A method and system for tracking operations of a medical system based on log audits

Abstract

The application relates to the technical field of medical information system log auditing, and discloses a medical system operation tracking method and system based on log auditing, wherein the medical system operation tracking method based on log auditing comprises the following steps: acquiring emergency tracking request parameters and generating an institution privacy budget state report; performing differential differential privacy processing on operation logs of each institution according to the privacy budget state, and generating an operation event stream with a data quality indication label; segmenting the operation event stream and performing initial intention clustering to generate an operation segment set; performing emergency operation indication feature detection on the operation segment to be analyzed, and distinguishing suspected emergency operation segments and suspected illegal operation segments; performing emergency business process variant template matching on the suspected emergency operation segments, and assigning an emergency business intention label; and performing process deviation marking, cross-institution link splicing and generating a tracking report.

Description

Technical Field

[0001] This invention relates to the field of log auditing technology for pharmaceutical information systems, and more specifically, to a method and system for tracking the operation of pharmaceutical systems based on log auditing. Background Technology

[0002] In the log auditing and operation tracking scenario of the pharmaceutical supply chain, when a serious adverse drug reaction event occurs, it is necessary to urgently trace the entire process of the involved drug. The traceability request involves multiple institutions in the supply chain, including suppliers, distributors, and medical institutions. Each institution performs differential privacy processing on its local operation logs according to the log extraction instructions and then submits them to the collaborative audit tracing node. The collaborative audit tracing node performs cross-institutional link splicing and integrity verification on the log data submitted by each institution.

[0003] In the operation intent analysis stage, existing methods utilize an operation intent clustering model trained on log data with historically labeled business operation intents. This model aggregates operation fragments into operation intent clusters by measuring the cosine similarity between composite feature vectors, and assigns a label to each cluster corresponding to the nearest known intent category in the training data. In the privacy protection stage, each organization performs differential privacy processing on its local logs each time it receives a log extraction instruction, using a preset privacy budget parameter to control the noise level.

[0004] The aforementioned technologies suffer from the following problems: In emergency medication traceability scenarios, emergency operation sequences exhibit unconventional features such as step compression, reversed order, and the inclusion of emergency authorization. Their composite feature vectors are significantly distant from the feature space of any known intent category. Operation intent clustering models uniformly label them as unknown intent types, failing to distinguish between reasonable emergency operation maneuvers and violations. Simultaneously, the accumulated privacy budget of the same institution's operation logs, after repeated processing of multiple traceability requests, approaches its limit. At this point, differential privacy mechanisms add considerable noise to sensitive fields, causing the emergency authorization flag to be flipped by the random response mechanism, operation timestamps to be disturbed by noise leading to inaccurate time interval calculations, and operation type encoding to lose sequence details at the aggregation granularity. The key features upon which emergency operation intent identification relies are severely degraded. Simply refusing to provide data results in the traceability link breaking at the institution node, making audit tracing impossible. Therefore, the inability to identify emergency operation intent and the degradation of key features due to privacy budget exhaustion are intertwined problems, becoming urgent technical challenges to be addressed in emergency medication traceability scenarios. Summary of the Invention

[0005] This invention provides a method and system for tracking operations in a pharmaceutical system based on log auditing, which solves the technical problem in related technologies that it is impossible to effectively track and identify the intent of operation logs in cross-institutional emergency medication scenarios while protecting the data privacy of each institution.

[0006] This invention discloses a method for tracking operations in a pharmaceutical system based on log auditing, comprising the following steps: obtaining the target drug batch identifier in an emergency traceability request, determining the set of participating institutions involved, querying the cumulative privacy budget value in the local privacy budget ledger of each institution and calculating the remaining privacy budget value, and generating a privacy budget status report; For organizations with sufficient privacy budgets, differential privacy processing is performed according to the standard privacy budget parameters to generate an operation event flow; for organizations with limited privacy budgets, the remaining privacy budget is differentially allocated according to the normalized proportion of the feature criticality of each field for identifying emergency intent, and then differential privacy processing is performed, with data quality indicator labels attached, to generate a differential privacy protection operation event flow. The operation event stream is grouped by session identifier and segmented by time interval to generate a set of operation segments. The operation intent clustering model is used to perform clustering processing on each operation segment, and operation segments that cannot match the known intent category are marked as operation segments to be analyzed. When analyzing operation segments, detect emergency operation indication features, mark operation segments that meet preset conditions as suspected emergency operation segments, and mark the rest as suspected violation operation segments; Extract the operation type encoding sequence from suspected emergency operation fragments, perform edit distance sequence alignment matching with the emergency business process variant template library, and assign emergency business intent labels to the successfully matched operation fragments; According to the direction of drug circulation, the operation segments of each institution are spliced ​​together across institutions to generate a full-process operation sequence. The operation segments in the full-process operation sequence are labeled with intent level, and a cross-institutional emergency drug use operation tracking report is generated.

[0007] Furthermore, the generation of the privacy budget status report includes: Each local log processing node queries the local privacy budget ledger for historical processing records that overlap with the log record set involved in the current request, extracts the consumed cumulative privacy budget value, and subtracts the cumulative privacy budget value from the organization's preset total privacy budget upper limit to obtain the remaining privacy budget value; The privacy budget status report includes an organization identifier, a remaining privacy budget value, and a privacy budget adequacy identifier. When the remaining privacy budget value is greater than or equal to the privacy budget value required to process all log records involved in the current request according to the regular privacy budget parameters, the privacy budget adequacy identifier indicates that the privacy budget is sufficient; otherwise, the privacy budget is limited. The privacy budget ledger is indexed by the unique identifier of each log record and records the privacy budget value and processing time allocated to each log record when it is processed by each historical request.

[0008] Furthermore, the differentiated allocation of the remaining privacy budget based on the normalized proportion of the feature criticality of each field for identifying emergency intent includes: The feature criticality of each field is divided into three levels: operation type code and emergency authorization flag are core fields for intent recognition, with the highest feature criticality weight; precise timestamp is a field that depends on time interval calculation, with the next highest feature criticality weight; operation parameter summary is an auxiliary field, with the lowest feature criticality weight. The feature criticality weights of each field are normalized using mean normalization based on the range; The privacy budget value allocated to each field is equal to the organization's remaining privacy budget value multiplied by the ratio of the normalized feature key weight of that field to the sum of the normalized feature key weights of all fields involved in the allocation.

[0009] Furthermore, the data quality indicator label is calculated based on the ratio of the actual privacy budget value allocated to each field to the conventional privacy budget parameter, and the data quality indicator label is divided into three levels: high quality, medium quality, and low quality according to the ratio range. Before implementing differentiated privacy budget allocation for organizations with limited privacy budgets, check whether there is a subset of queries in the log records involved in the current request that are exactly the same as those in historical requests. For the subset of queries that are exactly the same, directly reuse the historical processing results stored in the local privacy budget ledger without consuming additional privacy budget. Only perform the differentiated privacy budget allocation and differential privacy processing on the log records that were not covered by historical requests.

[0010] Furthermore, the operation intent clustering model is a clustering model trained based on log data of historically labeled business operation intents. The operation intent clustering model performs clustering determination by calculating the cosine similarity between the input operation fragment composite feature vector and the center vector of each known intent category. When the cosine similarity with the center vector of all known intent categories is lower than the preset similarity threshold, an unknown intent label is output. The category center vector of each intent category is obtained by performing mean aggregation on the composite feature vectors of samples of the same intent category in the training set; the training uses the Adam optimization algorithm to minimize the intra-class compactness loss, which is defined as the negative mean of the cosine similarity between the composite feature vectors of each sample of the same intent category in the training set and the category center vector.

