Anomaly Detection in Medical Imaging Data Using Classification Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Medical imaging data, particularly DICOM files, are vulnerable to malware and anomalies, leading to potential data compromise and system infections, with traditional antivirus solutions causing latency and incorrectly quarantining files, and existing systems lacking visibility and capability for differentiated anomaly detection.
Innovation Solution
A system utilizing a processor and memory with instructions to evaluate medical imaging files using classification models, such as MLP, SVM, or CNN, to determine anomaly or malware likelihood, generate modified files by removing suspected malicious data, and retrain models based on thresholds, while maintaining valid metadata and image data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus and antimalware software are used to detect malware in DICOM files, then malware detection capability is improved, but file availability is worsened due to quarantine or deletion actions
Solution Approach 1:
The system changes the detection parameters from binary malware detection to a spectrum of anomaly scores (0-1). By using continuous scoring rather than simple presence/absence detection, the system can differentiate between benign anomalies and actual malware, allowing files to be processed without blanket quarantine while still maintaining security awareness.
Solution Approach 2:
The system dynamically adjusts its response based on the anomaly score threshold. Instead of static quarantine/deletion, the system can flexibly choose to modify files, quarantine them, or allow processing based on the scored anomaly level, making the security response adaptive rather than rigid.
2Reliability
If DICOM files are deployed to third-party systems for virus/malware detection, then detection accuracy is improved, but access latency is worsened
Solution Approach 1:
The system introduces an intermediary anomaly detection mechanism that operates within the existing PACS workflow rather than requiring external third-party systems. This intermediary detection layer can identify and score anomalies locally, eliminating the need to deploy files to external systems and thereby reducing latency while maintaining detection capability.
Solution Approach 2:
The anomaly detection and scoring is performed preliminarily within the PACS system before files need to be accessed or deployed externally. By conducting detection actions in advance and maintaining scored anomaly information, the system avoids subsequent delays when files are needed for processing or sharing.
3Reliability
If anomaly detection is implemented to identify compromised files, then security visibility is improved, but false positives increase due to new modalities generating unexpected DICOM payloads
Solution Approach 1:
The system changes from binary anomaly detection to scored anomaly detection (0-1 scale). This parameter change allows the system to quantify the degree of anomaly rather than simply flagging anything unexpected, enabling better differentiation between true security threats and benign variations from new imaging modalities.
Solution Approach 2:
The system incorporates feedback mechanisms where anomaly scores and detected patterns are continuously learned and refined. This feedback loop allows the detection system to adapt to new imaging modalities and patterns over time, reducing false positives as the system learns what legitimate variations look like while maintaining sensitivity to actual threats.
Data Source
AI summary
A system and methods for detecting anomalies and/or malware in medical imaging files are disclosed. The method generally includes obtaining a medical imaging file, evaluating the medical imaging file using a classification model to determine a first score representative of a likelihood that the medical imaging file contains anomalous or malicious data and to identify suspected anomalous or malicious data within the medical imaging file, modifying the medical imaging file that removes suspected anomalous or malicious data from the medical imaging file if the first score meets or exceeds a threshold, and if the first score is less than the first threshold, at least one of: i) store the medical imaging file without said modification, or ii) retrain the classification model based on the medical imaging file.