Medical network threat early warning method fusing multi-modal features

Abstract

The invention relates to the field of network security and medical informatization, in particular to a medical network threat early warning method fusing multi-modal features, and the method comprises the steps: obtaining a multi-source data stream of a medical network; constructing a heterogeneous causal time sequence diagram according to the multi-source data stream; generating a flow constraint set by role permission configuration and diagnosis and treatment service path configuration of the medical information system; extracting an evidence chain set, and pruning path extension; extracting a plurality of features from the evidence chain set, and executing gating fusion coding according to modal availability to obtain evidence chain fusion representation; performing cross-modal alignment training to obtain an early warning characterization model; outputting a threat stage and an early warning risk value of each time window, and calculating an early warning risk lower bound; and outputting the threat early warning information. According to the method, role permission configuration and diagnosis and treatment service path configuration are formalized into the process constraint set, and sample construction of evidence chain extraction and cross-modal alignment training is adopted, so that early warning is triggered to realize early warning output of medical network threats.

Description

Technical Field

[0001] This invention relates to the fields of network security and medical informatics, and in particular to a method for early warning of medical network threats that integrates multimodal features. Background Technology

[0002] With the advancement of hospital informatization and interconnection, medical networks typically simultaneously handle various network behaviors, including access to medical information systems, terminal and server operations, and communication with medical IoT devices. When medical networks are compromised, laterally moved, or data is leaked, these behaviors often exhibit chain-like characteristics across devices, business systems, and time windows, and are coupled with access paths for diagnosis and treatment services and role / permission boundaries. Therefore, it is necessary to establish security monitoring methods that can support early warning for medical network scenarios.

[0003] In the prior art, CN107087008A discloses a security monitoring method and system for medical networks: network data is collected by setting up mirror ports on subnet switches; security monitoring equipment performs deep packet inspection on the network data to obtain metadata; a remote server uses machine learning based on the metadata to identify medical devices on the medical network, classify the devices, and establish normal behavior patterns; when abnormal control commands or abnormal behaviors are detected, alarms are generated and isolation can be implemented according to the degree of risk. The above scheme can achieve anomaly detection based on network data and device behavior patterns, but its disclosed content mainly focuses on device identification and behavior pattern determination starting from network-side metadata, without explicitly disclosing: formalizing the role and permission configuration and diagnosis and treatment business path configuration of the medical information system into process constraints, and using these process constraints for sample construction during the extraction and learning process of cross-source behavior chains to support stable risk assessment and evidence chain output for early warning.

[0004] Therefore, the main technical problem to be solved by this invention is: under the condition of multi-source data in medical networks, how to generate process constraints based on the role and permission configuration and diagnosis and treatment business path configuration of medical information systems, and use the process constraints to construct a traceable evidence chain in cross-source association results, while introducing the process constraints into fusion representation learning (including sample construction for cross-modal alignment training) to achieve early warning output of medical network threats. Summary of the Invention

[0005] To overcome the aforementioned technical deficiencies, the present invention aims to provide a medical network threat early warning method that integrates multimodal features. This invention formalizes role-permission configuration and treatment business path configuration into a set of process constraints, and uses this set of process constraints to constrain the extraction of evidence chains from heterogeneous causal time sequence graphs and the construction of samples for cross-modal alignment training. Based on this evidence chain fusion representation, threat stages and risk assessments are realized, triggering early warnings to achieve early warning output for medical network threats.

[0006] This invention discloses a medical network threat early warning method that integrates multimodal features, comprising:

[0007] Acquire multi-source data streams from the medical network and perform time synchronization correction and time window segmentation. The multi-source data streams include at least network communication data, host audit data, medical information system application log data, and medical IoT device communication data.

[0008] Entity parsing and cross-source association are performed on multi-source data streams to construct a heterogeneous causal time sequence graph. The nodes of the heterogeneous causal time sequence graph include medical business entity nodes, asset nodes and session nodes. The edges of the heterogeneous causal time sequence graph include access edges, communication edges and data read and write edges, and the edges carry timestamps and causal association weights.

[0009] The set of process constraints is generated by the role and permission configuration and diagnosis and treatment business path configuration of the medical information system. The set of process constraints limits the allowed sequence of node types and edge types.

[0010] Based on the process constraint set, an evidence chain set is extracted from the heterogeneous causal time sequence graph, and the path expansion is pruned based on the causal association weight.

[0011] Network communication features, host behavior features, service operation features, and device instruction features are extracted from the evidence chain set, and gating fusion coding is performed according to modal availability to obtain the evidence chain fusion representation;

[0012] Positive sample pairs are constructed using cross-modal representations of the same evidence chain, and negative sample pairs are constructed using representations of paths that do not satisfy the process constraint set or different evidence chains. Cross-modal alignment training is then performed to obtain the early warning representation model.

[0013] The warning characterization model is used to output the threat stage and warning risk value for each time window, and the lower bound of the warning risk is calculated based on the calibration sample set, which is a set of time window samples collected and labeled in advance.

[0014] When the threat phase meets the preset phase transition rules and the lower bound of the warning risk meets the preset triggering rules, the threat warning information containing the warning object, warning level, and evidence chain fragments is output.

[0015] Preferably, the process constraint set is generated by the role-resource permission mapping table and the diagnosis and treatment business path transfer table. The role-resource permission mapping table is used to limit the set of allowed access edge types from medical business entity nodes to asset nodes, and the diagnosis and treatment business path transfer table is used to limit the sequence of allowed edge types corresponding to business operation types. The set of allowed access edge types and the sequence of allowed edge types are used together as the constraint conditions for evidence chain extraction and the judgment conditions for constructing negative sample pairs.

[0016] Preferably, the causal association weight is the edge weight. ,and

[0017]

[0018] in, The cross-source identifier mapping consistency score;

[0019]

[0020] This represents the time difference between the two events corresponding to this edge. This is the upper bound of the preset time difference;

[0021]

[0022] and These are the context field sets for the two events, The number of elements in the set.