[0011] Furthermore, the emergency operation indication features include the following three items: the segment contains operation events with an emergency authorization flag set to true; the average time interval between operation events within the segment is lower than a preset emergency operation time interval threshold; and the segment contains a predefined emergency operation type code. The preset condition is that it includes at least two of the aforementioned emergency operation indication features; The suspected emergency operation segments are labeled with a detection confidence level. The detection confidence level is calculated based on the number of emergency operation instruction features satisfied and the degree to which each feature is satisfied. The detection confidence level of operation segments that satisfy three emergency operation instruction features is higher than that of operation segments that satisfy two emergency operation instruction features.

[0012] Furthermore, for operation segments from institutions with sufficient privacy budgets, the binary determination of the emergency operation instruction features is directly performed; for operation segments from institutions with limited privacy budgets, a relaxed detection strategy is adopted based on the data quality indicator label. The relaxed detection strategy includes: For the emergency authorization flag field, when the data quality level is medium or low, based on the random response mechanism, the probability of retaining the true value and the flipping probability under the actual privacy budget value allocated to the emergency authorization flag field are calculated. The proportion of records in the session where the emergency authorization flag is observed to be true is used as the prior probability. The posterior probability of the record actually containing emergency authorization is calculated when the emergency authorization flag is observed to be false. The probability of retaining the true value is equal to the ratio of the natural constant raised to the power of the actual privacy budget value allocated to the emergency authorization flag field to the sum of the power plus one. The posterior probability is equal to the product of the flipping probability and the prior probability divided by the sum of the product of the flipping probability and the prior probability plus the product of the probability of retaining the true value and the complement of the prior probability. When the posterior probability exceeds the preset probability judgment threshold, the record is still determined to contain emergency authorization. The determination of the operation time interval is to adjust the emergency operation time interval threshold to the normal emergency operation time interval threshold plus the product of the tolerance coefficient and the expected standard deviation of the timestamp noise, wherein the expected standard deviation of the timestamp noise is equal to the square root of two multiplied by the sensitivity of the timestamp field and then divided by the privacy budget value actually allocated to the timestamp field.

[0013] Furthermore, the edit distance sequence alignment matching uses the Levenshtein distance algorithm to calculate the edit distance between the operation type encoding sequence of the suspected emergency operation fragment and the operation type encoding sequence of the variant template. The variant template with the smallest edit distance and below the matching threshold is selected to be assigned an emergency business intent label. The confidence level of the emergency business intent label is determined based on the ratio of the edit distance to the matching threshold. The confidence level is divided into three levels: high confidence, medium confidence, and low confidence. For suspected emergency operation segments from organizations with limited privacy budgets, the matching threshold is adjusted to the product of the regular matching threshold and the difference between the adjustment coefficient and the quality coefficient corresponding to the data quality level. The quality coefficient corresponding to high quality is one, and the quality coefficients corresponding to medium quality and low quality decrease sequentially. The adjustment coefficient is a pre-set positive number.

[0014] Furthermore, for operation segments successfully assigned with emergency business intent tags, the alignment path generated when calculating the edit distance based on the Levenshtein distance algorithm is used to align the operation event sequence of the operation segment with the matched variant template node by node, marking skipped standard nodes, nodes whose execution order is adjusted, and additional emergency special operations. Based on the operator identifier and operation object identifier, the corresponding post-entry record and post-approval record are retrieved in the operation event stream to generate an emergency operation intent context reconstruction result containing emergency business intent tags, process variant deviation annotations, and post-completion status. In cross-institutional link splicing, when the confidence level of the emergency business intent label of adjacent institutional nodes is high, a strict consistency check is performed, requiring that the outbound operation of the upstream node and the inbound operation of the downstream node be completely consistent in terms of drug batch identification, quantity, and time sequence. When there are low-confidence nodes, the strictness of the check is reduced based on the data quality level of the low-confidence nodes, allowing deviations within the tolerance range corresponding to the data quality level in terms of quantity or time sequence, and the reliability level is marked in the check conclusion.

[0015] This invention provides a log-auditing-based operation tracking system for a medical system, comprising: The privacy budget status assessment module is used to obtain the target drug batch identifier in the emergency traceability request, determine the set of participating institutions involved, receive the remaining privacy budget value calculated by the local log processing nodes of each institution based on the local privacy budget ledger, and generate a privacy budget status report. The differential privacy processing module is used to perform differential privacy processing on institutions with sufficient privacy budgets according to the regular privacy budget parameters to generate operation event streams. For institutions with limited privacy budgets, the remaining privacy budget is differentially allocated according to the normalization ratio of the feature criticality of each field to identify emergency intent, and then differential privacy processing is performed and a data quality indicator label is attached to generate differential privacy protection operation event streams. The initial intent clustering module is used to group the operation event stream by session identifier and segment it by time interval to generate a set of operation fragments. It uses the operation intent clustering model to perform clustering processing on each operation fragment and marks the operation fragments that cannot match the known intent categories as operation fragments to be analyzed. The emergency operation instruction feature detection module is used to detect emergency operation instruction features in the operation segments to be analyzed, and to mark operation segments that meet preset conditions as suspected emergency operation segments, and the rest as suspected violation operation segments. The Emergency Business Process Variant Matching Module is used to extract the operation type encoding sequence from suspected emergency operation fragments, perform edit distance sequence alignment matching with the emergency business process variant template library, and assign emergency business intent labels to successfully matched operation fragments. The tracking report generation module is used to perform cross-institutional link splicing of operation segments from various institutions according to the direction of drug circulation to generate a full-process operation sequence, and to label each operation segment in the full-process operation sequence with intent level to generate a cross-institutional emergency drug use operation tracking report.

[0016] This invention discloses a log-auditing-based method for tracking operations in a medical system. It addresses the overlapping technical problems of unidentifiable emergency operation intent and degraded key features due to privacy budget exhaustion caused by repeated tracking in emergency medication tracing scenarios. The method achieves the following technical effects: By differentially allocating the remaining privacy budget based on the criticality of field features, the core fields for intent identification achieve higher data quality under limited privacy budget conditions compared to a uniform allocation method, reducing the degree of uniform degradation of key features; by reusing historical processing results for subsets of queries identical to historical requests, the method reduces duplicate consumption of privacy budget due to overlapping queries; by employing a relaxed detection strategy based on data quality indicator labels for operation segments of institutions with limited privacy budgets, the detection of emergency operation indicator features maintains effective judgment capability even under degraded data quality conditions; by adaptively relaxing the edit distance matching threshold for suspected emergency operation segments based on data quality levels, the matching of variant templates for emergency business processes can be effectively executed under different data quality levels; by linking the confidence level with the cross-institutional verification strictness and annotating the data quality level and privacy budget consumption status in the tracking report, the credibility assessment of the tracking conclusions at each node in the audit tracking report corresponds to the actual data quality status. Attached Figure Description

