CN113361977A

CN113361977A - Intelligent medical big data security risk processing method and intelligent medical server

Info

Publication number: CN113361977A
Application number: CN202110877991.1A
Authority: CN
Inventors: 尹晓兵; 古丽波; 莫正兵; 黄昌源
Original assignee: Shenzhen Hemeixin Precision Electronics Co ltd
Current assignee: Shenzhen Hemeixin Precision Electronics Co ltd
Priority date: 2021-08-02
Filing date: 2021-08-02
Publication date: 2021-09-07

Abstract

When the method is applied, the technical problem that the operation information collection time periods of different intelligent medical user ends are not considered in all directions to realize effective identification of abnormal diagnosis operation in the related technology can be solved, and the abnormal diagnosis operation identification can be carried out on the diagnosis interaction operation information by combining the remote diagnosis trigger time period, the operation limit index and the operation information collection time period so as to ensure that the detection result of the abnormal diagnosis operation can reflect the detection result of the related diagnosis operation from the time sequence angle, the diagnosis interaction angle and the terminal angle, so that the abnormal diagnosis operation for the remote medical interaction under the condition related to forbidden behaviors can be accurately and reliably identified based on the detection result of the abnormal diagnosis operation, and the related information safety risks and the medical safety risks are reduced to a certain extent, ensure the normal operation of the remote treatment service.

Description

Intelligent medical big data security risk processing method and intelligent medical server

Technical Field

The application relates to the technical field of digitization and intelligent medical treatment, in particular to an intelligent medical treatment big data security risk processing method and an intelligent medical treatment server.

Background

With the continuous development of digital technology and internet technology, more and more traditional industries expand new branches under the large environment of mobile internet, and one of the mobile medical fields (smart medical or digital medical) created by combining traditional medical treatment and mobile products is the traditional medical industry.

The digital upgrading of intelligent medical treatment can break region limitation and time limitation, thereby remarkably improving the medical interaction efficiency and improving the utilization rate of medical resources, and effectively solving the pain points of 'difficult seeing a doctor' and 'difficult seeking medical doctor' in the traditional medical treatment.

Currently, the operation of smart medicine can be based on remote interaction between a medical server and a medical client. However, in the practical application process, the medical client may cause information security risk and medical security risk in the intelligent medical environment due to improper remote medical treatment operation, so that it is difficult to ensure the normal operation of the intelligent medical treatment.

Disclosure of Invention

One of the embodiments of the present application provides an intelligent medical big data security risk processing method, where the method is applied to an intelligent medical server communicatively connected to a plurality of intelligent medical clients, where the plurality of intelligent medical clients are communicatively connected to each other, and the method includes: acquiring doctor seeing interaction operation information corresponding to different intelligent medical user sides and aiming at remote medical services; wherein, the operation limiting indexes respectively corresponding to the different intelligent medical user terminals have differences; and based on the operation information collection time periods of the treatment interactive operation information aiming at the remote medical service respectively corresponding to the different intelligent medical user sides, carrying out abnormal treatment operation identification on the treatment interactive operation information aiming at the remote medical service respectively corresponding to the different intelligent medical user sides to obtain an abnormal treatment operation detection result.

One embodiment of the present application provides an intelligent medical server, including a processor and a memory; the processor is in communication with the memory, from which the processor reads the computer program and operates to perform the method described above.

According to the application, the first group of the treatment interactive operation information corresponding to the first smart medical user side aiming at the remote medical service and the second group of the treatment interactive operation information corresponding to the second smart medical user side aiming at the remote medical service are obtained, wherein the first group of the treatment interactive operation information aiming at the remote medical service and the second group of the treatment interactive operation information aiming at the remote medical service are respectively treatment interactive operation information aiming at the remote medical service, which is obtained by carrying out multiple times of treatment interactive operation information acquisition on the target remote treatment medical item by the first smart medical user side and the second smart medical user side within the preset remote treatment triggering time period, the operation limiting indexes aiming at the remote medical service of the first smart medical user side and the second smart medical user side are different, and the operation information collecting time period and the second group of the treatment interactive operation information collecting time period are based on the operation information collecting time period of the first group of the treatment interactive operation information aiming at the remote medical service And according to the operation information collection period of the treatment interactive operation information of the telemedicine service, carrying out abnormal treatment operation identification on the first group of treatment interactive operation information aiming at the telemedicine service and the second group of treatment interactive operation information aiming at the telemedicine service to obtain an abnormal treatment operation detection result.

