CN105100181A - Monitoring system based on big data and working method thereof - Google Patents

Abstract

The invention discloses a monitoring system based on big data and a working method thereof. The system comprises an intelligent medicine box, a physical sign measuring terminal and a remote server, wherein patient physical sign measured values collected by the physical sign measuring terminal are uploaded to the remote server through wireless signals; the remote server monitors whether a patient has taken medicine through a built-in medicine compliance judgment module, judges the rationality of medicine compliance of the patient and sending a judging result to the intelligent medicine box; the patient is prompted by a prompting module arranged in the intelligent medicine box; and/ or the judging result is sent to a doctor client end; and the intelligent medicine box is internally provided with a radio frequency scanning circuit, the radio frequency scanning circuit is suitable for scanning a bar code on a medicine bottle, displaying medicine information and uploading the medicine information to the remote server.

Description

A kind of supervisory control system based on large data and method of work thereof

Technical field

The present invention relates to medical information system, be specifically related to a kind of supervisory control system based on large data (namely based on the supervisory control system of large data server) and method of work thereof.

Background technology

The aging population of current social is for a problem faced by having to entire society, family, individual, most of the elderly is with diseases such as heart disease, diabetes, hypertension, these diseases often need patient to carry out long sustainable management to the disease of himself under the assistance of doctor, follow set diagnosis and treatment plan put into practice in many aspects such as medication, daily life, diet, motion, rehabilitation physical therapies.In the overall process of disease control, patient often needs to be timed to hospital's (particularly basic hospital) and follows up a case by regular visits to, so that doctor follows the tracks of the disease progression of patient and adjusts doctor's advice in time.

Because this is a longer time course, the often periods of months even several years; And this process often occurs in outside clinical setting, need that patient is autonomous spontaneously to be managed oneself disease and health.Some patient is owing to being familiar with strong or other odjective cause of deficiency, selfdiscipline, be difficult to accomplish strict implement doctor's advice, at regular time and quantity medication, follow up a case by regular visits on time, the state of an illness is occurred repeatedly or aggravation, affect result for the treatment of, increase medical expense, thus help it in the urgent need to some aids and carry out medical monitoring management.

Traditional medical profession requirements of process patient in timing is followed up a case by regular visits to doctor place, and not only consumption wealth consuming time, and patient has in clinical setting by the risk of cross-infection.And the rise of Tele medicine in recent years, make doctor can by the state of an illness of the Internet real-time tracking monitoring patient, understand the health status after the taking medicine of patient and key physiological index.Thus one, just can complete when doctor and patient stay indoors and conventional follow up a case by regular visits to operation flow.Particularly for chronic, if doctor's advice implementation effect is good, patient profiles stablizes, and relative physiologic index is without marked change, then doctor can determine to adopt current doctor's advice at this point, arrives hospital again follow up a case by regular visits to without the need to patient.

For solving the problem, Chinese patent literature application publication number CN102855406A discloses a kind of intelligent medicine purchase system of monitoring based on Telemedicine System and doctor's advice compliance, although this technical scheme describes the problem which solving patient consumes's remote monitoring, but it does not carry out automatic monitoring for a certain disease, does not also embody concrete detection means.And for example Chinese patent literature application number CN102292063A discloses a kind of method and apparatus for dispensing medicament, this technical scheme have been directed to medicine timely, correctly provide, but the unresolved technical problem that effect after taking medicine is monitored.

Summary of the invention

The object of this invention is to provide a kind of supervisory control system and method for work, native system and method for work, by detecting the data after patient consumes, solve patient in the technical problem that whether stipulated time takes medicine and reasonability of taking medicine judges.

In order to solve the problems of the technologies described above, the invention provides a kind of supervisory control system, comprising: intelligent medicine box, sign measuring terminals, and based on the remote server (also namely: large data server) of large data; The measured value of the patient sign of collection is uploaded to remote server by 3G or 4G wireless network by wherein said sign measuring terminals, whether described remote server realizes monitored patient by built-in drug administration judge module and takes medicine, and/or the reasonability of patient consumes is judged, and judged result is sent to intelligent medicine box and/or sign measuring terminals by 3G or 4G wireless network signal, and remind patient by the prompting module of establishing in intelligent medicine box and/or sign measuring terminals; And/or judged result is sent to doctor's client; Processor module and a radio frequency reading circuit be connected with this processor module is provided with in described intelligent medicine box, this medicine information to obtain medicine information, and is uploaded to remote server by the bar code on the medicine bottle in this radio frequency reading circuit sweeps intelligent medicine box by processor module.

Preferably, be provided with network attack defense module in described remote server, this network attack defense module comprises: controller, IDS policy server, distributed IDS equipment and flow cleaning center; When arbitrary IDS equipment Inspection is to when having the message of ddos attack feature, namely report to IDS policy server by SSL traffic channel; Described IDS policy server is according to reporting information, make the processing policy corresponding with the message with ddos attack feature, then this message is shielded by controller or the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center; This remote server realize take medicine monitoring object while, also there is the function resisting malicious attack, to ensure that network is unobstructed.

Preferably, in order to the better message to ddos attack feature screen, filtering; Comprise in described IDS equipment: deception packet check module, the deceptive practices of link layer and internetwork layer address are detected; Destroy packet check module, the abnormal behaviour that internetwork layer and transport layer flag bit are arranged is detected; Exception message detection module, detects the formula attack that floods of application layer and transport layer; Successively message is detected by described deception packet check module, destruction packet check module, exception message detection module; And when if arbitrary detection module detects that message exists above-mentioned respective behavior, then this message is proceeded to IDS policy server; Described IDS policy server is suitable for having deceptive practices when message, and attacks threat in OpenFlow territory, then shield main frame by controller; Maybe when attack threatens not in OpenFlow territory, then by controller, the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center; Described IDS policy server is also suitable for having abnormal behaviour when message, then shielded by the flow of controller to attacker or attack main frame; And when message has the formula attack that floods, then described IDS policy server is suitable for being filtered to flow cleaning center by the switch access interface traffic redirect corresponding to this message by controller.

Another aspect, in order to solve the problems of the technologies described above, present invention also offers a kind of method of work of above-mentioned supervisory control system, comprising the steps: step S000, obtains patient consumes's information; Whether step S100, taken medicine by remote monitoring patient, and step S200 judges the reasonability of patient consumes; Step S300, and according to judged result to remind patient, and/or judged result is sent to doctor's client.