[0017] Figure 1 This is a flowchart of the log audit-based operation tracking method for a medical system provided in an embodiment of the present invention; Figure 2 This is a schematic diagram comparing the consumption and remaining status of privacy budgets of various institutions according to embodiments of the present invention; Figure 3 This is a schematic diagram of the differential privacy budget allocation results for each field of DIS-B provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the initial intention clustering cosine similarity of each operation segment provided in the embodiments of the present invention; Figure 5 This is a schematic diagram of the detection of emergency operation indication features of the segment to be analyzed, comparing the time interval with the threshold, provided in an embodiment of the present invention. Figure 6 This is a schematic diagram of the probabilistic determination process of the SEG-005 emergency authorization mark provided in an embodiment of the present invention; Figure 7 This is a schematic diagram illustrating the comparison between the template matching and editing distance and the threshold for suspected emergency operation segments provided in an embodiment of the present invention; Figure 8 This is a schematic diagram of the intent classification and confidence distribution of the entire process operation segment provided in the embodiments of the present invention; Figure 9 This is a schematic diagram illustrating the relationship between the standard deviation of Laplace noise and the time threshold adjustment amount for each mechanism provided in the embodiments of the present invention. Detailed Implementation

[0018] In the log auditing and operation tracking scenario of the pharmaceutical supply chain, when a serious adverse drug reaction event occurs, it is necessary to urgently trace the entire process of the involved drug. The traceability request involves multiple institutions in the supply chain, including suppliers, distributors, and medical institutions. Each institution performs differential privacy processing on its local operation logs according to the log extraction instructions and then submits them to the collaborative audit tracing node. The collaborative audit tracing node performs cross-institutional link splicing and integrity verification on the log data submitted by each institution.

[0019] In the operation intent analysis stage, existing methods utilize an operation intent clustering model trained on log data with historically labeled business operation intents. This model aggregates operation fragments into operation intent clusters by measuring the cosine similarity between composite feature vectors, and assigns a label to each cluster corresponding to the nearest known intent category in the training data. In the privacy protection stage, each organization performs differential privacy processing on its local logs each time it receives a log extraction instruction, using a preset privacy budget parameter to control the noise level.

[0020] The aforementioned technologies suffer from the following problems: In emergency medication traceability scenarios, emergency operation sequences exhibit unconventional features such as step compression, reversed order, and the inclusion of emergency authorization. Their composite feature vectors are significantly distant from the feature space of any known intent category. Operation intent clustering models uniformly label them as unknown intent types, failing to distinguish between reasonable emergency operation maneuvers and violations. Simultaneously, the accumulated privacy budget of the same institution's operation logs, after repeated processing of multiple traceability requests, approaches its limit. At this point, differential privacy mechanisms add considerable noise to sensitive fields, causing the emergency authorization flag to be flipped by the random response mechanism, operation timestamps to be disturbed by noise leading to inaccurate time interval calculations, and operation type encoding to lose sequence details at the aggregation granularity. The key features upon which emergency operation intent identification relies are severely degraded. Simply refusing to provide data results in the traceability link breaking at the institution node, making audit tracing impossible. Therefore, the inability to identify emergency operation intent and the degradation of key features due to privacy budget exhaustion are intertwined problems, becoming urgent technical challenges to be addressed in emergency medication traceability scenarios.

[0021] According to an embodiment of this implementation, a method for tracking operations in a medical system based on log auditing is provided. It should be understood that the implementing entities in this implementation are a collaborative audit tracing node and local log processing nodes of each institution. The collaborative audit tracing node is responsible for sending log extraction instructions to each institution, receiving operation event streams submitted by each institution, and performing subsequent analysis and processing. Each local log processing node is responsible for performing privacy protection processing on its own institution's operation logs before submitting the data to the collaborative audit tracing node.

[0022] At least one embodiment of the present invention discloses a method for tracking operations in a medical system based on log auditing, such as... Figure 1 As shown, it includes the following steps: Step 1: Obtain the emergency tracing request parameters and generate privacy budget status reports for each organization; The system retrieves the target drug batch identifier and tracking range parameters from the emergency traceability request. Based on the target drug batch identifier, it searches the drug circulation registration records for the sequence of institutions that the batch of drugs has passed through. Combining this with the tracking range parameters, it determines the set of participating institutions involved and sends log extraction instructions to the local log processing nodes of each institution. Upon receiving the log extraction instructions, each local log processing node queries its local privacy budget ledger for historical processing records that overlap with the log record set involved in the current request. It extracts the accumulated privacy budget value that has been consumed, calculates the remaining privacy budget value based on the institution's preset overall privacy budget cap, and generates a privacy budget status report for each institution.

[0023] It should be noted that the remaining privacy budget value is calculated as follows: ,in The remaining privacy budget value, This is the upper limit of the overall privacy budget set for the agency. This is the cumulative privacy budget value consumed by differential privacy processing performed on the set of log records involved in the current request, as recorded in the local privacy budget ledger. The privacy budget ledger is indexed by the unique identifier of each log record and records the privacy budget value allocated to each log record when it was processed by each historical request, along with the processing time. Therefore, it can accurately correlate the overlap between the log records involved in the current request and historical processing records.

[0024] It should be noted that the aforementioned privacy budget status report includes an organization identifier, remaining privacy budget value, and a privacy budget adequacy identifier. The rule for determining the privacy budget adequacy identifier is as follows: if the remaining privacy budget value is greater than or equal to the privacy budget value required to process all log records involved in the current request according to the regular privacy budget parameters, it is identified as having a sufficient privacy budget; otherwise, it is identified as having a limited privacy budget.

[0025] Step 2: Perform differentiated privacy processing on the operation logs of each institution based on the privacy budget status to generate an operation event stream; For organizations with sufficient privacy budgets, differential privacy processing is performed on local operation logs according to standard privacy budget parameters to extract operator identifiers, session identifiers, operation type codes, operation object identifiers, emergency authorization flags, and precise timestamps, generating a complete standardized operation event flow.

[0026] For organizations with limited privacy budgets, the criticality of each field in the log records involved in the current request for identifying urgent intent is assessed. The remaining privacy budget is then allocated differentially according to the normalized proportion of the criticality of each field's features, and differential privacy processing is performed. A data quality indicator label calculated based on the actual allocated privacy budget value is attached to each record, generating a differentiated privacy protection operation event stream with data quality indicator labels.

[0027] It should be noted that the feature criticality of the above fields is divided into three levels: the operation type code and the emergency authorization flag are core fields for intent recognition, and their feature criticality weight is the highest; the precise timestamp is a field dependent on the time interval calculation, and its feature criticality weight is the second highest; the operation parameter summary is an auxiliary field, and its feature criticality weight is the lowest. Feature criticality weight of each field. (in For field indexing, (Total number of fields) is pre-set to the corresponding value according to the above levels. Before performing differential allocation, the feature criticality weight of each field is determined. A mean normalization based on the range is used to eliminate the influence of the numerical units of different weight levels on the calculation of the allocation ratio. After normalization, the field... The allocated privacy budget value is: in This represents the agency's remaining privacy budget. For normalized fields Feature keyness weights The total number of fields involved in the allocation. The indexes of the fields are used for summation and traversal. Therefore, core fields intended for identification are allocated a larger proportion of the privacy budget, resulting in less noise added during differential privacy processing and relatively higher data quality.

[0028] It should be noted that the above data quality indicator labels are calculated based on the ratio of the actual privacy budget value allocated to each field to the standard privacy budget parameter. The closer the ratio is to 1, the closer the data quality of that field is to the standard processing level; the lower the ratio, the greater the impact of noise on that field. The data quality indicator labels are divided into three levels: high quality, medium quality, and low quality according to the ratio range.