Therefore, the technical problem of effectively identifying abnormal treatment operation without comprehensively considering the operation information collection time intervals of different intelligent medical user terminals in the related art can be solved, further, the abnormal diagnosis operation identification can be carried out on the diagnosis interaction operation information by combining the remote diagnosis triggering time interval, the operation limiting index and the operation information collecting time interval, so as to ensure that the detection result of the abnormal treatment operation can reflect the detection result of the related treatment operation from the time sequence angle, the treatment interaction angle and the terminal angle, therefore, the abnormal treatment operation of remote medical interaction under the condition related to the forbidden behavior can be accurately and reliably identified based on the detection result of the abnormal treatment operation, therefore, the occurrence of related information safety risks and medical safety risks is reduced to a certain extent, and the normal operation of the remote medical service is ensured.

Drawings

Fig. 1 is a block diagram of a hardware structure of an intelligent medical server implementing a security risk processing method for intelligent medical big data according to an embodiment of the present application.

Fig. 2 is a flowchart of an alternative method for processing safety risk of smart medical big data according to an embodiment of the present application.

Fig. 3 is a schematic diagram illustrating a procedure of transmitting the abnormal medical examination operation detection result to a target medical examination operation detection network to obtain a remote medical examination behavior detection result according to some embodiments of the present application.

FIG. 4 is a block diagram illustrating an exemplary intelligent medical big data security risk processing system according to some embodiments of the present application.

Detailed Description

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings used in the description of the embodiments will be briefly introduced below. It is obvious that the drawings in the following description are only examples or embodiments of the application, from which the application can also be applied to other similar scenarios without inventive effort for a person skilled in the art. Unless otherwise apparent from the context, or otherwise indicated, like reference numbers in the figures refer to the same structure or operation.

It should be understood that "system", "device", "unit" and/or "module" as used herein is a method for distinguishing different components, elements, parts, portions or assemblies at different levels. However, other words may be substituted by other expressions if they accomplish the same purpose.

As used in this application and the appended claims, the terms "a," "an," "the," and/or "the" are not intended to be inclusive in the singular, but rather are intended to be inclusive in the plural unless the context clearly dictates otherwise. In general, the terms "comprises" and "comprising" merely indicate that steps and elements are included which are explicitly identified, that the steps and elements do not form an exclusive list, and that a method or apparatus may include other steps or elements.

Flow charts are used herein to illustrate operations performed by systems according to embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed in the exact order in which they are performed. Rather, the various steps may be processed in reverse order or simultaneously. Meanwhile, other operations may be added to the processes, or a certain step or several steps of operations may be removed from the processes.

The method provided in the embodiment of the present application may be executed in an intelligent medical server, a cloud server, or a similar digital processing device. Taking an example of the smart medical server running on the smart medical server, fig. 1 is a block diagram of a hardware structure of the smart medical server of the smart medical big data security risk processing method according to the embodiment of the present application. As shown in fig. 1, the smart medical server 100 may include one or more processors 110 (only one is shown in fig. 1) (the processor 110 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), and a memory 120 for storing data, wherein the smart medical server 100 may further include a transmission device 130 for communication function. It will be understood by those skilled in the art that the structure shown in fig. 1 is only an illustration, and does not limit the structure of the smart medical server 100. For example, the smart medical server 100 may also include more or fewer components than shown in FIG. 1, or have a different configuration than shown in FIG. 1.

The memory 120 may be used to store a computer program, for example, a software program and a module of application software, such as a computer program corresponding to the intelligent medical big data security risk processing method in the embodiment of the present application, and the processor 110 executes various functional applications and data processing by running the computer program stored in the memory 120, so as to implement the above method. Memory 120 may include high speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 120 may further include memory remotely located from the processor 110, which may be connected to an intelligent medical server over a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission device 130 is used to acquire or transmit data information via a network. An example of the network may include a wireless network provided by a communication provider of the intelligent medical server. In one example, the transmission device 130 includes a Network adapter (NIC) that can be connected to other Network intelligent medical clients through a base station to communicate with the internet. In one example, the transmission device 130 may be a Radio Frequency (RF) module, which is used for communicating with the internet in a wireless manner.