Further, the method for whether being taken medicine by remote monitoring patient in described step S100 comprises the steps: step S110, sets up genius morbi value set; Step S120, obtains the measured value of the arbitrary acquisition time in collection period, then according to the difference of measured value of this measured value acquisition time identical with the last cycle and the slope calculations function SL interval time (t) of twice acquisition time; Whether step S130, set up patient according to described slope function SL (t) and to take medicine judgment formula, namely

$y_t=\left(\underset{t=1}{\overset{n1}{\mathrm{\Σ}}}(\mathrm{SL}\left(t\right)>\mathrm{\σ}1)\right),$ If time, then judge that patient does not take medicine;

In formula, σ 1 is the outlier threshold in the genius morbi value set when patient's single preset is not taken medicine corresponding to a characteristic value, described in for the accumulative threshold value of exception corresponding to the characteristic value when patient preset repeatedly does not take medicine, n1 is for gathering total degree.

Further, the method for whether being taken medicine by remote monitoring patient in described step S100 is also comprised: the result of calculation yt setting up judgment formula of taking medicine accordingly according to multiple characteristic values in described genius morbi value set _m, set up the judgment formula being suitable for judging whether to take medicine of multiple characteristic values;

Namely $\left(\underset{t=1}{\overset{n1}{\mathrm{\Σ}}}\underset{m=1}{\overset{n2}{\mathrm{\Σ}}}{\mathrm{yt}}_m\left(t\right)\right)>\mathrm{\ξ}1,$ Then judge that patient does not take medicine;

In formula, the multiple features outlier threshold of described ξ 1 corresponding to the various features value of patient when repeatedly not taking medicine preset, n2 is the quantity of characteristic value, the kind of m representation feature value.

Further, in described step S200, the method that the reasonability of patient consumes judges is comprised the steps:

Step S210, the standard value of the human body indicators parameter that default each acquisition time corresponding to genius morbi value set is corresponding; Step S220, calculates the measured value of arbitrary acquisition time and the difference functions D (t) of the standard value of identical acquisition time; Step S230, sets up patient consumes's reasonability judgment formula according to described difference functions D (t), namely

$y_r=\left(\underset{t=1}{\overset{n1}{\mathrm{\Σ}}}(D\left(t\right)>\mathrm{\σ}2)\right),$ If then judge that thing that patient takes medicine does not reach curative effect;

In formula, the outlier threshold corresponding to characteristic value σ 2 is not for reaching curative effect after default patient consumes time, the abnormal accumulative threshold value of many time points corresponding to characteristic value during for not reaching curative effect after default patient consumes.

Further, in described step S200, the method that the reasonability of patient consumes judges also is comprised the steps:

The result of calculation yr of reasonability judgment formula of taking medicine accordingly is set up according to multiple characteristic values in described genius morbi value set _m, set up multiple characteristic values be suitable for judge the rational formula of patient consumes;

Namely then judge that patient consumes does not reach curative effect;

In formula, described ξ 2 is for presetting the multiple features outlier threshold corresponding to various features value when not reaching curative effect after patient repeatedly takes medicine.

Further, in order to avoid patient is when multi-medicament carries out mixed clothes, generation pharmacology is conflicted, the method of work of described supervisory control system also comprises: a kind of method effectively avoiding medicine to mix clothes conflict, namely set up the mixed fail safe correspondence that takes of medicine to show, each unit item in this table is corresponding with the pharmacology information of each medicine respectively, to be tabled look-up successively comparison, to judge that each medicine is the fail safe of mixed clothes by the pharmacology information of this table to patient's each medicine to be taken.

Further, for special disease crowd, such as, heart disease, diabetes, the diseases such as hypertension, some medicine has taboo, wrongly take and can produce bad reaction, take on the corresponding basis shown of fail safe so the present invention also mixes at described medicine, set up the taboo drug control sublist of a certain disease, namely each unit item in this table is corresponding with the pharmacology information of each taboo medicine of described disease respectively, take after fail safe correspondence table tables look-up mixed to described medicine, to be tabled look-up successively comparison by the pharmacology information of taboo drug control sublist to patient's each medicine to be taken again, to judge that this medicine is to described disease fail safe.

Further, whether taken medicine by remote server monitored patient, and/or the reasonability of patient consumes is judged; In order to prevent network malicious attack, wherein, described remote server adopts SDN framework; Described SDN framework comprises: datum plane, using planar and control plane; Datum plane, when being arranged in the arbitrary IDS equipment Inspection of datum plane and threatening to attack, notice using planar enters into attack type analysis process; Using planar, for analyzing attack type, and threatens processing policy according to corresponding attack of attack type customization; Control plane, threatens Processing Interface for using planar provides to attack, and attacks threat identification interface for datum plane provides.

Beneficial effect of the present invention: whether (1) supervisory control system of the present invention and method of work achieve long-rangely takes medicine to patient, and the reasonability of taking medicine judges; And set up genius morbi value set, whether comprehensive descision takes medicine, improve the accuracy judged, and further the curative effect of taking medicine is detected, also feed back to doctor's client in time to by judged result simultaneously; (2) the present invention can also resist network malicious attack, normally works with Deterministic service device, and user side connects smooth and easy.

Accompanying drawing explanation

In order to make content of the present invention be more likely to be clearly understood, below basis specific embodiment and by reference to the accompanying drawings, the present invention is further detailed explanation, wherein

Fig. 1 shows the theory diagram of supervisory control system of the present invention.

Fig. 2 shows the theory diagram of IDS equipment;

Fig. 3 shows the flow chart of the method for work of supervisory control system of the present invention;

Fig. 4 shows in step S100 by method flow diagram that whether remote monitoring patient takes medicine;

Fig. 5 shows in step S200 the method flow diagram that the reasonability of patient consumes judges;

Fig. 6 shows the theory diagram of this remote server.

Embodiment

For making the object, technical solutions and advantages of the present invention clearly understand, below in conjunction with embodiment also with reference to accompanying drawing, the present invention is described in more detail.Should be appreciated that, these describe just exemplary, and do not really want to limit the scope of the invention.In addition, in the following description, the description to known features and technology is eliminated, to avoid unnecessarily obscuring concept of the present invention.