[0029] In this embodiment, to reduce redundant privacy budget consumption, before performing differentiated privacy budget allocation for organizations with limited privacy budgets, the following steps are included: checking whether there is a subset of queries in the log records involved in the current request that are exactly the same as those in historical requests; directly reusing the historical processing results stored in the local privacy budget ledger for the exact same subset of queries, without consuming additional privacy budget. The aforementioned differentiated privacy budget allocation and differential privacy processing are only performed on newly added log records that are not covered by historical requests. Through this reuse process, the redundant consumption of privacy budget caused by overlapping queries is reduced, allowing the remaining privacy budget to be more fully allocated to the processing of newly added log records.

[0030] Step 3: Segment the operation event stream and perform initial intent clustering to generate a set of operation fragments; The operation event streams submitted by each institution are grouped by session identifier and segmented within each session according to time intervals to generate a set of operation fragments. An operation intent clustering model is used to cluster the composite feature vectors of each operation fragment. Operation fragments matching known intent categories are assigned corresponding general business intent labels, while operation fragments that cannot match known intent categories are marked as operation fragments to be analyzed.

[0031] It should be noted that the above-mentioned segmentation by time interval refers to calculating the time interval between adjacent operation events within the same session. When a certain time interval exceeds the preset segmentation threshold within the session, the segmentation is performed at that interval position, dividing the sequence of operation events within a session into multiple operation segments.

[0032] It should be noted that the above-mentioned operation intent clustering model is a clustering model trained based on log data of historically labeled business operation intents. The input is a composite feature vector of the operation segment, and the output is a known intent category label or an unknown intent marker to which the operation segment belongs. The operation intent clustering model determines clustering by calculating the cosine similarity between the input composite feature vector and the center vectors of each known intent category. When the cosine similarity with all known intent category centers is lower than a preset similarity threshold, an unknown intent marker is output, and the corresponding operation segment is marked as an operation segment to be analyzed. The category center vector of each intent category is calculated by performing mean aggregation on the composite feature vectors of samples of the same intent category in the training set. Training uses the Adam optimization algorithm to minimize the intra-class compactness loss based on cosine similarity. Specifically, the intra-class compactness loss... Defined as the negative mean of the cosine similarity between the composite feature vector of each sample within the same intent category in the training set and the center vector of that category, i.e.: in The total number of samples in the training set. To sum the sample indices, For the first The composite feature vector of each sample, For the first The intent category label to which each sample belongs. For category The corresponding category center vector, Representing vectors Norm. Minimize This aims to maximize the cosine similarity between each sample within the same category and its category center, thereby achieving the optimization goal of intra-class compactness.

[0033] The output of the operation intent clustering model is either a known intent category label or an unknown intent marker. The known intent category label directly corresponds to the predefined business operation intent category name in the training data and can be directly used as the regular business intent annotation result of the operation segment. The unknown intent marker will transfer the corresponding operation segment to step 4 for further analysis.

[0034] Step 4: Perform emergency operation instruction feature detection on the operation segment to be analyzed to distinguish between suspected emergency operation segments and suspected violation operation segments; The analysis process detects emergency operation indication features in operation segments. These features include the following three items: the segment contains an operation event with a true emergency authorization flag; the average time interval between operation events within the segment is lower than a preset emergency operation time interval threshold; and the segment contains a predefined emergency operation type code. Operation segments containing at least two of these emergency operation indication features are marked as suspected emergency operation segments and their detection confidence level is assigned. Operation segments that do not meet the above conditions are marked as suspected violation operation segments.

[0035] It should be noted that the above detection confidence is calculated based on the number of emergency operation instruction features satisfied and the degree to which each feature is satisfied. The detection confidence of an operation segment that satisfies three emergency operation instruction features is higher than that of an operation segment that satisfies only two emergency operation instruction features.

[0036] In this embodiment, to maintain effective detection capability of emergency operation indication features even when data quality deteriorates in privacy-constrained institutions, based on step 4, the binary determination of the aforementioned emergency operation indication features is directly performed on operation segments from privacy-constrained institutions, while a relaxed detection strategy is adopted for operation segments from privacy-constrained institutions based on data quality indication labels. Specifically, the relaxed detection strategy includes the following processing: For the Emergency Authorization Flag field, due to privacy budget constraints, the random response mechanism may flip the true value of this field. Therefore, a probabilistic determination is performed within the random response probability range. That is, when the data quality level of the Emergency Authorization Flag field is medium or low, records with a false Emergency Authorization Flag are not directly determined to not contain Emergency Authorization. Instead, the posterior probability that the record actually contains Emergency Authorization is calculated based on the random response flip probability. When the posterior probability exceeds a preset probability determination threshold, it is still determined to contain Emergency Authorization. Specifically, let the random response mechanism, within a privacy budget of... The probability of retaining the true value is ,in Let be the natural constant, and let be the probability of flipping. When the emergency authorization flag is observed to be false, the posterior probability that the record actually contains an emergency authorization (the true value is true) is: in As the prior probability, the proportion of records in the session containing the current operation segment whose emergency authorization flag observation value is true is taken as the prior estimate. The probability of preserving the true value for a random response mechanism. The privacy budget value actually allocated to the Emergency Authorization flag field. Even if the posterior probability exceeds a preset probability threshold, the record is still determined to contain emergency authorization.

[0037] Furthermore, the aforementioned probability determination threshold is a pre-set fixed value used to control the strictness of the posterior probability determination. When the posterior probability exceeds the probability determination threshold, even if the observed emergency authorization flag is false, the record will still be determined to contain an emergency authorization, in order to avoid missed detections due to random response reversals.

[0038] For the emergency threshold of the operation time interval, since the timestamp is disturbed by noise, the emergency operation time interval threshold is included in the expected deviation tolerance of the timestamp noise. Let the normal emergency operation time interval threshold be... The expected standard deviation of timestamp noise is The tolerance coefficient is The adjusted emergency operation time interval threshold is: in This is the adjusted emergency operation time interval threshold. This is the threshold for the normal emergency operation time interval. This is the tolerance factor. This represents the expected standard deviation of the timestamp noise. Calculated based on the actual allocated privacy budget value corresponding to the data quality indicator label, specifically, the expected standard deviation of the Laplace noise added to the timestamp field is... ,in This refers to the sensitivity of the timestamp field (i.e., the maximum change in the timestamp field in adjacent datasets, with the same unit as the timestamp field). The privacy budget value actually allocated to the timestamp field. It should be noted that... , and The units of all three are consistent with the timestamp field, and they have the same dimension, so the above addition operation is valid in terms of dimension.

[0039] Furthermore, the aforementioned tolerance coefficient A pre-set positive number used to control the extent to which the time interval threshold is relaxed. The larger the value, the higher the adjusted emergency operation time interval threshold. The more lenient the setting, the greater the allowable deviation in time interval calculation due to timestamp noise. The smaller the value, the smaller the relaxation range of the emergency operation time interval threshold, and the stricter the judgment of the time interval.