The embodiment of the application provides an intelligent medical big data security risk processing method which is operated on an intelligent medical server, a cloud server or a similar digital processing device, for example, the method can be applied to the intelligent medical server with a plurality of intelligent medical user terminals in communication connection, and the plurality of intelligent medical user terminals are in communication connection with each other. Further, the method may comprise the following: acquiring doctor seeing interaction operation information corresponding to different intelligent medical user sides and aiming at remote medical services; wherein, the operation limiting indexes respectively corresponding to the different intelligent medical user terminals have differences; and based on the operation information collection time periods of the treatment interactive operation information aiming at the remote medical service respectively corresponding to the different intelligent medical user sides, carrying out abnormal treatment operation identification on the treatment interactive operation information aiming at the remote medical service respectively corresponding to the different intelligent medical user sides to obtain an abnormal treatment operation detection result.

By applying the method, the technical problem that the operation information collection time intervals of different intelligent medical user terminals are not considered comprehensively to realize effective identification of abnormal treatment operation in the related technology can be solved, further, the abnormal diagnosis operation identification can be carried out on the diagnosis interaction operation information by combining the remote diagnosis triggering time interval, the operation limiting index and the operation information collecting time interval, so as to ensure that the detection result of the abnormal treatment operation can reflect the detection result of the related treatment operation from the time sequence angle, the treatment interaction angle and the terminal angle, therefore, the abnormal treatment operation of remote medical interaction under the condition related to the forbidden behavior can be accurately and reliably identified based on the detection result of the abnormal treatment operation, therefore, the occurrence of related information safety risks and medical safety risks is reduced to a certain extent, and the normal operation of the remote medical service is ensured.

On the basis of the above, the embodiment of the present application further describes the above solution, and will be described with reference to the related drawings, fig. 2 is a flowchart of an optional intelligent medical big data security risk processing method according to the embodiment of the present application, and as shown in fig. 2, the method may include the following STEPs STEP210-STEP 220.

STEP210, obtaining a first set of treatment interaction operation information for the remote medical service corresponding to the first smart medical user terminal and a second set of treatment interaction operation information for the remote medical service corresponding to the second smart medical user terminal.

For example, the first group of the visit interactive operation information for the remote medical service is the visit interactive operation information for the remote medical service, which is obtained by the first smart medical user side performing the multiple-visit interactive operation information acquisition on the target remote visit medical item within the preset remote visit trigger period, and the second group of the visit interactive operation information for the remote medical service is the visit interactive operation information for the remote medical service, which is obtained by the second smart medical user side performing the multiple-visit interactive operation information acquisition on the target remote visit medical item within the preset remote visit trigger period. In the embodiment of the present application, the first smart medical client and the second smart medical client have different operation restriction indexes for the remote medical service.

It can be understood that STEP210 is a STEP of "obtaining the visit interaction operation information for the remote medical service corresponding to different intelligent medical clients respectively; wherein, there is a difference in the operation restriction indexes corresponding to the different intelligent medical clients. In STEP210, the smart medical client may be a digital terminal device, a platform medical service terminal, or other digital device terminals capable of performing remote medical interaction. Furthermore, different intelligent medical clients communicate with each other to realize medical information sharing, instant doctor-patient communication and appointment of seeing a doctor. Because the digital medical mode does not have participants participating in remote medical interaction in a non-medical scene, rapid medical interaction can be realized, medical resources are prevented from being maliciously occupied, and rights and interests of patients and hospitals are guaranteed. It is understood that, in the embodiment of the present application, the communication connection between the smart medical server and the plurality of smart medical clients serves for the diagnosis operation identification.