Embodiment 1

As shown in Figure 1, slow medicine of the present invention takes monitoring expert system, comprising: intelligent medicine box, sign measuring terminals, and remote server; The measured value of the patient sign gathered is uploaded to remote server by wireless signal (can select 2G, 3G or 4G wireless network signal) by wherein said sign measuring terminals, whether described remote server realizes monitored patient by built-in drug administration judge module and takes medicine, and/or the reasonability of patient consumes is judged, and judged result is sent to intelligent medicine box and/or sign measuring terminals by 2G, 3G or 4G wireless network signal; And remind patient by the prompting module of establishing in intelligent medicine box and/or sign measuring terminals; And/or judged result is sent to doctor's client; Be provided with a radio frequency reading circuit in described intelligent medicine box, medicine information to obtain medicine information, and is uploaded to remote server by the bar code on the medicine bottle in this radio frequency reading circuit sweeps intelligent medicine box by processor module.Wherein, the method for work about drug administration judge module will be described in detail in the following embodiments.Doctor's client is specially the man-machine interactive system of placing doctor place, and doctor also can in the situation of taking medicine of clinic monitored patient.

Described radio frequency reading circuit comprises: radio frequency reading module, for scanning the bar code on medicine bottle; This radio frequency reading module is connected with the processor module in intelligent medicine box control circuit, and this processor module is also connected with a memory module, and described memory module is for storing the medicine information corresponding with the bar code on medicine bottle; Whether described processor module is suitable for obtaining medicine information according to the bar code on scanning medicine bottle, and medicine information is uploaded to remote server, so that take medicine to patient, and/or judge the reasonability of patient consumes.Can also and shown by display module, after making patient abandon medicine packing box, keep the information of taking medicine of oneself.

Further, supervisory control system can also be connected with pharmacy's drug administration management system, by the instructions of taking of medicine by Internet Transmission in the memory of intelligent medicine box, to provide suggestion of taking medicine.

This intelligent medicine box also has medication amount measuring ability, when medication amount is not enough, carries out corresponding prompting.

Described prompting includes but not limited to adopt: light-emitting device, voice reminder or by means such as sending short message by mobile phone.

Described sign measuring terminals adopts the wrist strap or wrister (such as radio universal health monitoring wrist strap disclosed in Chinese patent literature CN203107107U that are worn on patients wrist, or watch strap human blood pressure non-invasive continuous detection device disclosed in Chinese patent literature CN100586366C), or be worn on all the other positions of human body (as waist, chest or leg first-class) health monitoring device (the disclosed health monitoring device based on Zigbee of such as Chinese patent literature CN101467878A), it can gather the sign information of patient, such as blood pressure, blood sugar, pulse, electrocardio, blood oxygen, part or all of in the information such as body temperature.The connected mode of sign measuring terminals and intelligent medicine box includes but not limited to the modes such as bluetooth, ultrasonic wave, Zigbee etc. are wireless or wired.The modes such as described intelligent medicine box uploads characteristic value, and the connected mode of sign measuring terminals and remote server can be wireless (2G, 3G or 4G), wired, realized by mixed-media network modules mixed-media, namely wireless module and ethernet module realize.

Further, as the optional execution mode of one of the present embodiment.

Be provided with network attack defense module in described remote server, this network attack defense module comprises: controller, IDS policy server, distributed IDS equipment and flow cleaning center; When arbitrary IDS equipment Inspection is to when having the message of ddos attack feature, namely report to IDS policy server by SSL traffic channel; Described IDS policy server is according to reporting information, make the processing policy corresponding with the message with ddos attack feature, then this message is shielded by controller or the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center.

Fig. 2 shows the theory diagram of IDS equipment.

As shown in Figure 2, further, comprise in described IDS equipment: deception packet check module, the deceptive practices of link layer and internetwork layer address are detected; Destroy packet check module, the abnormal behaviour that internetwork layer and transport layer flag bit are arranged is detected; Exception message detection module, detects the formula attack that floods of application layer and transport layer; Successively message is detected by described deception packet check module, destruction packet check module, exception message detection module; And when if arbitrary detection module detects that message exists above-mentioned respective behavior, then this message is proceeded to IDS policy server; Described IDS policy server is suitable for having deceptive practices when message, and attacks threat in OpenFlow territory, then shield main frame by controller; Maybe when attack threatens not in OpenFlow territory, then by controller, the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center; Described IDS policy server is also suitable for having abnormal behaviour when message, then shielded by the flow of controller to attacker or attack main frame; And when message has the formula attack that floods, then described IDS policy server is suitable for being filtered to flow cleaning center by the switch access interface traffic redirect corresponding to this message by controller.

Wherein, ddos attack characterizing definition is: to the deceptive practices of link layer and internetwork layer address, the abnormal behaviour that arranges internetwork layer and transport layer flag bit, and to flood formula attack to application layer and transport layer.IDS is intrusion detection device.SDN is software defined network.

The present invention adopts from deception packet check module to destruction packet check module, then to the order that exception message detection module detects successively, wherein, each module obtains packet information and adopts independently Interface design, reduces the coupling relevance of intermodule; And each module uses the program data structure optimized, and each process sub-process of careful segmentation, improves the high cohesion characteristic of module.This detection ordering improves the detection efficiency to message data, and reduces loss.

Call network equipment information binding table by described deception packet check module, and in described IDS policy server, build the first Hash table being suitable for that packet cheating behavior is counted in the unit interval, and set the first threshold values in this first Hash table; Described deception packet check module, the type of the message be encapsulated in Packet-In message is resolved, to obtain corresponding source, object IP address, MAC Address and to upload No. DPID, switch and the port number information of Packet-In message, and each information is compared with the corresponding information in network equipment information binding table respectively; If the above-mentioned information matches in message, then message is proceeded to and destroy packet check module; If the above-mentioned information in message is not mated, then proceed to described IDS policy server, abandon, and count deceptive practices simultaneously message, when this count value is more than the first threshold values, shielding sends program and/or the main frame of this message.

Concrete, described deception packet check module is used for carrying out first time judgement to message, namely judges whether message is IP spoofing attack message, port spoofing attack message or MAC spoofing attack message.