[0023] Preferably, pruning includes: weighting the causal association edges of adjacent edges in the chain of evidence. The chain confidence is obtained by performing a cumulative multiplication:

[0024]

[0025] in The number of edges contained in the chain of evidence; when the chain confidence level is... Less than the preset threshold The path extension will be terminated upon reaching a preset threshold. It is determined by the confidence distribution of the normal chain of evidence in the calibration sample set.

[0026] Preferably, the extraction of the evidence chain set includes: starting from the medical business entity node or asset node, gradually expanding along the edge type sequence that satisfies the process constraint set, and making the timestamps of the edges within the evidence chain monotonically increase, so as to obtain the evidence chain arranged in chronological order.

[0027] Preferably, the gated fusion coding includes: establishing a modality availability flag for each modality. ,in and Modal index; calculate fusion weights:

[0028]

[0029] And for the four modal feature vectors The fusion vector is obtained by weighted summation.

[0030]

[0031] in, This is a feature vector for network communication. This is the host behavior feature vector. This is a feature vector for business operations. This is a device instruction feature vector. It is the evidence chain fusion representation or its input vector.

[0032] Preferably, cross-modal alignment training employs contrastive loss, and applies it to the two modal representations of the same evidence chain. and Calculate similarity:

[0033]

[0034] in For vector dot product, For each positive sample pair, the vector norm is used; and for each positive sample pair... Its corresponding negative sample set Calculate the loss:

[0035]

[0036] in, To represent the negative samples corresponding to the positive samples, For preset temperature parameters, This is the single-sample contrast loss.

[0037] Preferably, the construction of negative sample pairs includes hard negative sample construction: performing minimum editing perturbation on the evidence chain that satisfies the process constraint set to generate a perturbation path, wherein the minimum editing perturbation includes at least one or more of edge type replacement, edge direction reversal and timestamp exchange; and representing the path in the perturbation path that does not satisfy the process constraint set as one side sample of the negative sample pair.

[0038] Preferably, the evidence chain fusion encoding includes chain sequence encoding and graph context encoding: chain sequence encoding uses the event type embedding vector and time interval embedding vector within the evidence chain as input to obtain the chain vector; graph context encoding uses the local subgraph covered by the evidence chain as input to obtain the context vector; and attention fusion is performed on the chain vector and the context vector to obtain the evidence chain fusion representation.

[0039] Preferably, the threat stage satisfies the stage set. and with stage transition allow matrix Constrain adjacent time window stages, where This indicates that it is allowed by stage Migration to Stage , This indicates that migration is not allowed. When migration is deemed not allowed, the current time window phase is replaced with the allowed phase that maximizes the warning risk value, so as to output a threat phase sequence that satisfies the preset phase migration rules.

[0040] Preferably, the lower bound of the early warning risk is: And calculated from the calibration sample set: for the calibration sample set... Calculate the residuals for each sample:

[0041]

[0042] And calculate the quantile values:

[0043]

[0044] Furthermore, regarding the time window calculate:

[0045]

[0046] in, For the first The warning risk value for each calibration sample. For the first The true labeled value of each calibration sample, For preset signal parameters and , For time windows The warning risk value, For time windows The lower limit of the early warning risk.

[0047] Preferably, the preset triggering rules include a criticality adaptive threshold: configuring criticality for the assets corresponding to the warning object. ,in Set discrete levels; and set trigger thresholds:

[0048]

[0049] in, and These are preset parameters; when The system determines whether the preset triggering rules are met.

[0050] Preferably, determining the evidence chain fragment includes contribution tracing: tracing the contribution of the first fragment in the evidence chain... Calculating the contribution of a strip edge

[0051]

[0052] in, For including the first The warning risk value of the strip edge, To remove the first The early warning risk value is recalculated after the edge is removed; the contribution level is selected. Edges that meet preset conditions and their corresponding original log fragments are used as evidence chain fragments.

[0053] Preferably, cross-modal alignment training employs collaborative training in multi-medical institution scenarios: each medical institution trains its local model update based on evidence chain fusion representation. The data is then uploaded to the aggregation end. The aggregation end performs pruning on each local model update and calculates the similarity between each local model update and the updated median vector to filter out abnormal updates with similarity below a threshold. Then, the remaining updates are weighted and aggregated to update the global early warning representation model. The updated median vector is the vector calculated based on the median of each local model update.

[0054] Preferably, the method further includes drift monitoring and calibration updates: updating the feature histograms of recent time windows. Feature histogram of the calibration sample set Calculate distribution distance

[0055]

[0056] in For histogram binning indexing; when Greater than the preset threshold Update the calibration sample set and recalculate the quantile values ​​mentioned above. To update the lower limit of early warning risks.

[0057] Compared with existing technologies, the above technical solution has the following advantages:

[0058] 1. Existing medical network threat early warning systems often rely on a single modality (such as only network metadata or only abnormal device commands), resulting in a high number of false alarms and high false negatives, and making it difficult to cover the complex link of "business privilege escalation - host landing - external connection and transmission". This invention acquires network communication data, host audit data, medical information system application log data and medical IoT device communication data, performs time synchronization correction and time window segmentation, constructs a heterogeneous causal time sequence diagram, extracts evidence chains under process constraint set constraints and integrates multimodal features, thereby improving the detection capability of cross-system, multi-stage complex threats and reducing false alarms.

[0059] 2. Existing methods typically only provide alarm scores or single-point anomaly indicators, which are difficult to explain "why an alarm was triggered" and difficult to quickly locate the handling point. This invention locates the key edge based on the contribution of evidence chain fragments and outputs the original record identifier or summary corresponding to the key edge, thereby enhancing the interpretability of the warning and improving the efficiency of security personnel review and handling.