In this embodiment, the first set of visit interaction operation information for the remote medical service corresponding to the first smart medical client may be understood as the first set of visit interaction operation information for the remote medical service collected by the first smart medical client in the digital medical interaction scenario, or as the first smart medical client generated in the digital medical interaction scenario. Similarly, the second group of the visit interactive operation information for the remote medical service corresponding to the second smart medical user terminal can be understood as the second group of the visit interactive operation information for the remote medical service collected by the second smart medical user terminal in the digital medical interactive scene, or as the second smart medical user terminal generated in the digital medical interactive scene. It is understood that the first set of visit interaction maneuver information for the telemedicine service may include a plurality of visit interaction maneuver information, such as: { information11, information12, information13, information14, } the second group of information about the treatment interaction operation for telemedicine service may include a plurality of pieces of information about the treatment interaction operation, such as { information21, information22, information23, information24, }. In addition, in order to ensure the ordered processing of the remote medical services, remote medical service triggering time periods are usually set for different intelligent medical clients in advance, that is, during the remote medical service triggering time periods, the intelligent medical clients can perform the interaction of the remote medical services. For example, telemedicine services include, but are not limited to, appointment visits, off-site interrogation, on-line payment for medical fees, and the like. In addition, the target remote medical treatment project may correspond to a plurality of intelligent medical user terminals, and the target remote medical treatment project may also be one of the medical service projects such as the medical treatment appointment, the remote inquiry, the online payment of medical fees, and the like. For the convenience of the following description, the first smart medical subscriber terminal is defined as MED Client1, and the second smart medical subscriber terminal is defined as MED Client 2. Further, in order to ensure normal business traffic between different intelligent medical clients, different operation restriction indexes for the remote medical service may be set for different intelligent medical clients. For example, for the first intelligent medical user end MED Client1, the operation restriction index may be for paying the medical fee according to a specified payment form, and for the second intelligent medical user end MED Client2, the operation restriction index may be for paying the medical fee within a specified payment time period. Of course, the operation limitation index for different smart medical clients may also be other constraint conditions or other limitation conditions, which are not listed here.

Based on the content, the treatment interactive operation information of different intelligent medical user sides aiming at the same target remote treatment medical project can be determined, so that the subsequent abnormal treatment operation identification can be realized based on the remote treatment triggering time period, the operation limiting index and the intelligent medical user side level, and the efficiency and the reliability of the abnormal treatment operation identification can be improved.

Generally speaking, different types of smart medical clients may have different preprocessing modes for the diagnosis interactive operation information for the remote medical service, and in order to ensure the integrity and accuracy of the acquired first group of diagnosis interactive operation information for the remote medical service corresponding to the first smart medical client and the second group of diagnosis interactive operation information for the remote medical service corresponding to the second smart medical client, the corresponding smart medical clients may be instructed to perform relevant information preprocessing in advance. To achieve the above object, on the premise that the first smart medical user end is a digital terminal device and the second smart medical user end is a platform medical service end, before the implementation step of "obtaining a first set of treatment interactive operation information for the telemedical service corresponding to the first smart medical user end and a second set of treatment interactive operation information for the telemedical service corresponding to the second smart medical user end", the smart medical server may further implement the following: instructing the digital terminal equipment to perform information analysis on a group of remote medical information contents acquired by the digital terminal equipment to obtain the number of a group of remote medical treatment items in the target remote medical treatment item and corresponding treatment interactive operation information aiming at the remote medical treatment items; generating a first group of treatment interactive operation information aiming at the remote medical service according to the number of the group of remote treatment items and the corresponding treatment interactive operation information aiming at the remote treatment items; on the premise that the target intelligent medical user side comprises a platform medical service terminal, instructing the platform medical service terminal to perform service analysis operation on a group of remote medical information contents acquired by the platform medical service terminal to obtain a group of auxiliary remote medical services; and generating a second group of treatment interactive operation information aiming at the remote medical service according to the group of auxiliary remote medical services.

