert attacks involving frequent file and network operations, such as data theft, then [the weight] should be increased. The weights, and their values, can be determined through expert evaluation combined with historical data analysis. For example, security teams can set different weight policy profiles for different attack scenarios, which the system can automatically switch based on external threat intelligence. In this example, considering that privacy protection focuses more on preventing system activities related to data leakage, the weights are set as follows: It is 0.7, therefore .

[0060] This represents the CPU utilization of the z-th process, expressed as a percentage. This represents the memory usage of the z-th process, expressed as a percentage. This represents the number of disk I / O operations performed by the z-th process, measured in operations per second. This represents the number of network connection requests made by the z-th process, in times per minute. This represents the system call frequency of the z-th process, expressed in times per second. This represents the number of file accesses by the z-th process, expressed in times per minute. The number of threads created by the z-th process, expressed in times per minute, is directly extracted from the set of process behaviors to be analyzed. For example, for process PID 5432, the collected real-time data is as follows: , , times / second times / minute times / second times / minute times per minute.

[0061] These benchmark values ​​are the average values ​​of various indicators for a normal process. These benchmark values ​​are obtained by performing long-term (e.g., 7 consecutive days) performance monitoring on processes in the aforementioned benign process whitelist and calculating the average values ​​of each indicator. For example, after statistical analysis, the benchmark values ​​for a normal process are: , , times / second times / minute times / second times / minute times per minute.

[0062] Calculation process: First, calculate resource consumption. and system activity : ; ; ; ; ; ; ; ; Then, substitute all the parameters into the main formula. Perform the calculation: ; ; ; ; ; ; The results show that the final isolation priority score of process PID 5432 is 138.706, which is a very high value. It comprehensively reflects that the process not only has significant anomalies in its historical behavior, but also exhibits extremely high aggressiveness or destructiveness in its current system resource consumption and activity. This score will serve as the core basis for sorting and decision-making. The higher the score, the greater the threat that the process poses to system security and stability, and the more it needs to be prioritized. Among all the processes to be analyzed, this process will be placed at the forefront of the isolation queue.

[0063] Based on the process isolation priorities calculated for all processes to be analyzed, the system organizes these processes and their corresponding priority scores into a temporary response queue and immediately sorts the queue in descending order of priority scores, ensuring that the process with the highest score is at the top of the queue. Subsequently, the system executes pause operations one by one from the head of the queue in the sorted order. The pause operation is achieved by sending an operating system-level SIGSTOP signal to the target process (in Linux / Unix environments) or calling the SuspendThread function to freeze all threads of the process (in Windows environments), thereby instantly depriving the process of its ability to execute any code without terminating it. Each time a process is successfully paused, the system updates the status of the process in the internal monitoring status table, marking it from "running" or "suspicious" to "pending isolation," and records the timestamp of the pause operation and the basis for executing the operation (i.e., its isolation priority score). After this series of operations is completed, the identifiers of all successfully paused and marked processes are summarized to form an ordered list, namely the list of isolated malicious processes.

[0064] The steps to obtain the results of malicious process analysis are as follows: Based on an isolated list of malicious processes, the behavior patterns of each process are analyzed to assess potential threats to system security, analyze the relationships between processes and their access to critical system resources, identify patterns that match known malicious behaviors, and obtain abnormal process behavior analysis results. Based on the abnormal process behavior analysis results, the degree of malice of the process is determined, the impact of each process is analyzed, the threat to system stability and user data security is assessed, and malicious process analysis results are generated.