[0040] Step 5: Perform emergency business process variant template matching on suspected emergency operation segments and assign emergency business intent tags; Extract the operation type encoding sequence from the suspected emergency operation fragment, perform edit distance sequence alignment matching with the variant templates allowed for various emergency scenarios defined in the emergency business process variant template library, select the variant template with the smallest edit distance and below the matching threshold to assign an emergency business intent label to the suspected emergency operation fragment, and mark the confidence level of the emergency business intent label in the matching results.

[0041] It should be noted that the aforementioned emergency business process variant template library defines variant templates corresponding to multiple emergency scenarios. Each variant template describes a permitted operation step compression mode, operation order adjustment mode, and special operation type combination under an emergency scenario. The aforementioned edit distance sequence alignment matching refers to aligning the operation type encoding sequence of a suspected emergency operation fragment with the operation type encoding sequence defined in the variant template, and calculating the minimum number of edit operations required to convert the suspected emergency operation fragment sequence into a variant template sequence. Edit operations include insertion, deletion, and replacement. The smaller the edit distance, the higher the degree of matching between the suspected emergency operation fragment and the variant template. The edit distance is calculated using the Levenshtein distance algorithm.

[0042] It should be noted that the confidence level of the aforementioned emergency business intent label is determined based on the ratio of edit distance to the matching threshold. The lower the ratio, the higher the confidence level. The confidence levels are divided into three levels: high confidence, medium confidence, and low confidence. When the edit distance between a suspected emergency operation fragment and all variant templates exceeds the matching threshold, the suspected emergency operation fragment is not successfully assigned an emergency business intent label, but retains its suspected emergency operation fragment label status.

[0043] The output of step 5 is the emergency business intent label and confidence level corresponding to each suspected emergency operation segment. The emergency business intent label directly corresponds to the predefined emergency scenario category name in the emergency business process variant template library, and can be directly used as the basis for the intent labeling in the subsequent step 6 process deviation labeling and step 8 report generation.

[0044] In this embodiment, to maintain the effectiveness of template matching even when the operation type encoding sequence of a privacy-budget-constrained organization is deviated due to noise, based on step 5, the edit distance matching threshold for suspected emergency operation segments from privacy-budget-constrained organizations is adaptively relaxed based on the quality level corresponding to the data quality indicator label. Let the regular matching threshold be... The quality coefficient corresponding to the data quality level is High quality corresponds to medium quality corresponding Values ​​between 0 and 1 correspond to low quality. The value is close to 0, and the adjustment factor is... The adjusted matching threshold is: in The adjusted matching threshold, This is the standard matching threshold. To adjust the coefficient, This represents the quality coefficient corresponding to the data quality level. Therefore, data segments with lower quality that are suspected of being urgent operations are allowed a larger edit distance tolerance, and the confidence level of the matched urgent business intent tags is correspondingly lower.

[0045] Furthermore, the aforementioned adjustment coefficients This is a pre-set positive number used to control the extent to which the matching threshold widens as data quality deteriorates. When (High quality) That is, the regular matching threshold is not adjusted; when When approaching 0 (low quality), Approaching That is, the matching threshold is relaxed to a maximum of the normal matching threshold. times.

[0046] Step 6: Perform process deviation annotation and post-event completion status checks on the operation segments that have been assigned emergency business intent tags; In this embodiment of the application, to provide specific information on emergency operations deviating from the standard process to support audit judgment, in addition to step 5, the following steps are also included: For operation segments successfully assigned emergency business intent tags, the operation event sequence of the operation segment is aligned node by node with the matched emergency business process variant template, and skipped standard nodes, nodes whose execution order is adjusted, and additional emergency special operations are marked. Simultaneously, based on the operator identifier and operation object identifier, the existence of corresponding post-event supplementary records and post-event approval records is searched in the operation event stream to generate an emergency operation intent context reconstruction result containing emergency business intent tags, process variant deviation annotations, and post-event completion status.

[0047] It should be noted that the above-mentioned node-by-node alignment is directly read from the alignment path generated when the Levenshtein distance algorithm calculates the edit distance in step 5. This alignment path records the correspondence between each operation event in the operation fragment sequence and each template node in the variant template sequence, including four types of correspondence: matching, insertion, deletion, and replacement. Thus, skipped standard nodes, nodes whose execution order has been adjusted, and additional emergency special operations can be directly identified without re-performing the alignment calculation.

[0048] Step 7: Perform cross-institutional link splicing according to the drug circulation direction to generate a complete process operation sequence; The intent recognition results of each institutional node are spliced ​​across institutions according to the direction of drug flow, and the operation segments of each institution are linked together into a full-process operation sequence according to the flow order of the target drug batch in the supply chain.

[0049] In this embodiment of the application, to ensure that the verification conclusions of each connection point in the audit trail report correspond to the actual data quality status, the following steps are included in addition to step 7: verifying the consistency of connections between adjacent institutional nodes in the link. When the confidence level of the emergency business intent label of both upstream and downstream nodes is high, a strict consistency verification is performed, requiring that the outbound operation of the upstream node and the inbound operation of the downstream node be completely consistent in terms of drug batch identification, quantity, and time sequence. When there are low-confidence nodes, the verification strictness is reduced based on the data quality level of the low-confidence nodes, allowing deviations within the tolerance range corresponding to the data quality level in terms of quantity or time sequence, and the reliability level is marked in the verification conclusion.

[0050] Furthermore, the tolerance ranges corresponding to the aforementioned data quality levels are pre-set based on the data quality indicator labels corresponding to each level. The tolerance range corresponding to the high quality level is the smallest, the tolerance range corresponding to the medium quality level is in the middle, and the tolerance range corresponding to the low quality level is the largest, thereby reflecting the degree of deviation that the consistency verification can tolerate under different data quality levels.

[0051] Step 8: Generate a cross-agency emergency medication operation tracking report; Each operation segment in the entire operation sequence is labeled at the intent level. The labeling categories include general intents, identified urgent intents, and intents pending review. Figure Three The report categorizes and annotates each operational segment with its corresponding confidence level. For operational segments with identified emergency intent, it adds process variation deviation annotations and post-event completion status. Suspected violation operational segments and suspected emergency operational segments that fail to match the emergency business intent tag are marked as high-concern operational segments requiring manual review. The audit trail report includes annotations on the data quality level and privacy budget consumption status of each institutional node, generating a log-audited medical system operational trail report.

[0052] It should be noted that the above-mentioned "regular intents" refer to the intent categories corresponding to the regular business intent labels assigned by the operation intent clustering model in step 3. "Identified emergency intents" refer to the intent categories corresponding to the operation fragments successfully assigned emergency business intent labels through matching with the emergency business process variant template in step 5. "Intents pending review" refer to the intent categories corresponding to suspected non-compliant operation fragments or suspected emergency operation fragments that failed to match emergency business intent labels. These operation fragments require manual judgment by auditors based on the contextual information appended to the tracking report.

[0053] This implementation addresses the overlapping issues of unidentifiable emergency operation intent and depleted privacy budget due to repeated tracing in emergency medication tracing scenarios. It employs techniques such as differentiated allocation of privacy budget based on field feature criticality, relaxed emergency operation indicator feature detection based on data quality indicator labels, and adaptive edit distance matching threshold.

[0054] Because in step 2, the privacy budget is allocated differently according to the feature criticality of emergency intent recognition based on each field, and the limited remaining privacy budget is preferentially allocated to the core fields of intent recognition such as operation type encoding and emergency authorization flag, the data quality of the core fields of intent recognition is improved compared with the uniform allocation method under the condition of limited privacy budget, thus overcoming the problem of key features being uniformly degraded due to privacy protection noise.