For example, by instructing the digital terminal device to perform information analysis on a group of remote medical information contents acquired by the digital terminal device, the remote medical information contents can be optimized and adjusted, so that the treatment interactive operation information for the remote treatment events which can be directly used for information identification processing can be obtained, and further, by determining the number of a group of remote treatment events in the target remote treatment medical project, accurate statistics on the number of the first group of treatment interactive operation information for the remote medical service can be realized. In addition, since the auxiliary telemedicine service may involve information risk and medical risk problems, when the second group of treatment interactive operation information for the telemedicine service is generated according to the group of auxiliary telemedicine service, the risk verification of the treatment operation items corresponding to the auxiliary telemedicine service can be performed based on the service analysis operation process of the platform-based medical service terminal for telemedicine information content, so that the information risk and the medical risk of the generated second group of treatment interactive operation information for the telemedicine service are avoided.

STEP220, based on the first group of operation information collection periods for collecting the first group of treatment interaction operation information for the remote medical service at the first intelligent medical user side and the second group of operation information collection periods for collecting the second group of treatment interaction operation information for the remote medical service at the second intelligent medical user side, performing abnormal treatment operation identification on the treatment interaction operation information for the remote medical service included in the first group of treatment interaction operation information for the remote medical service and the treatment interaction operation information for the remote medical service included in the second group of treatment interaction operation information for the remote medical service, and obtaining an abnormal treatment operation detection result.

It is to be understood that the abnormal medical treatment operation detection result may be used to identify the abnormal medical treatment operation, and in the embodiment of the present application, the abnormal medical treatment operation may be a medical treatment operation in an operation situation related to a local intelligent medical user terminal or a remote intelligent medical user terminal corresponding to a forbidden behavior (such as an irregular behavior or a behavior with an information security risk). Further, when the abnormal treatment operation is identified, the time domain influence and the communication network influence of the remote medical service can be considered by taking the operation information collection time periods of the treatment interactive operation information corresponding to different intelligent medical clients and aiming at the remote medical service into consideration, so that the accuracy of the detection result of the abnormal treatment operation is ensured.

For example, the operation information collection time period may be a time period from when the smart medical user collects the first visit interactive operation information to when the collection of the last visit interactive operation information is completed, or may be a time period corresponding to the time period after the smart medical user activates the information collection thread, or may be a time period after the smart medical user triggers the remote medical service event, which is not limited in the embodiment of the present application. Of course, in the implementation process, the determination manner of the operation information collection period may also include other manners, such as determining the operation information collection period based on the visit interaction operation authentication information. On this basis, based on the operation information collection period during which the first group of visit interaction operation information for the telemedicine service is collected by the first smart medical user end and the operation information collection period during which the second group of visit interaction operation information for the telemedicine service is collected by the second smart medical user end, the visit interaction operation information for the telemedicine service included in the first group of visit interaction operation information for the telemedicine service and the visit interaction operation information for the telemedicine service included in the second group of visit interaction operation information for the telemedicine service are subjected to abnormal visit operation identification, and before an abnormal visit operation detection result is obtained, the operation information collection periods corresponding to different smart medical user ends may be determined as follows: acquiring a first group of diagnosis interaction operation authentication information corresponding to the first intelligent medical user side and a second group of diagnosis interaction operation authentication information corresponding to the second intelligent medical user side; determining a time period for acquiring each diagnosis interaction operation authentication information included in the first group of diagnosis interaction operation authentication information as an operation information collection time period for the first intelligent medical user side to collect the diagnosis interaction operation information for the remote medical service included in the first group of diagnosis interaction operation information for the remote medical service; and determining the time period for acquiring each diagnosis interaction operation authentication information included in the second group of diagnosis interaction operation authentication information as an operation information collection time period for the second intelligent medical user side to collect the diagnosis interaction operation information for the remote medical service included in the second group of diagnosis interaction operation information for the remote medical service.