[0060] 3. Existing methods often use fixed or empirical thresholds for early warning, which are easily affected by sample noise, labeling errors, and business fluctuations, resulting in unstable early warnings. This invention constructs a lower bound for early warning risk based on the residual quantile statistics of the calibration sample set and combines it with a criticality adaptive threshold to trigger early warnings, thereby improving the robustness and controllability of early warning triggering.

[0061] 4. Existing anomaly detection-based solutions often suffer from false alarms triggered by "legitimate high-frequency operations" or "unauthorized links" being drowned out by noise in environments with complex medical business processes and significant differences in role permissions. This invention generates a set of process constraints by configuring role-resource permissions and medical business paths, and uses the set of process constraints to impose constraints in evidence chain extraction, pruning, and hard negative sample construction, thereby enhancing the ability to identify unauthorized business and abnormal paths and suppressing noise from legitimate operations.

[0062] 5. Existing cross-source association often relies on single-field matching or coarse-grained association, which is prone to association errors due to timing deviations, lease changes, or multiple terminals sharing accounts. This invention performs anchor event offset estimation and compensation on multi-source data and maintains mapping tables such as user-account, client address-host, and device-gateway to perform consistent cross-source association, thereby improving the accuracy of cross-source association and reducing false positives and false negatives caused by association deviations.

[0063] 6. Existing methods are prone to path combination explosion when expanding the evidence chain, resulting in high computational overhead and insufficient real-time performance. This invention calculates edge weights and performs pruning based on chain confidence and quantile thresholds, thereby controlling the size of candidate evidence chains and improving the real-time performance and resource utilization efficiency of online early warning.

[0064] 7. Existing solutions exhibit significant performance degradation when some modalities are missing (e.g., terminal auditing is temporarily unavailable or device commands are unavailable); this invention performs gated fusion based on modal availability flags and generates a fusion vector by weighting multimodal features, thereby improving stability in modal-missing scenarios.

[0065] 8. Existing solutions are prone to distribution drift after business upgrades, asset migrations, or network policy changes, which can lead to threshold failure. This invention calculates the distribution distance between the recent feature histogram and the calibration feature histogram and updates the calibration sample set and quantile values ​​when the drift threshold is exceeded, thereby reducing the impact of drift on the stability of the early warning system and extending the model's validity period.

[0066] 9. Existing multi-institution collaborative training is easily affected by abnormal updates or differences in data quality, leading to global model degradation. This invention filters out abnormal updates at the aggregation end based on the mid-vector of the update and a similarity threshold, and weights and aggregates the remaining updates, thereby improving the stability of collaborative training and the stability of the global model. Attached Figure Description

[0067] Figure 1 A schematic diagram illustrating how the lower bound of early warning risk changes over time;

[0068] Figure 2 This is a diagram illustrating the precision-recall curve.

[0069] Figure 3 This is a schematic diagram illustrating the change in distribution distance over time.

[0070] Figure 4 This is a schematic diagram illustrating the steps of a medical network threat early warning method that integrates multimodal features according to the present invention. Detailed Implementation

[0071] The advantages of the present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments.

[0072] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure as detailed in the appended claims.

[0073] The terminology used in this disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The singular forms “a,” “the,” and “the” as used in this disclosure and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0074] It should be understood that although the terms first, second, third, etc., may be used in this disclosure to describe various information, such information should not be limited to these terms. These terms are used only to distinguish information of the same type from one another. For example, without departing from the scope of this disclosure, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0075] In the description of this invention, it should be understood that the terms "longitudinal", "lateral", "up", "down", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0076] In the description of this invention, unless otherwise specified and limited, it should be noted that the terms "installation", "connection" and "linking" should be interpreted broadly. For example, they can refer to mechanical or electrical connections, or internal connections between two components. They can be direct connections or indirect connections through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms according to the specific circumstances.

[0077] In the following description, suffixes such as "module," "part," or "unit" used to denote elements are used only for the convenience of the description of the invention and have no specific meaning in themselves. Therefore, "module" and "part" can be used interchangeably.

[0078] See Figure 4As shown in this embodiment, a medical network threat early warning method integrating multimodal features is provided, including: acquiring multi-source data streams of the medical network and performing time synchronization correction and time window segmentation, wherein the multi-source data streams include at least network communication data, host audit data, medical information system application log data, and medical IoT device communication data; performing entity parsing and cross-source association on the multi-source data streams to construct a heterogeneous causal time sequence graph, wherein the nodes of the heterogeneous causal time sequence graph include medical business entity nodes, asset nodes, and session nodes, and the edges of the heterogeneous causal time sequence graph include access edges, communication edges, and data read / write edges, and the edges carry timestamps and causal association weights; generating a process constraint set from the role permission configuration and diagnosis and treatment business path configuration of the medical information system, wherein the process constraint set limits the allowed node type sequence and edge type sequence; and applying the process constraint set to the heterogeneous causal time sequence graph. The system extracts a set of evidence chains and prunes path expansion based on causal association weights. It extracts network communication features, host behavior features, business operation features, and device instruction features from the evidence chain set and performs gated fusion coding according to modal availability to obtain a fused representation of the evidence chains. Positive sample pairs are constructed using cross-modal representations of the same evidence chain, and negative sample pairs are constructed using representations of paths that do not satisfy the process constraint set or different evidence chains. Cross-modal alignment training is then performed to obtain an early warning representation model. The early warning representation model outputs the threat stage and early warning risk value for each time window and calculates the lower bound of the early warning risk based on a calibration sample set, where the calibration sample set is a pre-collected and labeled set of time window samples. When the threat stage meets a preset stage transition rule and the lower bound of the early warning risk meets a preset triggering rule, threat early warning information containing the early warning object, early warning level, and evidence chain fragments is output. Specifically:

[0079] This embodiment discloses a medical network threat early warning method integrating multimodal features. The method is deployed on a hospital-side security analysis platform. The security analysis platform establishes data channels with network mirroring acquisition devices, host auditing agents, medical information system log acquisition components, medical IoT gateways, and configuration data export components to acquire multi-source data streams from the medical network and perform time synchronization correction, time window segmentation, cross-source correlation modeling, and early warning output. For ease of reproduction, this embodiment uses a production network of a tertiary hospital as an example environment. The production network includes core switches, business area switches, office area switches, and isolation area switches. The medical information system includes at least a unified identity authentication service, HIS, EMR, LIS, and PACS. Assets include at least business servers, medical terminals, and networked medical devices. The networked medical devices are connected via a medical IoT gateway, and the device management platform maintains the device type and command code mapping.