Concrete steps comprise: parse source, target MAC (Media Access Control) address and switch entrance first in ethernet frames, then parse different messages according to different type of messages.When type of message is IP, ARP, RARP, then parse corresponding source, object IP address then these information to be tabled look-up coupling to the information in network equipment information binding table, if match corresponding information, then give and destroy packet check resume module.If do not mate, then this message is proceeded to the process of IDS policy server; And accumulated counts is carried out to deceptive practices simultaneously, when this count value is more than the first threshold values, shielding sends program and/or the main frame of this message.

Have a device manager module DeviceManagerImpl in Floodlight, when an equipment in a network mobile device time tracking equipment, and according to newly flowing define equipment.

Equipment manager learns equipment from PacketIn request, and from PacketIn message, obtain device network parameter information (information such as source, object IP, MAC, VLAN), is carried out dividing into switch or main frame by equipment by entity classification device.Under default situations, entity classification device uses MAC Address and/or vlan table to show an equipment, mark equipment that these two attributes can be unique.The important information of another one is that the mounting points (No. DPID of switch and port numbers) of equipment is (in an openflow region, an equipment can only have a mounting points, and here openflow region refers to the set of the multiple switches be connected with same Floodlight example.Equipment manager is also provided with expired time for IP address, mounting points, equipment, and last timestamp is as judging the foundation whether they are expired.)

Therefore only need call the IDeviceService that DeviceManagerImpl module provides inside network equipment information binding table module, simultaneously to the monitoring interface of this service interpolation IDeviceListener.

The monitoring interface that wherein IDeviceListener provides has:

ISP: IFloodlightProviderService, IDeviceService

Rely on interface: IFloodlightModule, IDeviceListener

Record in table can refresh the record in binding table in real time according to the low and high level trigger mechanism (low level triggering PortDown extracted by netting twine, and netting twine pulls out the high level of triggering PortUp) of switch.

Traditional ddos attack cannot touch, revise the information of SwitchDPID and SwitchPort, utilizes this advantage, can detect spoofing attack more flexibly.

In described IDS policy server, build being suitable in the unit interval the second Hash table that abnormal behaviour counts is arranged to the flag bit of message, and set the second threshold values in this second Hash table; The each flag bit of described destruction packet check module to message detects, to judge whether each flag bit meets ICP/IP protocol specification; If each flag bit of message meets, then message is proceeded to exception message detection module; If each flag bit of message does not meet, then proceed to described IDS policy server, abandon message, and arrange abnormal behaviour to flag bit simultaneously and count, when this count value is more than the second threshold values, shielding sends program and/or the main frame of this message.

Concrete, described destruction packet check module, judges for carrying out second time to message, namely judges whether message is the attack message with malice flag bit feature.Wherein, the attack message with malice flag bit feature includes but not limited to IP attack message, TCP attack message.Implementation step comprises: detection IP attack message and TCP/UDP attack message wherein being realized to the flag bit of each message, namely identifies whether each flag bit meets ICP/IP protocol specification.If met, just directly transfer to abnormal number packet check resume module.If do not meet, be then judged as attack message, proceed to the process of IDS policy server.

With typical attack such as TearDrop for row, an offset field and a burst mark (MF) is had in IP packet header, if assailant is arranged to incorrect value offset field, IP fragmentation message just there will be the situation overlapping or disconnect, and target machine system will be collapsed.

In IP heading, have a protocol fields, this field specifies this IP message and carries which kind of agreement.The value of this field is less than 100, if assailant sends to target machine the IP message that a large amount of bands is greater than the protocol fields of 100, the protocol stack in target machine system will be damaged, and is formed and attacks.

Therefore in destruction packet check module, first extract each flag bit of message, then check whether normal.

If normal, then give subsequent module for processing.

If abnormal, then abandon this packet, and to corresponding Hash table rolling counters forward.If when unit interval inside counting device exceedes described second threshold values of setting, then call IDS policy server and corresponding program is shielded and/or directly shields corresponding main frame.

After packet filtering by deception packet check module, the address in the follow-up packet handled by destruction packet check module is all real.Like this, effectively avoid target machine and have received destruction message, may directly cause the protocol stack of target machine to collapse, even target machine directly collapses.

The processing capacity destroying packet check module is roughly similar with deception packet check handling process, and whether normal the flag bit of what difference was that destruction packet check module parses is each message, then detect each flag bit.

If talked about normally, just directly to follow-up exception message detection module process.

If abnormal, then abandon this packet, and to the corresponding Hash table inside counting device counting of host application reference mechanism.If exceed the threshold values of setting, then shield corresponding attacker or directly shield and attack main frame.

The Hash table for identifying the formula attack message that floods is built at described exception message detection module, in described IDS policy server, build the 3rd Hash table being suitable for that the formula attack of flooding is counted in the unit interval, and set the 3rd threshold values in the 3rd Hash table; Described exception message detection module, is suitable for judging whether described message has attack according to the threshold values set in described Hash table; If without attack, then by data distributing; If have attack, then proceed to described IDS policy server, abandon, and count attack simultaneously message, when count value is more than the 3rd threshold values, shielding sends program and/or the main frame of this message.

Concrete, described exception message detection module, judges for carrying out third time to message, namely judges whether message is the formula attack message that floods.

Concrete steps comprise: utilize the identification to building to flood adding up to the respective record in Hash table of formula attack message, and detect whether exceed threshold value, to judge whether the being formula attack message that floods.

Through above-mentioned deception packet check module, the filtering destroying packet check module two modules, the packet of subsequent module for processing belongs to packet under normal circumstances substantially.But, under normal circumstances, also have ddos attack and produce, in the prior art, generally only carry out deception packet check module, destroy packet check module, and in the technical program, in order to avoid ddos attack as much as possible.

Following examples to after carrying out deception packet check module, destroying packet check modular filtration, then shield the embodiment of ddos attack by exception message detection module.This execution mode is for UDPFlooding and ICMPFlooding.

About UDPFloodling, utilizing the mechanism of udp protocol without the need to connecting, sending a large amount of UDP message to target machine.Target machine can spend a large amount of time-triggered protocol UDP messages, and these UDP attack messages not only can make the cache overflow depositing UDP message, and can take a large amount of network bandwidths, and target machine (or little) cannot receive legal UDP message.