[0055] Because in step 2, the results of historical processing are directly reused for the subset of queries that are exactly the same as those in the historical requests without consuming additional privacy budget, the duplicate consumption of privacy budget caused by overlapping queries is reduced, thus slowing down the process of the accumulated privacy budget approaching its limit.

[0056] Because in step 4, a relaxed detection strategy based on data quality indicator labels is used for operation segments from privacy-budget-constrained institutions, the emergency authorization flag is probabilistically determined within the range of random response probability, and the expected deviation tolerance of timestamp noise is included in the time interval threshold, the detection of emergency operation indicator features can still maintain effective judgment capability under the condition of degraded data quality, avoiding the situation where emergency operations are misjudged as non-emergency operations due to noise.

[0057] Because the edit distance matching threshold for suspected emergency operation fragments from privacy-constrained institutions is adaptively relaxed based on the data quality level in step 5, emergency business process variant template matching can be effectively performed under different data quality levels, avoiding the situation where the emergency operation intent of a node cannot be identified at all due to insufficient data quality of a certain institution node in the tracing link.

[0058] Because the confidence level of the emergency business intent label is linked to the cross-agency verification strictness in steps 7 and 8, and the data quality level and privacy budget consumption status of each agency node are noted in the tracking report, the credibility assessment of the tracking conclusions of each node in the audit tracking report corresponds transparently to the actual data quality status. Auditors can classify and interpret the tracking conclusions based on the confidence level and data quality level.

[0059] In summary, this implementation method, while meeting the differential privacy protection requirements of various institutions, enables emergency medication operation traceability to still complete the identification of emergency operation intentions and full-process audit tracking across institutions under the condition of limited privacy budget.

[0060] The following is an example of an application of the present invention, such as... Figures 2-9 As shown, the implementation process is as follows: A batch of anticoagulant drugs (batch number: LOT-HEP-20XX0318-047) experienced a serious adverse reaction event in March 20XX. The collaborative audit trail node (node ​​code: AUDIT-CTR-01) received an urgent traceability request, requiring tracing the entire process of this batch of drugs from the supplier to the end user. A search of drug distribution registration records revealed that the distribution path of this batch of drugs involved three institutions: the supplier (institution code: SUP-A), the distributor (institution code: DIS-B), and the medical institution (institution code: MED-C). SUP-A and DIS-B had already consumed significant privacy budgets in previous traceability requests, while MED-C had relatively sufficient privacy budgets.

[0061] Upon receiving an emergency traceability request, the collaborative audit trail node AUDIT-CTR-01 retrieves three participating institutions from the drug circulation registration records based on batch number LOT-HEP-20XX0318-047, and sends log extraction instructions to each institution's local log processing node. Each institution queries its local privacy budget ledger for historical processing records that overlap with the log record set involved in the current request, extracts its accumulated privacy budget consumption value, and calculates the remaining privacy budget value by combining it with the preset overall privacy budget cap.

[0062] Taking DIS-B as an example, its remaining privacy budget is calculated as follows: Table 1: Privacy Budget Status Report for Each Institution: As shown in Table 1, SUP-A and DIS-B have limited privacy budgets because of the high consumption of historical tracing requests, with remaining privacy budgets below the 2.00 required for normal processing. MED-C has 3.80 remaining, and is therefore marked as having sufficient privacy budgets.

[0063] MED-C performs differential privacy processing on local operation logs using the standard privacy budget parameters (2.00) to generate a complete standardized operation event flow.

[0064] SUP-A and DIS-B are privacy-budget-constrained organizations that need to allocate privacy budgets differently for each field based on feature criticality. Taking DIS-B (with a remaining budget of 0.65) as an example, there are four fields involved in the allocation (operation type code, emergency authorization flag, precise timestamp, and operation parameter summary). The preset weights and normalized weights of each field are as follows.

[0065] After normalization, the privacy budget assigned to field i is the product of its normalization weight and the remaining budget value. For example, consider the operation type encoding field (normalization weight 0.35): Table 2 shows the results of the differential allocation of privacy budget for each field in DIS-B: The data quality level is determined based on the ratio of the actual allocated budget value for each field to the regular budget parameter (2.00): the ratio for operation type code and emergency authorization flag is 0.2275 / 2.00=0.114, and the ratio for precise timestamp is 0.1300 / 2.00=0.065, both below the medium quality threshold. However, operation type code and emergency authorization flag, as core fields, received the largest relative budget allocation. Before performing differential privacy processing, DIS-B also checked the overlap between the current request and historical request log records, finding that 8 records completely overlapped with historical requests. The historical processing results were directly reused, and differential privacy budget allocation was only performed on the 5 newly added records, effectively saving privacy budget consumption.

[0066] The collaborative audit trail node groups the operation event streams submitted by the three institutions by session identifier and segments them within a session according to the time interval between adjacent operation events (the preset segmentation threshold within a session is 30 minutes). The operation intent clustering model calculates the cosine similarity between the composite feature vector of each operation segment and the known intent category center vector. Operation segments with similarity scores below the preset threshold (0.75) are marked as operation segments to be analyzed.

[0067] Table 3. Clustering results of initial intentions for operational segments of each institution: SEG-003, SEG-005, and SEG-007 all have a cosine similarity of less than 0.75 with all known intent category centers, and are therefore marked as operation segments to be analyzed, proceeding to step 4 for further analysis.

[0068] Three emergency operation indication features were detected for the three operation segments to be analyzed. SEG-003 came from MED-C, which has a sufficient privacy budget, and was directly judged by binary judgment; SEG-005 came from DIS-B and SEG-007 came from SUP-A, both of which are institutions with limited privacy budgets, and a relaxed detection strategy was adopted.

[0069] Example of probabilistic determination of SEG-005 (DIS-B) emergency authorization flag: The actual budget allocated to the DIS-B emergency authorization flag field is 0.2275, and the probability of retaining the true value in a random response is: In session SES-DB-018, containing SEG-005, there are 7 records, of which 2 have a true observation value, with a prior probability of 2 / 7 ≈ 0.286. For a record with a false observation value, the posterior probability that it actually contains an emergency authorization is: The posterior probability (0.242) does not exceed the preset probability judgment threshold (0.35), so the record is not judged to contain emergency authorization.

[0070] Example of adjusting the SEG-005 time interval threshold: The timestamp field allocation budget is 0.1300, the timestamp field sensitivity is 60 seconds, and the expected standard deviation of Laplace noise is: The standard emergency operation interval threshold is 180 seconds, with a tolerance factor of 1.5. The adjusted threshold is: Table 4. Detection results of emergency operation instruction features for the operation segment to be analyzed: SEG-003 meets all three features and is marked as a suspected emergency operation segment (high confidence); SEG-005 meets two features (time interval within the adjusted threshold and contains emergency operation type coding) and is marked as a suspected emergency operation segment (medium confidence); SEG-007 does not meet any features and is marked as a suspected violation operation segment.