[0080] This example will describe the multi-source data and acquisition methods in detail, as follows:

[0081] To ensure that multi-source data can be verified and parsed consistently, this embodiment establishes a data dictionary for four types of data sources, forming a correspondence of "collection location - collection method - key fields - field meaning", as shown in Table 1.

[0082] Four types of data source data dictionary (example) Table 1

[0083]

[0084] It should be noted that, to avoid ambiguity in the understanding of terminology and to ensure consistency in the use of symbols, the following terms and symbols are uniformly explained in this embodiment: The calibration sample set is a set of samples used to determine the calculation parameters for the lower bound of the warning risk. The calibration sample set consists of historical time window samples, and each time window sample contains at least the multi-source data for the corresponding time window, the warning risk value output by the model, and the real labeled value confirmed by manual or rule-based methods. The real labeled value is 0 for normal and 1 for threat. The warning risk value is the risk score output by the security analysis platform for the current time window, and the warning risk value ranges from 0 to 1. The quantile value is the threshold obtained by performing quantile statistics on the residual set of the calibration sample set. The quantile value is used to construct the lower bound of the warning risk. The evidence chain is a path sequence that satisfies the set of process constraints and whose edge timestamps monotonically increase within the same time window. The minimum edit perturbation is the perturbation chain obtained by performing a single-step edit operation on an evidence chain. The single-step edit operation includes at least one of the following three operations: performing edge type replacement on an edge, performing direction reversal on an edge, and performing timestamp swapping on two adjacent edges. Each perturbation performs only one single-step edit operation.

[0085] It should be noted that the acquisition of multi-source data streams will be described in detail in this embodiment, as follows:

[0086] Acquisition of network communication data:

[0087] In this embodiment, a mirroring port is configured on the core switch to perform bidirectional mirroring of the uplink ports in the service area and the uplink ports in the isolation area. The mirrored traffic is input into the network mirroring acquisition device. The network mirroring acquisition device uses a packet capture component to receive packets and aggregates them into session records according to the five-tuple of "source address, destination address, source port, destination port, and protocol type". The idle timeout is set to 15 seconds and the maximum session duration is set to 60 seconds. The device also parses the DNS lookup name, the server name indication field in the TLS handshake, and the available fields in the HTTP header. The session records are written to the session cache queue in a structured form and a session identifier is assigned for subsequent association. Table 2 provides an example of a network session record related to the same time period (anonymized).

[0088] Example of network session log (illustrative) Table 2

[0089]

[0090] Obtaining host audit data:

[0091] This embodiment deploys a host audit agent on critical business servers and medical terminals to collect login events, process creation events, network connection events, file read / write events, and privileged call events, and outputs them in a unified structured format. For Windows terminals, it collects typical security events and process / network / file behaviors; for Linux servers, it collects audit records corresponding to system calls such as execve, connect, open, and setuid. The structured fields include at least the host identifier, account identifier, event timestamp, event type, process image path, parent process image path, command-line arguments, target address, target port, and file path. Table 3 provides two examples of host audit events.

[0092] Example of Host Audit Event (Illustrative) Table 3

[0093]

[0094] Acquisition of application log data in medical information systems:

[0095] This embodiment subscribes to the unified identity authentication service and the log outputs of HIS, EMR, LIS, and PACS through the medical information system log collection component. It parses logs of different formats and standardizes them into a unified set of fields. These standardized fields include at least user identifier, role identifier, department identifier, business system identifier, business operation type, business object identifier, access resource identifier, client address, session identifier, and operation result code. Table 4 provides two sample business operation logs, including medical record query operations and data export operations.

[0096] Example of Medical Information System Application Log (Illustrative) Table 4

[0097]

[0098] Meanwhile, the configuration data export component periodically exports role permission configurations and diagnosis and treatment business path configurations from the system configuration library, forming role-resource permission mapping tables and diagnosis and treatment business path transfer tables respectively, and stores them in the configuration storage area.

[0099] Acquisition of communication data from medical IoT devices:

[0100] In this embodiment, the medical IoT gateway records device connection and command interaction metadata, and maps the original command codes to command categories according to the command code mapping table of the device management platform. The structured fields include at least device identifier, device type, gateway identifier, command code, command category identifier, command direction, session start / end time, and command frequency. Table 5 provides an example of a device communication metadata record.

[0101] Example of communication data from medical IoT devices (illustrated) Table 5

[0102]

[0103] It should be noted that the time synchronization correction will be described in detail in this embodiment, as follows:

[0104] This embodiment employs a time synchronization method combining "basic time synchronization + server-side offset estimation and compensation." First, the network mirror acquisition device, host audit agent, business system server, and medical IoT gateway are all configured with network time services, with a synchronization period of 300 seconds, and dual time source redundancy is set. Second, to eliminate residual biases introduced by different acquisition links, this embodiment estimates and compensates for the time offsets of each source on the server side using anchor events. Anchor events are selected by matching successful login events with events establishing new sessions with the same client address for authentication services. After accumulating at least 200 anchor samples from the same source, the median of the time difference sample set is taken as the offset. Example: The unified identity authentication log records a successful login timestamp of 15:20:05.900. The network side first observes a new session from the same client address 10.10.12.34 to the authentication service address 10.10.20.10 with a timestamp of 15:20:05.120, resulting in a time difference of 0.780 seconds. The offset is obtained by taking the median of the sample set from this source. For example, if the network source offset is +0.790 seconds, then the network session record timestamp is compensated by "timestamp + 0.790 seconds". Similarly, the host audit source offset is obtained as follows. The offsets are 0.120 seconds for business log sources and +0.260 seconds for IoT gateway sources, and are compensated accordingly to ensure that multi-source events fall under a unified time base.