[0065] Specifically, based on the isolated list of malicious processes, the system retrieves detailed snapshot data corresponding to each process identifier in the set of processes to be analyzed, and initiates a multi-dimensional deep analysis process. First, at the behavioral pattern analysis level, the system compares the process's system call sequence with a pre-defined, MITRE-based... The system compares attacks against a Tactical, Technique, and Process (TTP) knowledge base built using the ATT&CK framework. This knowledge base maps known attack techniques to specific system call sequence patterns. For example, a "create scheduled task" action (corresponding to T1053.005) is defined as a call to schtasks.exe or an access sequence to a related COM interface, while a "credential theft" action (corresponding to T1003) is defined as an attempt to read memory from the lsass.exe process. Secondly, at the inter-process correlation analysis level, the system constructs a local process tree centered on the isolated process. By querying the parent process identifier (PPID) of each process, it traces back up to three generations. If its parent or grandparent process is also a known suspicious process or not on the system whitelist, this correlation is recorded as a high-risk indicator. Simultaneously, the system analyzes inter-process communication by examining named pipes, shared memory segments, or network sockets used by the isolated process to identify communication links with other suspicious processes. Furthermore... At the critical system resource access analysis level, the system matches the file paths and registry keys accessed by the process with a predefined list of critical resources. This list categorizes resources within the medical system into three levels based on sensitivity. For example, Level 1 (highest) includes the private key storage file for electronic seals and database connection configuration files; Level 2 includes folders storing bulk patient information and financial statement directories; and Level 3 includes system startup registry keys and security policy configuration items. Finally, the system applies a set of YARA rules to scan the process's memory image and the files it creates. This YARA rule base is continuously updated from public threat intelligence sources and internal security incident analysis, and is specifically designed to identify the binary signatures of known malware families, ransomware, Trojans, and spyware. By combining all the TTPs matched in the above analysis, suspicious process associations, access records to critical resources, and the matched YARA rules, a detailed structured report is generated for each isolated process. These reports are then summarized to obtain the results of the process behavior anomaly analysis.

[0066] Based on the process behavior anomaly analysis results generated in the previous step, the system initiates a deterministic malice assessment and impact analysis process for each process. First, to determine the malice level of a process, the system employs an evidence-based scoring rule engine. This engine assigns a base score to each finding in the process behavior anomaly analysis results. For example, matching a high-confidence YARA rule scores 50 points, accessing a level 1, highest-sensitivity resource scores 30 points, discovering a parent-child relationship with another suspicious process scores 20 points, and matching a MITRE rule scores 20 points. In ATT&CK, persistence technology scores 15 points. It accumulates the scores of all detected malicious processes to obtain a total malicious score. Then, it determines the degree of malice based on a preset malicious score threshold. This threshold is set through statistical analysis of the score distribution of historically confirmed malicious and benign samples. For example, a total score above 80 is identified as "confirmed malicious," 50-80 as "highly suspicious," 20-50 as "moderately suspicious," and below 20 is initially marked as "awaiting verification." Next, the system analyzes the impact on each process, focusing on system stability and data security. For system stability threats, the system assesses their impact on the processes under analysis. The system records resource usage in the process behavior set. If CPU usage consistently exceeds 90% for more than one minute, or memory usage consistently increases by more than 10% of the total system memory, it is classified as a "high stability threat." For user data security threats, the system assesses the highest sensitivity level of the resources accessed. If a Level 1 resource has been accessed, it is classified as a "serious data security threat," and if a Level 2 resource has been accessed, it is classified as a "high data security threat." Finally, the determined level of malice, total malice score, and threat assessment conclusions for system stability and user data security are integrated to generate a final qualitative and quantitative analysis report for each process. All these reports are then aggregated to generate the malicious process analysis results.

[0067] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for protecting privacy information based on smart medical electronic seals, characterized in that, Includes the following steps: Collect operation records and behavioral data of electronic seals to generate behavioral datasets; Feature extraction is performed on the behavioral dataset to extract behavioral features, including access frequency and operation time period, and the extracted behavioral features are generated. Based on the extracted behavioral features, the deviation between the features and the normal pattern is analyzed using a decision tree algorithm to generate behavioral pattern analysis results. Based on the behavioral pattern analysis results, behavioral characteristics that differ from the normal pattern are selected to generate abnormal behavior indicators. The random forest algorithm is applied to analyze the abnormal behavior indicators to identify potential malicious activities and generate potential malicious activity analysis results. Based on the potential malicious activity analysis results, process isolation is performed to suspend and isolate malicious processes and generate a list of isolated malicious processes. The isolated list of malicious processes is reviewed, the behavior and impact of each process are analyzed, and malicious process analysis results are generated.