[0071] Operation type encoding sequences were extracted from SEG-003 (MED-C) and SEG-005 (DIS-B), and Levenshtein distance matching was performed with the emergency business process variant template library. SEG-003 comes from privacy-budget-sufficient institutions, using a standard matching threshold of 3; SEG-005 comes from DIS-B, with the data quality level corresponding to a medium quality operation type encoding field, a quality coefficient of 0.5, an adjustment factor of 0.8, and an adjusted matching threshold of: Table 5: Template matching results for suspected emergency operation segments: The edit distance of SEG-003 is 1, which is much lower than the normal threshold of 3, indicating a high confidence level in the match. The edit distance of SEG-005 is 3, which is within the adjusted threshold of 4.2, indicating a medium confidence level in the match, reflecting the impact of decreased data quality on the reliability of the matching results.

[0072] For SEG-003 and SEG-005, each operation event sequence is aligned node by node with the matched emergency business process variant template. The alignment path generated by the Levenshtein algorithm in step 5 is directly read, process deviation information is marked, and the post-event supplementary records and approval records corresponding to the operator identifier and operation object identifier are retrieved in the operation event stream.

[0073] SEG-003 (MED-C, Emergency Rapid Transfer): The alignment path shows that the standard node "Dual Verification" is skipped, and the order of the remaining nodes is consistent with the template. There are no additional emergency special operations. The operation event stream shows that operator OP-MC-071 submitted a supplementary record (record number: POST-MC-20XX0318-031) within 4 hours after the event occurred. The approval record exists and has been approved.

[0074] SEG-005 (DIS-B, Emergency Compression Outbound): The alignment path shows that the "Quality Inspection Scan" node has been deleted, and the order of "Outbound Approval" and "Loading and Delivery" has been swapped. It also includes an emergency special operation node "OP-SHIP-SKIP". A supplementary record (record number: POST-DB-20XX0318-009) was found in the operation event stream, but the approval record is missing. The subsequent completion status is marked as "supplementary record exists, approval is missing".

[0075] The operation segments of each institution are linked together according to the drug flow direction SUP-A→DIS-B→MED-C to form a complete operation sequence. The consistency between adjacent institutional nodes is verified: the connection point between SUP-A (SEG-006, conventional intent, high confidence) and DIS-B (SEG-004, conventional intent, high confidence) is subject to strict consistency verification, and the drug batch identification, quantity (480 units), and time sequence are completely consistent; the connection point between DIS-B (SEG-005, medium confidence) and MED-C (SEG-003, high confidence) has a reduced verification stringency due to the presence of a medium confidence node in DIS-B, allowing quantity deviations within the tolerance range corresponding to the medium quality level (±5 units). The actual verified quantity difference was 3 units, which is within the tolerance range, and the verification conclusion is marked with a reliability level of "medium reliability".

[0076] Each operation segment in the entire operation sequence is labeled at the intent level, and the data quality level and privacy budget consumption status of each institutional node are noted to generate a final tracking report.

[0077] Table 6 Summary of Cross-Institutional Emergency Medication Use Operation Tracking Report: SUP-A's SEG-007 was marked as a high-concern operation segment because it did not meet any emergency operation instruction characteristics and required manual review; DIS-B's SEG-005 was successfully identified as an emergency compression outbound intention, and the lack of approval was clearly marked in the report; MED-C's SEG-003 was identified with high confidence as an emergency rapid transfer, and was subsequently completed.

[0078] Throughout the implementation process, data originates from the local operation logs of each institution. The privacy budget status report generated in Step 1 drives the differentiated processing strategy branching in Step 2: MED-C generates a high-quality standard event stream with a sufficient budget, while SUP-A and DIS-B generate differentiated event streams with data quality indicator labels using a limited budget. Initial clustering in Step 3 segments the event stream into operational fragments and distinguishes between routine intents and fragments to be analyzed. Step 4 employs different detection strategies based on the data quality labels of the source institutions, dividing the fragments to be analyzed into suspected emergency and suspected violation categories. Step 5 adaptively adjusts the matching threshold based on the data quality level to complete template matching, outputting emergency business intent labels with confidence levels. Step 6 utilizes the alignment path from Step 5 to supplement process deviations and post-event completion information. Step 7 connects the results of each node according to the drug flow direction and verifies the strictness in conjunction with the confidence level. Step 8 summarizes all labeled information to generate the final tracking report. Data quality level and privacy budget status are maintained throughout, ensuring that the credibility assessment of the tracking conclusions transparently corresponds to the actual data quality.

[0079] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. A method for tracking operations in a medical system based on log auditing, characterized in that, Includes the following steps: Obtain the target drug batch identifier from the emergency traceability request, determine the set of participating institutions involved, and each institution's local log processing node queries the cumulative privacy budget value in the local privacy budget ledger and calculates the remaining privacy budget value to generate a privacy budget status report. For organizations with sufficient privacy budgets, differential privacy processing is performed according to the standard privacy budget parameters to generate an operation event flow; for organizations with limited privacy budgets, the remaining privacy budget is differentially allocated according to the normalized proportion of the feature criticality of each field for identifying emergency intent, and then differential privacy processing is performed, with data quality indicator labels attached, to generate a differential privacy protection operation event flow. The operation event stream is grouped by session identifier and segmented by time interval to generate a set of operation segments. The operation intent clustering model is used to perform clustering processing on each operation segment, and operation segments that cannot match the known intent category are marked as operation segments to be analyzed. When analyzing operation segments, detect emergency operation indication features, mark operation segments that meet preset conditions as suspected emergency operation segments, and mark the rest as suspected violation operation segments; Extract the operation type encoding sequence from suspected emergency operation fragments, perform edit distance sequence alignment matching with the emergency business process variant template library, and assign emergency business intent labels to the successfully matched operation fragments; According to the direction of drug circulation, the operation segments of each institution are spliced ​​together across institutions to generate a full-process operation sequence. The operation segments in the full-process operation sequence are labeled with intent level, and a cross-institutional emergency drug use operation tracking report is generated.

2. The method for tracking medical system operations based on log auditing according to claim 1, characterized in that, The generation of the privacy budget status report includes: Each local log processing node queries the local privacy budget ledger for historical processing records that overlap with the log record set involved in the current request, extracts the consumed cumulative privacy budget value, and subtracts the cumulative privacy budget value from the organization's preset total privacy budget upper limit to obtain the remaining privacy budget value; The privacy budget status report includes an organization identifier, a remaining privacy budget value, and a privacy budget adequacy identifier. When the remaining privacy budget value is greater than or equal to the privacy budget value required to process all log records involved in the current request according to the regular privacy budget parameters, the privacy budget adequacy identifier indicates that the privacy budget is sufficient; otherwise, the privacy budget is limited. The privacy budget ledger is indexed by the unique identifier of each log record and records the privacy budget value and processing time allocated to each log record when it is processed by each historical request.

3. The method for tracking medical system operations based on log auditing according to claim 1, characterized in that, The method of differentially allocating the remaining privacy budget according to the normalization ratio of the feature criticality of each field for identifying emergency intent includes: The feature criticality of each field is divided into three levels: operation type code and emergency authorization flag are core fields for intent recognition, with the highest feature criticality weight; precise timestamp is a field that depends on time interval calculation, with the next highest feature criticality weight; operation parameter summary is an auxiliary field, with the lowest feature criticality weight. The feature criticality weights of each field are normalized using mean normalization based on the range; The privacy budget value allocated to each field is equal to the organization's remaining privacy budget value multiplied by the ratio of the normalized feature key weight of that field to the sum of the normalized feature key weights of all fields involved in the allocation.