[0105] It should be noted that the time window segmentation will be described in detail in this embodiment, as follows:

[0106] To accommodate different attack durations and alarm response requirements, this embodiment can set the window length to 10 to 300 seconds and the sliding step size to 5 to 120 seconds. In this example, the window length is set to 60 seconds and the sliding step size to 30 seconds, with 00:00:00 of the current day as the window start time. For any event, the window index is calculated using the time-corrected timestamp. To avoid the chain behavior being broken due to window boundaries, this embodiment allows events to be written to two adjacent overlapping windows simultaneously, so that cross-window behavior can form a complete chain of evidence in at least one window.

[0107] It should be noted that the mapping table will be described in detail in this embodiment, as follows:

[0108] To ensure that cross-source association does not rely on subjective inference, this embodiment maintains three types of mapping tables and stores them in the configuration storage area, as shown in Tables 6 to 8.

[0109] Example Table 6: User Identifier-Account Identifier Mapping Representation

[0110]

[0111] Example Table 7 of Client Address-Host Identifier Mapping

[0112]

[0113] Example of Device Identifier-Gateway Identifier Mapping Table 8

[0114]

[0115] It should be noted that the process constraint set will be described in detail in this embodiment, as follows:

[0116] Role-Resource Permission Mapping Table:

[0117] The role-resource permission mapping table is used to limit the allowed operations, allowed security domains, and allowed time periods for a role to access resources, as shown in Table 9.

[0118] Example Table 9 of Role-Resource Permission Mapping

[0119]

[0120] Medical Service Pathway Transfer Table:

[0121] The diagnosis and treatment business path transfer table is used to limit the allowed successor relationships and allowed system call sets for business operation types, as shown in Table 10.

[0122] Table 10 shows an example of the shift in the medical service pathway.

[0123]

[0124] Derivation of allowed and forbidden sequences:

[0125] This embodiment generates a set of process constraints by combining Tables 9 and 10, which includes allowed and prohibited node type sequences and edge type sequences. An example of an allowed sequence is: Role-Nurse executes "Medical Record Query (Res-EMR-Query) → Test Result View → Medical Order View" during working hours, and the access occurs within the business area security domain; this sequence is written into the allowed sequence library. An example of a prohibited sequence is: Role-Nurse directly executes "Medical Record Query → Batch Export (Res-EMR-Export and operation = Batch Export) → External Upload." Based on the constraints in Table 9 that batch export is not allowed and Table 10 that batch export requires approval before uploading for archiving, this sequence is written into the prohibited sequence library and used as a basis for judgment in evidence chain extraction and hard negative sample construction.

[0126] It should be noted that the construction of the heterogeneous causal time series graph will be described in detail in this embodiment, as follows:

[0127] Within each time window, this embodiment performs entity resolution and cross-source association to construct a heterogeneous causal sequence graph. Nodes include at least medical business entity nodes, asset nodes, session nodes, and data object nodes; edges include at least access edges, communication edges, and data read / write edges, and each edge is assigned a timestamp and edge weight.

[0128] Cross-source association example:

[0129] Taking AppLog-001 in Table 4 as an example, the user identifier usr-100728 is mapped to the account identifier acct-nurse-07 through Table 6, and the client address 10.10.12.34 is mapped to the host identifier Host-WS-031 through Table 7. Therefore, AppLog-001 is associated with HostEvt-001 and HostEvt-002 in Table 3 to the same medical business entity node and the same asset node. Furthermore, the destination address 10.10.20.10 of HostEvt-002 matches the destination address 10.10.20.10 of the session record in Table 2, thereby incorporating the network session SessNet-20251224-152005-000137 into the same chained context.

[0130] In this embodiment, the edge weights are expressed as a product:

[0131]

[0132] The edge weight is The cross-source identifier mapping consistency score is The score for proximity in time is The context field consistency score is The time proximity score is calculated using the following formula:

[0133]

[0134] Wherein, the time difference is The upper bound of the time difference is In this example, Seconds. Context field consistency score is calculated using the following formula:

[0135]

[0136] The set With sets These are the context fields for the two events. In this example, the context fields are "business system identifier, access resource identifier, business object identifier, and client address".

[0137] It should be noted that, for ease of understanding, this embodiment will provide an example of the calculation process for the weights of opposite edges, as follows:

[0138] Calculate the edge weight corresponding to "Business Operation Log AppLog-001 → Host Process Creation Event HostEvt-001". Cross-source identifier mapping consistency score: AppLog-001, mapped through Table 6, yields account acct-nurse-07, which matches the account HostEvt-001. Time proximity score: AppLog-001 timestamp 15:20:06.900, HostEvt-001 timestamp 15:20:07.350, time difference Seconds, substituting, we get:

[0139]

[0140] Context field consistency score: Let

[0141]

[0142]

[0143] but , ,get:

[0144]

[0145] Therefore, the edge weight is:

[0146]

[0147] The edge weight is written into the edge attributes of the heterogeneous causal time series graph for subsequent evidence chain expansion and pruning.