Because different main frames sends a large amount of UDP message bag to single main frame, so certainly have the situation that udp port takies, so the technical program can receive the unreachable bag of port of an ICMP.

So the technical program can set up a Hash table to All hosts, be used for specially depositing in the unit interval number of times receiving the unreachable bag of ICMP port.If exceed the threshold values of setting, then directly shield corresponding attacker.

About ICMPFloodling, directly unit interval inside counting is carried out for ICMPFlooding.If exceed corresponding threshold values, then direct corresponding shielding is carried out to respective host, although the method is simple, directly effective.

Therefore, exception message detection module, if the type of message detected is exception message type of detection, then carries out corresponding counter detection and whether exceedes threshold value, if do not exceed threshold value, also can be issued by optimum routing policy this packet.If exceeded threshold value, then shield corresponding attacker, or directly corresponding shielding has been carried out to respective host.

When in described deception packet check module, destruction packet check module and exception message detection module, arbitrary module judges that described message is above-mentioned attack message, then this attack message is proceeded to IDS policy server, that is, abandon described message, and shielding sends program and/or the main frame of this message.

When " deception packet check module ", " destroying packet check module " and " exception message detection module " need packet discard or needs to shield threat main frame time.Directly call IDS policy server and carry out corresponding threat process operation.

The concrete implementation step of described IDS policy server comprises:

Abandon described message, namely the step of packet discard comprises as follows:

OpenFlow switch is not matching under corresponding stream expression condition, can this data envelope be contained in PacketIn message, this packet exists in local buffer memory by exchange opportunity simultaneously, packet is deposited in the buffer, there is No. ID, a buffer area, this No. ID also can be encapsulated in the buffer_id of PacketIn message, by the form of Packetout, the buffer_id simultaneously in Packetout message fills in the buffer area ID (buffer_id in corresponding PacketIn message) of the packet that will abandon.

The step of shielding main frame comprises as follows:

OpenFlow protocol streams list structure is as follows:

Territory, packet header

Counter

Action

The structure in its middle wrapping head territory is:

IDS policy server comprises the step that application programs carries out shielding and comprises as follows:

Step 1: fill in corresponding matching field in the territory, packet header of stream table, and by arranging Wildcards mask field, obtain shielding attacker or host information.Wherein, as attacker need be shielded, then in territory, stream table packet header, fill in following matching field: IP, MAC, VLAN, SwtichDPID, SwtichPort, protocol type and port numbers thereof etc.As need main frame be shielded, then fill in territory, stream table packet header: the matching fields such as IP, MAC, VLAN, SwtichDPID, SwtichPort.

Step 2: stream is shown action lists and puts sky, realizes the data packet discarding of attacker/main frame.

Step 3: call the record value in each Hash table, calculates stream table time-out erasing time automatically.

Step 4: issue stream table mask program or main frame.

Therefore, the network of the technical program can effectively identify and filtering attack packets, and remote server can be avoided to be subject to malicious attack.

Embodiment 2

Fig. 3 shows the flow chart of the method for work of supervisory control system of the present invention.

As shown in Figure 3, the method for work of supervisory control system of the present invention, comprises the steps: step S000, obtains patient consumes's information; Whether step S100, taken medicine by remote monitoring patient; Step S200, judges the reasonability of patient consumes; Step S300, and according to judged result to remind patient, and/or judged result is sent to doctor's client.

In described step S000, obtaining patient consumes's information can be obtained by radio frequency reading circuit in embodiment 1.

Fig. 4 shows in step S100 by method flow diagram that whether remote monitoring patient takes medicine.

As shown in Figure 4, concrete, the method for whether being taken medicine by remote monitoring patient in described step S100 is comprised the steps:

Step S110, sets up genius morbi value set.

Step S120, slope calculations function.Obtain the measured value of arbitrary acquisition time in collection period, then according to the difference of measured value of this measured value acquisition time identical with the last cycle and the slope calculations function SL interval time (t) of twice acquisition time.

Step S130, builds judgment formula of taking medicine.Set up patient according to described slope function SL (t) whether to take medicine judgment formula, namely

$y_t=\left(\underset{t=1}{\overset{n1}{\mathrm{\Σ}}}(\mathrm{SL}\left(t\right)>\mathrm{\σ}1)\right),$ If time, then judge that patient does not take medicine;

In formula, σ 1 is the outlier threshold in the genius morbi value set when patient's single preset is not taken medicine corresponding to a characteristic value, described in for the accumulative threshold value of exception corresponding to the characteristic value when patient preset repeatedly does not take medicine, n1 is for gathering total degree.

Further, the method for whether being taken medicine by remote monitoring patient in described step S100 is also comprised:

The result of calculation yt of judgment formula of taking medicine accordingly is set up according to multiple characteristic values in described genius morbi value set _m, set up the judgment formula being suitable for judging whether to take medicine of multiple characteristic values;

Namely $\left(\underset{t=1}{\overset{n1}{\mathrm{\Σ}}}\underset{m=1}{\overset{n2}{\mathrm{\Σ}}}{\mathrm{yt}}_m\left(t\right)\right)>\mathrm{\ξ}1,$ Then judge that patient does not take medicine;

In formula, the multiple features outlier threshold of described ξ 1 corresponding to the various features value of patient when repeatedly not taking medicine preset, n2 is the quantity of characteristic value, the kind of m representation feature value.

Fig. 5 shows in step S200 the method flow diagram that the reasonability of patient consumes judges.

As shown in Figure 5, concrete, in described step S200, the method that the reasonability of patient consumes judges is comprised the steps:

Step S210, presets relevant parameter, i.e. the standard value of the human body indicators parameter that default each acquisition time corresponding to genius morbi value set is corresponding.

Step S220, calculated difference, calculates the measured value of arbitrary acquisition time and the difference functions D (t) of the standard value of identical acquisition time.

Step S230, sets up patient consumes's reasonability judgment formula according to described difference functions D (t), namely

$y_r=\left(\underset{t=1}{\overset{n1}{\mathrm{\Σ}}}(D\left(t\right)>\mathrm{\σ}2)\right),$ If then judge that thing that patient takes medicine does not reach curative effect;

In formula, the outlier threshold corresponding to characteristic value σ 2 is not for reaching curative effect after default patient consumes time, the abnormal accumulative threshold value of many time points corresponding to characteristic value during for not reaching curative effect after default patient consumes, n1 is for gathering total degree.