4. The method for tracking medical system operations based on log auditing according to claim 1, characterized in that, The data quality indicator label is calculated based on the ratio of the actual privacy budget value allocated to each field to the conventional privacy budget parameter. The data quality indicator label is divided into three levels: high quality, medium quality, and low quality according to the ratio range. Before implementing differentiated privacy budget allocation for organizations with limited privacy budgets, check whether there is a subset of queries in the log records involved in the current request that are exactly the same as those in historical requests. For the subset of queries that are exactly the same, directly reuse the historical processing results stored in the local privacy budget ledger without consuming additional privacy budget. Only perform the differentiated privacy budget allocation and differential privacy processing on the log records that were not covered by historical requests.

5. The method for tracking medical system operations based on log auditing according to claim 1, characterized in that, The operation intent clustering model is a clustering model trained based on log data of historically labeled business operation intents. The operation intent clustering model performs clustering determination by calculating the cosine similarity between the composite feature vector of the input operation fragment and the center vector of each known intent category. When the cosine similarity with the center vector of all known intent categories is lower than the preset similarity threshold, an unknown intent label is output. The category center vector of each intent category is obtained by performing mean aggregation on the composite feature vectors of samples of the same intent category in the training set; the training uses the Adam optimization algorithm to minimize the intra-class compactness loss, which is defined as the negative mean of the cosine similarity between the composite feature vectors of each sample of the same intent category in the training set and the category center vector.

6. The method for tracking medical system operations based on log auditing according to claim 1, characterized in that, The emergency operation instruction features include the following three items: The fragment contains operation events with the emergency authorization flag set to true, the average time interval between operation events within the fragment is lower than a preset emergency operation time interval threshold, and the fragment contains a predefined emergency operation type code; The preset condition is that it includes at least two of the aforementioned emergency operation indication features; The suspected emergency operation segments are labeled with a detection confidence level. The detection confidence level is calculated based on the number of emergency operation instruction features satisfied and the degree to which each feature is satisfied. The detection confidence level of operation segments that satisfy three emergency operation instruction features is higher than that of operation segments that satisfy two emergency operation instruction features.

7. The method for tracking medical system operations based on log auditing according to claim 6, characterized in that, For operation segments from institutions with sufficient privacy budgets, a binary determination of the emergency operation instruction features is directly performed. For operation segments from institutions with limited privacy budgets, a relaxed detection strategy is adopted based on the data quality indicator label. The relaxed detection strategy includes: For the emergency authorization flag field, when the data quality level is medium or low, based on the random response mechanism, the probability of retaining the true value and the flipping probability under the actual privacy budget value allocated to the emergency authorization flag field are calculated. The proportion of records in the session where the emergency authorization flag is observed to be true is used as the prior probability. The posterior probability of the record actually containing emergency authorization is calculated when the emergency authorization flag is observed to be false. The probability of retaining the true value is equal to the ratio of the natural constant raised to the power of the actual privacy budget value allocated to the emergency authorization flag field to the sum of the power plus one. The posterior probability is equal to the product of the flipping probability and the prior probability divided by the sum of the product of the flipping probability and the prior probability plus the product of the probability of retaining the true value and the complement of the prior probability. When the posterior probability exceeds the preset probability judgment threshold, the record is still determined to contain emergency authorization. The determination of the operation time interval is to adjust the emergency operation time interval threshold to the normal emergency operation time interval threshold plus the product of the tolerance coefficient and the expected standard deviation of the timestamp noise, wherein the expected standard deviation of the timestamp noise is equal to the square root of two multiplied by the sensitivity of the timestamp field and then divided by the privacy budget value actually allocated to the timestamp field.

8. The method for tracking medical system operations based on log auditing according to claim 1, characterized in that, The edit distance sequence alignment matching uses the Levenshtein distance algorithm to calculate the edit distance between the operation type encoding sequence of the suspected emergency operation fragment and the operation type encoding sequence of the variant template. The variant template with the smallest edit distance and below the matching threshold is selected to be assigned an emergency business intent label. The confidence level of the emergency business intent label is determined based on the ratio of the edit distance to the matching threshold. The confidence level is divided into three levels: high confidence, medium confidence, and low confidence. For suspected emergency operation segments from organizations with limited privacy budgets, the matching threshold is adjusted to the product of the regular matching threshold and the difference between the adjustment coefficient and the quality coefficient corresponding to the data quality level. The quality coefficient corresponding to high quality is one, and the quality coefficients corresponding to medium quality and low quality decrease sequentially. The adjustment coefficient is a pre-set positive number.

9. The method for tracking medical system operations based on log auditing according to claim 8, characterized in that, For operation segments that have been successfully assigned emergency business intent labels, the alignment path generated when calculating the edit distance based on the Levenshtein distance algorithm is used to align the operation event sequence of the operation segment with the matched variant template node by node. Skipped standard nodes, nodes whose execution order has been adjusted, and additional emergency special operations are marked. Based on the operator identifier and operation object identifier, the corresponding post-entry records and post-approval records are retrieved in the operation event stream to generate an emergency operation intent context reconstruction result that includes emergency business intent labels, process variant deviation annotations, and post-completion status. In cross-institutional link splicing, when the confidence level of the emergency business intent label of adjacent institutional nodes is high, a strict consistency check is performed, requiring that the outbound operation of the upstream node and the inbound operation of the downstream node be completely consistent in terms of drug batch identification, quantity, and time sequence. When there are low-confidence nodes, the strictness of the check is reduced based on the data quality level of the low-confidence nodes, allowing deviations within the tolerance range corresponding to the data quality level in terms of quantity or time sequence, and the reliability level is marked in the check conclusion.

10. A log-auditing-based pharmaceutical system operation tracking system, used to execute the log-auditing-based pharmaceutical system operation tracking method according to any one of claims 1 to 9, characterized in that, include: The privacy budget status assessment module is used to obtain the target drug batch identifier in the emergency traceability request, determine the set of participating institutions involved, receive the remaining privacy budget value calculated by the local log processing nodes of each institution based on the local privacy budget ledger, and generate a privacy budget status report. The differential privacy processing module is used to perform differential privacy processing on institutions with sufficient privacy budgets according to the regular privacy budget parameters to generate operation event streams. For institutions with limited privacy budgets, the remaining privacy budget is differentially allocated according to the normalization ratio of the feature criticality of each field to identify emergency intent, and then differential privacy processing is performed and a data quality indicator label is attached to generate differential privacy protection operation event streams. The initial intent clustering module is used to group the operation event stream by session identifier and segment it by time interval to generate a set of operation fragments. It uses the operation intent clustering model to perform clustering processing on each operation fragment and marks the operation fragments that cannot match the known intent categories as operation fragments to be analyzed. The emergency operation instruction feature detection module is used to detect emergency operation instruction features in the operation segments to be analyzed, and to mark operation segments that meet preset conditions as suspected emergency operation segments, and the rest as suspected violation operation segments. The Emergency Business Process Variant Matching Module is used to extract the operation type encoding sequence from suspected emergency operation fragments, perform edit distance sequence alignment matching with the emergency business process variant template library, and assign emergency business intent labels to successfully matched operation fragments. The tracking report generation module is used to perform cross-institutional link splicing of operation segments from various institutions according to the direction of drug circulation to generate a full-process operation sequence, and to label each operation segment in the full-process operation sequence with intent level to generate a cross-institutional emergency drug use operation tracking report.

Images