[0148] It should be noted that this embodiment extracts the evidence chain set from the heterogeneous causal time sequence graph based on the process constraint set. The evidence chain satisfies the process constraint set and the edge timestamps are monotonically increasing; during path expansion, expansion terminates when the node type sequence or edge type sequence no longer satisfies the process constraint set. To control the number of paths, this embodiment calculates the chain confidence and prunes the branches. The chain confidence is calculated using the following formula:

[0149]

[0150] Among them, the chain confidence level is , No. The edge weight is The number of sides is Example: If the chain of evidence contains three edges with edge weights of 0.80, 0.60, and 0.90 respectively, then the chain confidence is:

[0151]

[0152] Pruning threshold Determined by the confidence distribution of the normal chain of evidence in the calibration sample set, the 5th percentile of the confidence level of the normal chain of evidence is taken as... ,For example The path expansion is terminated when the chain confidence is less than 0.30.

[0153] It should be noted that this embodiment will describe the multimodal feature extraction and gated fusion encoding in detail, as follows:

[0154] For each chain of evidence, this embodiment extracts network communication feature vectors, host behavior feature vectors, service operation feature vectors, and device instruction feature vectors, and performs gating fusion based on modal availability. Modal availability is indicated by... ,in The fusion weights are calculated using the following formula:

[0155]

[0156] The fusion vector is calculated using the following formula:

[0157]

[0158] The network communication feature vector is: The host behavior feature vector is The business operation feature vector is The device instruction feature vector is The fusion vector is .

[0159] Additionally, for ease of understanding, the following example is provided in this embodiment: if a certain chain of evidence does not involve device communication data, then... , , , ,get , For ease of demonstration, let , , Then the fusion vector is:

[0160]

[0161] It should be noted that the composition of the early warning representation model will be described in detail in this embodiment, as follows:

[0162] The early warning representation model includes at least a chain sequence encoding module, a graph context encoding module, and a fusion discriminant module. The chain sequence encoding module encodes the event type sequence and the time interval between adjacent events within the evidence chain, outputting a chain sequence vector. The graph context encoding module encodes the local subgraph covered by the evidence chain, outputting a graph context vector. The fusion discriminant module fuses the chain sequence vector and the graph context vector to obtain a fused representation of the evidence chain and outputs the early warning risk value and threat stage accordingly. In one optional implementation, the chain sequence encoding module uses a sequence encoding network to encode the event type embedding vector and the time interval embedding vector; the graph context encoding module uses a graph encoding network to aggregate and encode the node and edge attributes of the local subgraph; and the fusion discriminant module uses a weighted fusion or attention-weighted fusion method to fuse the chain sequence vector and the graph context vector, inputting the fusion result into the classification and regression output layer to obtain the early warning risk value and threat stage. The specific network form of the above modules can be selected according to deployment resources and data scale, but all follow the data structure, input-output relationship, and training method disclosed in this embodiment.

[0163] It should be noted that this embodiment will describe the cross-modal alignment training in detail, as follows:

[0164] This embodiment constructs positive sample pairs using cross-modal representations of the same evidence chain, and constructs negative sample pairs using paths that do not satisfy the process constraint set or different evidence chain representations, and introduces a hard negative sample construction mechanism. In hard negative sample construction, a single-step editing operation is performed on any evidence chain that satisfies the process constraint set to obtain a perturbation chain. The single-step editing operation includes at least one of the following: edge type replacement, edge direction reversal, and timestamp exchange, and only one operation is performed per perturbation. When the perturbation chain does not satisfy the process constraint set or does not satisfy the condition of monotonically increasing edge timestamps, the representation sample corresponding to the perturbation chain is taken as a hard negative sample.

[0165] Similarity is calculated using the following formula:

[0166]

[0167] The comparative loss is calculated using the following formula:

[0168]

[0169] The temperature parameter is: .

[0170] Additionally, it should be noted that, for ease of understanding, the following example calculation will be given in this embodiment: taking the positive sample pair representation vector. , Then the dot product norm The similarity is:

[0171]

[0172] Take the negative sample representation vector , The calculated similarity is approximately 1. 2, Take temperature parameters. ,but:

[0173]

[0174]

[0175]

[0176] Substituting the values, we obtain the comparison loss:

[0177]

[0178] It should be noted that this embodiment will provide a detailed description of the threat phase, phase transition constraints, and early warning triggering, as follows:

[0179] This embodiment outputs a threat stage and a warning risk value for each time window, and calculates a lower bound for the warning risk based on a calibration sample set to trigger the warning. The threat stage set is represented as:

[0180]

[0181] In this example, these represent the reconnaissance phase, intrusion phase, lateral movement phase, and data transfer phase, respectively. Phase transitions allow the matrix to... This indicates that it is allowed by stage Migration to Stage ,by This indicates that migration is not allowed. When a migration is detected to be not allowed, the current time window phase is replaced with the phase that maximizes the warning risk value among the allowed phases, so as to obtain a phase sequence that satisfies the rules.

[0182] The lower bound of the early warning risk is constructed using the following quantile: for the first... For each time window sample, record the model output warning risk value. The actual labeled value is The residual is calculated using the following formula:

[0183]

[0184] Selecting quantile parameters ,in In this embodiment, the value can be between 0.80 and 0.99; the quantile value is determined by the following formula:

[0185]

[0186] For the current time window The lower bound of the early warning risk is calculated using the following formula:

[0187]

[0188] Example calculation: The set of calibration sample residuals is:

[0189]

[0190] The sorting yields:

[0191]

[0192] When taking When the quantile value is taken as 0.35, that is... If a certain time window outputs ,but .

[0193] The trigger threshold adopts a criticality adaptive threshold, which is calculated using the following formula:

[0194]

[0195] in

[0196] For criticality level, and These are preset parameters. Example: Take... , When the warning target is a core business server and is critical hour:

[0197]

[0198] When satisfied Furthermore, threat warning information is output when the stage transition satisfies the allowable matrix constraint.