Further, in described step S200, the method that the reasonability of patient consumes judges also is comprised the steps:

The result of calculation yr of reasonability judgment formula of taking medicine accordingly is set up according to multiple characteristic values in described genius morbi value set _m, set up multiple characteristic values be suitable for judge the rational formula of patient consumes;

Namely then judge that patient consumes does not reach curative effect;

In formula, described ξ 2 is for presetting the multiple features outlier threshold corresponding to various features value when not reaching curative effect after patient repeatedly takes medicine, and n2 is the quantity of characteristic value, the kind of m representation feature value.

Technical scheme for a better understanding of the present invention, illustrates hypertension as follows as concrete execution mode.

One, the monitoring features value of hypertensive patient is determined

The characteristic value of hypertensive patient's sign mainly contains: systolic pressure C ₁, diastolic pressure C ₂, Related Risk Factors quantity C ₃, set up genius morbi value set according to above-mentioned characteristic value, wherein each characteristic value can represent with Cm, the kind of m representation feature value.The feature of real-time measurement only has 2: systolic pressure C ₁, diastolic pressure C ₂, for Related Risk Factors quantity C ₃do not need to measure, can by the parameter of doctor by diagnosis typing.

Systolic pressure C ₁with diastolic pressure C ₂value be regular to be obtained by sign measuring terminals (blood pressure instrument) collection, and characteristic value to be transferred in system by long-range intelligent medicine box.

The standard value S of characteristic value is determined according to hypertensive classification situation (normal, prehypertensive, I level hypertension, II level hypertension, III level hypertension, ISH and hypertension emergency) and delamination (low danger, middle danger, high-risk and very high-risk) ₁and S ₂.

Hypertensive disease classification has come by table one:

The table one hypertension grading table of comparisons

Hypertensive disease layering has come by table two:

The table two hypertension layering table of comparisons

Conventional take medicine after Normal Diagnosis value

Table three is hypertensive normal value table after effectively taking medicine

According to table 3, determine characteristic value systolic pressure C ₁, diastolic pressure C ₂corresponding standard value S ₁=130 or S ₂=140 or S ₁=150, S ₂=90 or S ₁=80.

The hazards relevant to hypertension are main is correlated with following medical history: diabetes, obesity, hyperhomocysteinemiainjury, high fat of blood, atherosclerotic, gout, ephrosis, family of stroke, smoking, drink, heart disease family history etc.C ₃value equal quantity shared in the disease that current patient specifies above, when this value there occurs change, then C ₃also change.According to features of hypertension, get Related Risk Factors quantity C ₃corresponding standard value S ₃=0.

Two, determine that characteristic value measures frequency

According to the feature of human body, the high blood pressure peak value of people appears at about 10 (t in the morning ₁) and mid-afternoon (t ₂), (t about the blood pressure low peak of people appears at 1:00 AM ₃), because 1:00 AM is the length of one's sleep of people, thus with (t before sleeping ₄) and (t after getting up morning ₅) double measurement substitute.

Judge whether a people has hypertension, and general recommendations is at t ₁and t ₂time point is measured; And judge that the validity of taking medicine generally measures (t in the set time of every day ₀).

In sum, hypertensive feature can at t ₀, t ₁, t ₂, t ₄, t ₅carry out measuring.

Three, characteristic value slope function generates

For each characteristic index, generate slope function:

SL1(t)＝(T1(t)-T1(t0))/(t-t0)

SL2(t)＝(T2(t)-T2(t0))/(t-t0)

Wherein t0 represents same Measuring Time point the previous day, because according to the undulating value in a day of human blood-pressure, the measurement of section just has comparative sense at one time.

These two functions are also the points of series of discrete on two-dimensional coordinate, and consecutive points straight line connects, then also constitute two broken line graphs.

Four, characteristic value difference functions generates

Every day is at t ₀, t ₁, t ₂, t ₄, t ₅totally 5 time carries out systolic pressure and the diastolic pressure of Measure blood pressure.

Systolic pressure is labeled as function T1 (t), and every day, the measurement point of 5 time points was discrete point: T1 ₀, T1 ₁, T1 ₂, T1 ₄, T1 ₅

Diastolic pressure is labeled as function T2 (t), and every day, the measurement point of 5 time points was discrete point: T2 ₀, T2 ₁, T2 ₂, T2 ₄, T2 ₅

The difference functions of structure systolic pressure:

D1 (t)=T1 (t)-S1, wherein t=0,1,2,4,5

D2 (t)=T2 (t)-S2, wherein t=0,1,2,4,5

These two functions form multiple with discrete point on two-dimensional coordinate, and consecutive points straight line connects then formation two broken lines.

Five, the generation of anomaly parameter threshold value

In calculating below, need to use 4 important threshold parameters: σ 1, σ 2,

σ 1 is the outlier threshold in the genius morbi value set when patient's single preset is not taken medicine corresponding to a characteristic value, described in for the accumulative threshold value of exception corresponding to the characteristic value when patient preset repeatedly does not take medicine, through can empirical value be drawn, σ 1=0.3 π → 0.5 π to high blood pressure disease test, accuracy is higher.

Outlier threshold corresponding to characteristic value when σ 2 is not for reaching curative effect after the patient consumes that presets (also can referred to as disease reasonability anomaly parameter threshold value), the abnormal accumulative threshold value of many time points corresponding to characteristic value during for not reaching curative effect after the patient consumes that presets (also can referred to as disease reasonability outlier threshold), through can empirical value be drawn, σ 2=10 → 20 to high blood pressure disease test, accuracy is higher.

Six, the function of whether taking medicine of characteristic value generates, and namely whether patient takes medicine judgment formula

Seven, the generation of characteristic value rational function, i.e. patient consumes's reasonability judgment formula

Eight, set up the result of calculation of judgment formula of taking medicine accordingly according to multiple characteristic values in described genius morbi value set, set up the judgment formula being suitable for judging whether to take medicine of multiple characteristic values;

if $\left(\underset{t=1}{\overset{n1}{\mathrm{\Σ}}}\underset{m=1}{\overset{2}{\mathrm{\Σ}}}{\mathrm{yt}}_m\left(t\right)\right)>\mathrm{\ξ}1$ then

Do not take medicine

else

Normally take medicine

The multiple features outlier threshold of described ξ 1 corresponding to the various features value of patient when repeatedly not taking medicine preset, with according to being that 5-8 is more reasonable to this value of hypertensive test.2 is the quantity of characteristic value.