2. The privacy information protection method based on smart medical electronic seal according to claim 1, characterized in that, The steps for obtaining the behavior dataset are as follows: Identify the frequency of use and operation time of electronic seals, record the log of each seal activity, including the operator's identity and operation time, and form a preliminary operation record set; Based on the preliminary operation record set, the time period and duration of the operation behavior are analyzed, and the environment and context of each operation are recorded to obtain a more complete behavior dataset; Based on the more complete behavioral dataset, data quality standardization and cleaning are performed to remove outliers and redundant data, resulting in a standardized behavioral dataset.

3. The privacy information protection method based on smart medical electronic seal according to claim 1, characterized in that, The steps for obtaining the extracted behavioral features are as follows: Based on the behavioral dataset, the mean, variance, and frequency distribution are calculated to form the extracted behavioral features.

4. The privacy information protection method based on smart medical electronic seal according to claim 1, characterized in that, The steps for obtaining the behavioral pattern analysis results are as follows: Based on the extracted behavioral features, the access frequency and operation time period are classified and stored, the distribution of access frequency in different time intervals is calculated, and the operation time period is time-series segmented and classified to obtain the behavioral feature matrix. Calculate the behavior pattern deviation index based on the behavior feature matrix; Based on the behavior pattern deviation index, a threshold range for normal patterns is set. The deviation index is compared with the threshold range to filter abnormal feature items, classify and record abnormal behavior patterns, and archive them to the corresponding behavior categories to generate behavior pattern analysis results.

5. The privacy information protection method based on smart medical electronic seal according to claim 1, characterized in that, The steps for obtaining the abnormal behavior indicators are as follows: Based on the behavioral pattern analysis results, the abnormal deviation values ​​of all feature items are extracted, feature items with deviations exceeding the normal range are filtered, and the degree of deviation of feature items in different operation periods, operation durations and operation intervals is analyzed to generate a feature anomaly dataset. Calculate the abnormal behavior score based on the aforementioned feature anomaly score dataset; Based on the abnormal behavior score, all feature items are classified, abnormal types are marked, and the distribution of abnormal behavior feature items is recorded to generate abnormal behavior indicators.

6. The privacy information protection method based on smart medical electronic seal according to claim 1, characterized in that, The steps for obtaining the results of the potential malicious activity analysis are as follows: The abnormal behavior indicators are selected as the training set. The number of trees, the maximum depth of each tree, and the randomness parameters of feature selection in the random forest model are configured using the training set. The model training process is then executed to obtain the trained model. The trained model is then used for analysis to generate analysis results on potential malicious activities.

7. The privacy information protection method based on smart medical electronic seal according to claim 1, characterized in that, The steps for obtaining the list of isolated malicious processes are as follows: Based on the analysis results of the potential malicious activities, the process identifiers marked as abnormal are extracted, and the running status, resource consumption and accessed system files of each process are recorded to generate a set of process behaviors to be analyzed. Calculate the process isolation priority based on the set of process behaviors to be analyzed; Based on the process isolation priority, the processes are sorted, a pause operation is performed, and the paused processes are marked as pending isolation, generating a list of isolated malicious processes.

8. The privacy information protection method based on smart medical electronic seal according to claim 1, characterized in that, The steps for obtaining the malicious process analysis results are as follows: Based on the isolated list of malicious processes, the behavior patterns of each process are analyzed to assess the potential threat to system security, analyze the relationships between processes and their access to critical system resources, identify patterns that match known malicious behaviors, and obtain the results of abnormal process behavior analysis. Based on the abnormal process behavior analysis results, the degree of malice of the process is determined, the impact of each process is analyzed, the threat to system stability and user data security is assessed, and malicious process analysis results are generated.

Images