[0199] It should be noted that this embodiment will provide a detailed description of the backtracking of the contribution of evidence chain fragments, as follows:

[0200] To enhance the interpretability of the early warning, this embodiment performs contribution backtracking on the evidence chain. The contribution of the iii-th edge in the evidence chain is calculated as follows:

[0201]

[0202] in To remove the first The warning risk value is recalculated after the edge is removed. Example: If After removing the batch exported edges, the result is recalculated. ,but:

[0203]

[0204] In this embodiment, edges with a contribution greater than a preset threshold (e.g., 0.10) are designated as key edges, and the original record identifiers or summaries corresponding to the nodes adjacent to the key edges are output to form evidence chain fragments for verification.

[0205] This embodiment will describe the collaborative training of multiple medical institutions in detail, as follows:

[0206] In a multi-institutional healthcare setting, each institution trains its local model update based on the evidence chain fusion representation and uploads it to the aggregation endpoint. The aggregation endpoint prunes the local model updates and calculates the similarity between each local model update and the updated median vector. The updated median vector is the vector calculated based on the element-wise median of each local model update. The similarity is calculated in one optional implementation using the following formula:

[0207]

[0208] in Update vectors for the local model. To update the median vector; the aggregation end will select vectors with similarity less than a threshold. Local model updates are identified as abnormal updates and filtered out. The remaining updates are then weighted and aggregated to update the global early warning representation model and distributed to various medical institutions.

[0209] It should be noted that drift monitoring and calibration updates will be described in detail in this embodiment.

[0210] This embodiment monitors drift between recent data and the calibration sample set. The stable characteristics of recent time windows are statistically analyzed into a recent feature histogram. The calibration sample set is statistically analyzed into a calibration feature histogram. The distribution distance is calculated using the following formula:

[0211]

[0212] in This is the binning index. Example: If the three-bin histogram is... , ,but:

[0213]

[0214] When the distribution distance exceeds the drift threshold, the calibration sample set is updated and the quantile values ​​are recalculated. This updates the lower bound calculation of early warning risks to reduce the impact of drift.

[0215] Comparative experimental design:

[0216] To compare with existing solutions, this embodiment sets up a comparative scheme. The comparative scheme only identifies medical devices and establishes normal device behavior patterns based on network-side metadata, triggering alarms for abnormal control commands or behaviors and implementing isolation when the risk is high. The method in this embodiment integrates network communication data, host audit data, medical information system application log data, and medical IoT device communication data, and introduces role permission configuration and diagnosis and treatment business path configuration to generate a set of process constraints. The set of process constraints drives the extraction of evidence chains and the construction of hard negative samples. At the same time, it triggers warnings and outputs evidence chain fragments by using the lower bound of warning risk and stage migration rules. To ensure fairness, both methods use the same batch of de-identified samples, the same time window division, and the same labeling caliber. The comparative scheme also performs threshold scanning to generate precision-recall curves.

[0217] The evaluation metrics are calculated as follows: precision equals the number of true positives divided by the sum of the number of true positives and false positives; recall equals the number of true positives divided by the sum of the number of true negatives and false negatives; F1 score is the harmonic mean of precision and recall; average warning lead time is the difference (in minutes) between the first warning trigger time and the threat labeling start time. Statistical results are shown in Table 11.

[0218] Table 11: Statistical Results of Comparative Experiments on Different Schemes (Example)

[0219]

[0220] In addition, to visually demonstrate the difference between the warning trigger time and the stability of risk estimation, please refer to... Figure 1 As shown, Figure 1This diagram illustrates the change of the lower bound of early warning risk over time. The data source and generation method for point 1 are as follows: Figure 1 Using attack replay scenarios as the data source, the early warning risk value is output by the early warning characterization model for each time window. According to the calibration sample set Obtain quantile values ​​and calculate the lower bound of early warning risk. The maximum value of the lower bound of the warning risk for multiple time windows within the same minute is taken as the curve point for that minute, resulting in the curve of the method in this embodiment; the comparison scheme generates a comparison curve under the same window division and the same quantile calculation caliber; the trigger threshold line is... The result is calculated and marked with a horizontal dashed line. Figure 1 The graph is defined as follows: the horizontal axis represents time (minutes), the vertical axis represents the lower bound of the warning risk; the curve represents the change of the lower bound of risk over time, and the horizontal dashed line represents the trigger threshold. When the lower bound of the warning risk exceeds the trigger threshold and the stage transition meets the allowable matrix constraint, the warning output condition is met, so as to intuitively reflect the difference between the warning trigger time and the stability of risk estimation.

[0221] Meanwhile, to reflect the overall trade-off in detection performance at different thresholds, please refer to... Figure 2 As shown, Figure 2 This is a diagram illustrating the precision-recall curve. Figure 2 Data sources and generation methods: Figure 2 Using the same batch of playback and manually labeled samples as data sources, multiple trigger thresholds were scanned, and at each threshold, the results were categorized as "whether the condition is met". Furthermore, the system determines whether to output an alert based on whether the stage transition satisfies the constraint, and calculates the precision and recall rates by counting the number of true positives, false positives, and false negatives. The system forms curves from each threshold point and connects them to obtain the PR curve. This embodiment and the comparison scheme generate corresponding curves respectively. Figure 2 The graph means: the horizontal axis represents recall and the vertical axis represents precision. The closer the curve is to the upper right corner, the higher the precision can be while maintaining a high recall, reflecting the overall trade-off between detection performance at different thresholds.

[0222] Furthermore, see Figure 3 As shown, Figure 3 This is a schematic diagram illustrating the change in distribution distance over time. Figure 3 Data sources and generation methods: Figure 3 Using recent time window feature statistics summarized by day as the data source, a recent feature histogram is constructed by selecting stable features. A calibration feature histogram is constructed using the calibration sample set. ,according to Calculate the daily distribution distance and plot the curve, with the drift threshold marked by a horizontal dashed line; when the distribution distance exceeds the drift threshold, trigger an update of the calibration sample set and recalculate the quantile values. . Figure 3 The graph means: the horizontal axis represents the number of days, the vertical axis represents the distribution distance, the curve reflects the degree of deviation of the recent business distribution relative to the calibration sample set, the horizontal dashed line is the drift threshold, when the curve exceeds the threshold it indicates that a significant distribution shift has occurred, and the calibration sample set and quantile values ​​need to be updated to maintain the stability of the early warning.