Nine, the result of calculation yr of reasonability judgment formula of taking medicine accordingly is set up according to multiple characteristic values in described genius morbi value set _m, set up multiple characteristic values be suitable for judge the rational formula of patient consumes;

if $\left(\underset{t=0}{\overset{n1}{\mathrm{\Σ}}}\underset{m=1}{\overset{2}{\mathrm{\Σ}}}{\mathrm{yr}}_m\left(t\right)\right)>\mathrm{\ξ}2$ then

Take medicine rationally

else

Take medicine unreasonable

Wherein said ξ 2 for presetting the multiple features outlier threshold corresponding to various features value when not reaching curative effect after patient repeatedly takes medicine, with according to being that 5-8 is more reasonable to this value of hypertensive test.

Ten, set up the mixed fail safe correspondence that takes of medicine to show.

The method of work of described supervisory control system also comprises:

Set up that medicine is mixed takes fail safe correspondence table, that is, each unit item in this table is corresponding with the pharmacology information of each medicine respectively, to be tabled look-up successively comparison, to judge that each medicine is the fail safe of mixed clothes by the pharmacology information of this table to patient's each medicine to be taken.

Concrete, the mixed fail safe correspondence that takes had in system between various medicine is shown, and can represent with B matrix:

$B=\left(\begin{array}{cccc}{b}_{11}& b_{12}& \·\·\·& b_{1n}\\ b_{21}& b_{22}& \·\·\·& b_{2n}\\ \·& \·& \·& \·\\ \·& \·& \·& \·\\ \·& \·& \·& \·\\ b_{n1}& b_{n2}& \·\·\·& b_{\mathrm{nn}}\end{array}\right)$

B matrix table is shown with the conflict test chart of n kind medicine, wherein: b _ij(i, j=1,2,, n) represent in i-th kind of medicine and jth: plant the conflicting that medicine mixes clothes, if not conflict, be then 1, have conflict to be then 0.Because medicine itself is inconsistent, then b can be found out _mm=1, namely diagonal is 1, namely as follows

Suppose certain clothes for patients m kind medicine, then:

Judge that medicine is mixed and take security test.

if $\underset{i=1}{\overset{m}{\mathrm{\Π}}}\underset{j=1}{\overset{m}{\mathrm{\Π}}}{b}_{\mathrm{ij}}=1$ then

Mix and take safety of medicine

else

Mixed thing of taking medicine is dangerous

Further, the mixed fail safe correspondence table that takes of described medicine also comprises: the taboo drug control sublist of a certain disease, namely each unit item in this table is corresponding with the pharmacology information of each taboo medicine of described disease respectively, take after fail safe correspondence table tables look-up mixed to described medicine, to be tabled look-up successively comparison by the pharmacology information of taboo drug control sublist to patient's each medicine to be taken again, to judge that this medicine is to described disease fail safe.

Concrete, there is a disease taboo drug reference table in systems in which, can represents with T series vector:

$T_1=\left[\begin{array}{cccc}{t}_{11}& t_{12}& \·\·\·& t_{{1n}_1}\end{array}\right]$

$T_2=\left[\begin{array}{cccc}{t}_{21}& t_{22}& \·\·\·& t_{{2n}_2}\end{array}\right]$

…

$T_n=\left[\begin{array}{cccc}{t}_{n1}& t_{n2}& \·\·\·& t_{{\mathrm{nn}}_n}\end{array}\right]$

The medicine table of T series vector representation hypertension taboo, vector T _m(m=1,2,, n) represent that label is prohibited take medicine thing table, wherein t by m disease _mi.(i=1,2 ... n _m) represent m disease prohibit certain medicines of clothes.

Suppose that certain patient has x kind complication, currently taken y kind medicine, then:

Judge hypertension and the security test of complication medicine contraindication.

if $\underset{i=1}{\overset{x}{\mathrm{\Π}}}\underset{j=1}{\overset{y}{\mathrm{\Π}}}{t}_j\∉T_i=1$ then

Take medicine without taboo

else

To take medicine taboo

Whether the optional execution mode of the one as the present embodiment, taken medicine by remote server monitored patient, and/or judge the reasonability of patient consumes.

Fig. 6 shows the theory diagram of this remote server.

As shown in Figure 6, wherein, described remote server adopts SDN framework; Described SDN framework comprises: datum plane, using planar and control plane; Datum plane, when being arranged in the arbitrary IDS equipment Inspection of datum plane and threatening to attack, notice using planar enters into attack type analysis process; Using planar, for analyzing attack type, and threatens processing policy according to corresponding attack of attack type customization; Control plane, threatens Processing Interface for using planar provides to attack, and attacks threat identification interface for datum plane provides.

Described attack threat includes but not limited to: DDOS attack threatens.

Wherein, SDN is software defined network.

In Fig. 6, using planar threatens processing policy about attack type analysis, attack, the attack monitoring of datum plane, attack threaten shielding and routing optimality, and the attack of control plane threatens process, attack threat identification is launched to illustrate in embodiment 1, repeats no more here.

Judging whether patient takes medicine in above-described embodiment, and/or in the rational process of patient consumes, cicada information that patient suffers from the disease in advance, this information can be obtained by multiple channel, such as undertaken inputting (input mode can adopt key-press input and speech recognition to input) by intelligent medicine box by patient, or obtained from medical diagnostic system by remote server.

Claims (10)

1. a supervisory control system, is characterized in that, comprising: intelligent medicine box, sign measuring terminals, and remote server; Wherein

The measured value of the patient sign of collection is uploaded to remote server by 3G or 4G wireless network by described sign measuring terminals, whether described remote server realizes monitored patient by built-in drug administration judge module and takes medicine, and/or the reasonability of patient consumes is judged, and judged result is sent to intelligent medicine box and sign measuring terminals by 3G or 4G wireless network signal, and remind patient by the prompting module of establishing in intelligent medicine box and sign measuring terminals;

Processor module and a radio frequency reading circuit be connected with this processor module is provided with in described intelligent medicine box, medicine information to obtain medicine information, and is uploaded to remote server by the bar code on the medicine bottle in this radio frequency reading circuit sweeps intelligent medicine box by processor module.