[0223] It should be noted that the embodiments of the present invention have better implementability and are not intended to limit the present invention in any way. Any person skilled in the art may use the above-disclosed technical content to change or modify it into equivalent effective embodiments. However, any modifications or equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall still fall within the scope of the technical solution of the present invention.

Claims

1. A method for early warning of medical network threats by integrating multimodal features, characterized in that, include: Acquire multi-source data streams from the medical network and perform time synchronization correction and time window segmentation. The multi-source data streams include at least network communication data, host audit data, medical information system application log data, and medical IoT device communication data. Entity parsing and cross-source association are performed on the multi-source data stream to construct a heterogeneous causal time sequence graph. The nodes of the heterogeneous causal time sequence graph include medical business entity nodes, asset nodes and session nodes. The edges of the heterogeneous causal time sequence graph include access edges, communication edges and data read and write edges, and the edges carry timestamps and causal association weights. A set of process constraints is generated from the role and permission configuration and diagnosis and treatment business path configuration of the medical information system. The set of process constraints limits the allowed sequence of node types and edge types. Based on the set of process constraints, an evidence chain set is extracted from the heterogeneous causal time sequence graph, and the path expansion is pruned based on the causal association weights. Network communication features, host behavior features, service operation features, and device instruction features are extracted from the evidence chain set, and gating fusion coding is performed according to modal availability to obtain the evidence chain fusion representation; Positive sample pairs are constructed using cross-modal representations of the same evidence chain, and negative sample pairs are constructed using representations of paths that do not satisfy the set of process constraints or different evidence chains. Cross-modal alignment training is then performed to obtain the early warning representation model. The warning characterization model is used to output the threat stage and warning risk value for each time window, and the lower bound of the warning risk is calculated based on the calibration sample set, wherein the calibration sample set is a set of time window samples that have been collected and labeled in advance. When the threat stage meets the preset stage transition rules and the lower bound of the warning risk meets the preset triggering rules, threat warning information containing the warning object, warning level, and evidence chain fragments is output.

2. The medical network threat early warning method integrating multimodal features according to claim 1, characterized in that, The causal correlation weight is the edge weight. ,and in, The cross-source identifier mapping consistency score; This represents the time difference between the two events corresponding to this edge. This is the upper bound of the preset time difference; and These are the context field sets for the two events, The number of elements in the set.

3. The medical network threat early warning method integrating multimodal features according to claim 1, characterized in that, The pruning includes: weighting the causal association edges of adjacent edges in the evidence chain. The chain confidence is obtained by performing a cumulative multiplication: in The number of edges contained in the chain of evidence; when the confidence level of the chain is... Less than the preset threshold The path extension is terminated when the preset threshold is reached. It is determined by the confidence distribution of the normal chain of evidence in the calibration sample set.

4. The medical network threat early warning method integrating multimodal features according to claim 1, characterized in that, The gated fusion coding includes: establishing a modality availability flag for each modality. ,in and Modal index; calculate fusion weights: And for the four modal feature vectors The fusion vector is obtained by weighted summation. in, This is a feature vector for network communication. This is the host behavior feature vector. This is a feature vector representing business operations. This is a device instruction feature vector. The evidence chain fusion representation or its input vector.

5. The medical network threat early warning method integrating multimodal features according to claim 1, characterized in that, The cross-modal alignment training employs contrastive loss and applies it to the two modal representations of the same evidence chain. and Calculate similarity: in For vector dot product, For each positive sample pair, the vector norm is used; and for each positive sample pair... Its corresponding negative sample set Calculate the loss: in, This represents the negative sample corresponding to the positive sample pair. For preset temperature parameters, This is the single-sample contrast loss.

6. The medical network threat early warning method integrating multimodal features according to claim 1, characterized in that, The construction of the negative sample pair includes the construction of hard negative samples: performing minimum editing perturbation on the evidence chain that satisfies the process constraint set to generate a perturbation path, wherein the minimum editing perturbation includes at least one or more of edge type replacement, edge direction reversal and timestamp exchange; and representing the path in the perturbation path that does not satisfy the process constraint set as one side sample of the negative sample pair.

7. The medical network threat early warning method integrating multimodal features according to claim 1, characterized in that, The threat phase satisfies the phase set. and with stage transition allow matrix Constrain adjacent time window stages, where This indicates that it is allowed by stage Migration to Stage , This indicates that migration is not allowed. When migration is deemed not allowed, the current time window phase is replaced with the allowed phase that maximizes the warning risk value, so as to output a threat phase sequence that satisfies the preset phase migration rules.

8. The medical network threat early warning method integrating multimodal features according to claim 1, characterized in that, The lower bound of the early warning risk is And calculated from the calibration sample set: for the calibration sample set... Calculate the residuals for each sample: And calculate the quantile values: Furthermore, regarding the time window calculate: in, For the first The warning risk value for each calibration sample. For the first The true labeled value of each calibration sample, For preset signal parameters and , For time windows The warning risk value, For time windows The lower limit of the early warning risk.

9. The medical network threat early warning method integrating multimodal features according to claim 1, characterized in that, The preset triggering rules include a criticality adaptive threshold: configuring criticality for the assets corresponding to the warning object. ,in Set discrete levels; and set trigger thresholds: in, and These are preset parameters; when The preset triggering rule is determined to be met at that time.

10. The medical network threat early warning method integrating multimodal features according to claim 8, characterized in that, The method also includes drift monitoring and calibration updates: feature histograms of recent time windows. The feature histogram of the calibration sample set Calculate distribution distance in For histogram binning indexing; when Greater than the preset threshold Update the calibration sample set and recalculate the quantile values ​​in claim 8. This is to update the lower bound of the warning risk.

Images