2. supervisory control system according to claim 1, is characterized in that, is provided with network attack defense module in described remote server, and this network attack defense module comprises: controller, IDS policy server, distributed IDS equipment and flow cleaning center;

When arbitrary IDS equipment Inspection is to when having the message of ddos attack feature, namely report to IDS policy server by SSL traffic channel;

Described IDS policy server is according to reporting information, make the processing policy corresponding with the message with ddos attack feature, then this message is shielded by controller or the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center.

3. remote server according to claim 2, is characterized in that, comprises in described IDS equipment:

Deception packet check module, detects the deceptive practices of link layer and internetwork layer address;

Destroy packet check module, the abnormal behaviour that internetwork layer and transport layer flag bit are arranged is detected;

Exception message detection module, detects the formula attack that floods of application layer and transport layer;

Successively message is detected by described deception packet check module, destruction packet check module, exception message detection module; And when if arbitrary detection module detects that message exists above-mentioned respective behavior, then this message is proceeded to IDS policy server;

Described IDS policy server is suitable for having deceptive practices when message, and attacks threat in OpenFlow territory, then shield main frame by controller; Maybe when attack threatens not in OpenFlow territory, then by controller, the switch access interface traffic redirect corresponding to this message is filtered to flow cleaning center;

Described IDS policy server is also suitable for having abnormal behaviour when message, then shielded by the flow of controller to attacker or attack main frame; And

When message has the formula attack that floods, then described IDS policy server is suitable for being filtered to flow cleaning center by the switch access interface traffic redirect corresponding to this message by controller.

4. a method of work for supervisory control system according to claim 1, is characterized in that comprising the steps:

Step S000, obtains patient consumes's information;

Whether step S100, taken medicine by remote monitoring patient;

Step S200, judges the reasonability of patient consumes;

Step S300, and according to judged result to remind patient, and/or judged result is sent to doctor's client.

5. the method for work of supervisory control system according to claim 4, is characterized in that,

The method of whether being taken medicine by remote monitoring patient in described step S100 is comprised the steps:

Step S110, sets up genius morbi value set;

Step S120, obtains the measured value of the arbitrary acquisition time in collection period, then according to the difference of the measured value of this measured value acquisition time identical with the last cycle and slope calculations function SL(t interval time of twice acquisition time);

Step S130, according to described slope function SL(t) set up patient and whether to take medicine judgment formula, namely

if, time, then judge that patient does not take medicine;

In formula, for the outlier threshold in the genius morbi value set when patient's single preset is not taken medicine corresponding to a characteristic value, described in for the accumulative threshold value of exception corresponding to the characteristic value when patient preset repeatedly does not take medicine, n1 is for gathering total degree.

6. the method for work of supervisory control system according to claim 5, is characterized in that,

The method of whether being taken medicine by remote monitoring patient in described step S100 is also comprised:

The result of calculation of judgment formula of taking medicine accordingly is set up according to multiple characteristic values in described genius morbi value set , set up the judgment formula being suitable for judging whether to take medicine of multiple characteristic values;

Namely , then judge that patient does not take medicine;

In formula, described in multiple features outlier threshold corresponding to the various features value of patient when repeatedly not taking medicine preset, n2 is the quantity of characteristic value, the kind of m representation feature value.

7. the method for work of supervisory control system according to claim 6, is characterized in that,

In described step S200, the method that the reasonability of patient consumes judges is comprised the steps:

Step S210, the standard value of the human body indicators parameter that default each acquisition time corresponding to genius morbi value set is corresponding;

Step S220, calculates the measured value of arbitrary acquisition time and the difference functions D(t of the standard value of identical acquisition time);

Step S230, according to described difference functions D(t) set up patient consumes's reasonability judgment formula, namely

if, , then judge that thing that patient takes medicine does not reach curative effect;

In formula, outlier threshold corresponding to characteristic value during for not reaching curative effect after default patient consumes, the abnormal accumulative threshold value of many time points corresponding to characteristic value during for not reaching curative effect after default patient consumes.

8. the method for work of supervisory control system according to claim 7, is characterized in that,

In described step S200, the method that the reasonability of patient consumes judges also is comprised the steps:

The result of calculation of reasonability judgment formula of taking medicine accordingly is set up according to multiple characteristic values in described genius morbi value set , set up multiple characteristic values be suitable for judge the rational formula of patient consumes;

Namely , then judge that patient consumes does not reach curative effect;

In formula, described in for default patient repeatedly take medicine after do not reach curative effect time various features value corresponding to multiple features outlier threshold.

9. the method for work of supervisory control system according to claim 8, is characterized in that, the method for work of described supervisory control system also comprises:

Set up that medicine is mixed takes fail safe correspondence table, that is, each unit item in this table is corresponding with the pharmacology information of each medicine respectively, to be tabled look-up successively comparison, to judge that each medicine is the fail safe of mixed clothes by the pharmacology information of this table to patient's each medicine to be taken; And/or

The mixed fail safe correspondence table that takes of described medicine also comprises: the taboo drug control sublist of a certain disease, namely each unit item in this table is corresponding with the pharmacology information of each taboo medicine of described disease respectively, take after fail safe correspondence table tables look-up mixed to described medicine, to be tabled look-up successively comparison by the pharmacology information of taboo drug control sublist to patient's each medicine to be taken again, to judge that this medicine is to described disease fail safe.

10. whether the method for work of supervisory control system according to claim 4, is characterized in that, taken medicine by remote server monitored patient, and/or judges the reasonability of patient consumes;

Wherein, described remote server adopts SDN framework;

Described SDN framework comprises: datum plane, using planar and control plane;

Datum plane, when being arranged in the arbitrary IDS equipment Inspection of datum plane and threatening to attack, notice using planar enters into attack type analysis process;

Using planar, for analyzing attack type, and threatens processing policy according to corresponding attack of attack type customization;

Control plane, threatens Processing Interface for using planar provides to attack, and attacks threat identification interface for datum plane provides.