In the above-mentioned scheme for determining the operation information collection period based on the visit interactive operation authentication information, since the first group of visit interactive operation authentication information corresponding to the first smart medical user terminal and the second group of visit interactive operation authentication information corresponding to the second smart medical user terminal are analyzed, the information collection behavior corresponding to the invalid visit interactive operation information can be cleaned, thereby ensuring the accuracy of the obtained operation information collection period. For example, for the first intelligent medical user end MED Client1, if the time period for acquiring each visit interaction operation authentication information included in the first set of visit interaction operation authentication information is not determined as the operation information collection time period for the first intelligent medical user end to collect the visit interaction operation information for the remote medical service included in the first set of visit interaction operation information for the remote medical service, then when the first intelligent medical user end MED Client1 first collected the failed visit interaction operation information (or understood as a non-medical visit service operation), the intelligent medical server may perform the operation information collection time period determination based on the time when the first intelligent medical user end MED Client1 first collected the failed visit interaction operation information, if the failed visit interaction operation information collection time is ahead of the visit interaction operation authentication information, the operation information collecting period during which the first smart medical user terminal collects the visit interaction operation information for the telemedical service included in the first set of visit interaction operation information for the telemedical service is erroneously enlarged. For example, the collection time of the invalid diagnosis interaction operation information is time1, the collection time of the diagnosis interaction operation authentication information in the first group of diagnosis interaction operation authentication information is time 2-time 10, if the collection time of the diagnosis interaction operation authentication information is not taken as a reference, the operation information collection time period corresponding to the determined first intelligent medical user end MED Client1 may be time 1-time 10, and the actual operation information collection time period is time 2-time 10. For another example, the collection time of the failed visiting interactive operation information is time15, the collection time of the visiting interactive operation authentication information in the first group of visiting interactive operation authentication information is time 1-time 10, if the collection time of the visiting interactive operation authentication information is not taken as a reference, the operation information collection time period corresponding to the determined first intelligent medical user end MED Client1 may be time 1-t 15, and the actual operation information collection time period is time 1-time 10. Therefore, through the content, the operation information collection time intervals corresponding to different intelligent medical user terminals can be accurately determined. In this embodiment of the application, the diagnosis interaction operation authentication information may be diagnosis interaction operation information corresponding to the intelligent medical user terminal after the intelligent medical user terminal is subjected to the relevant validity authentication, and may be generally understood as safe diagnosis interaction operation information. It can be understood that, for the description of the operation information collection period, included in the second group of the visit interaction operation information for the remote medical service, collected by the second smart medical user end, the visit interaction operation information for the remote medical service may refer to the above contents, and is not described herein again.

On the basis, determining the time period for acquiring each diagnosis interaction operation authentication information included in the first group of diagnosis interaction operation authentication information as an operation information collection time period for the first smart medical user terminal to collect the diagnosis interaction operation information for the remote medical service included in the first group of diagnosis interaction operation information for the remote medical service may include the following steps: the first group of diagnosis interactive operation authentication information comprises that the first intelligent medical user side generates and issues a priority comparison result of each diagnosis interactive operation information for the remote medical service, which is included in the first group of diagnosis interactive operation information for the remote medical service, on the premise that the corresponding diagnosis interactive operation information marked with a first prohibition behavior identifier is acquired, the time period for acquiring the diagnosis interactive operation information marked with the first prohibition behavior identifier is determined as the time period for acquiring the diagnosis interactive operation information for the remote medical service, which is included in the first group of diagnosis interactive operation information for the remote medical service and corresponds to the diagnosis interactive operation information marked with the first prohibition behavior identifier.

Correspondingly, determining the time period for acquiring each diagnosis interaction operation authentication information included in the second group of diagnosis interaction operation authentication information as the operation information collection time period for the second smart medical user terminal to collect the diagnosis interaction operation information for the remote medical service included in the second group of diagnosis interaction operation information for the remote medical service includes: the second group of diagnosis interactive operation authentication information comprises that the second intelligent medical user side determines the time period for acquiring the diagnosis interactive operation information marked with the second prohibition behavior mark as the time period for acquiring the diagnosis interactive operation information corresponding to the remote medical service and corresponding to the diagnosis interactive operation information marked with the second prohibition behavior mark, wherein the time period for acquiring the diagnosis interactive operation information marked with the second prohibition behavior mark is included in the second group of diagnosis interactive operation information corresponding to the diagnosis interactive operation information marked with the second prohibition behavior mark.

It is to be understood that, since the description for the step of determining the time period for acquiring each of the diagnosis interaction operation authentication information included in the first set of diagnosis interaction operation authentication information as the operation information collection time period for the first smart medical user terminal to collect the diagnosis interaction operation information for the remote medical service included in the first set of diagnosis interaction operation information for the remote medical service "and the description for the step of determining the time period for acquiring each of the diagnosis interaction operation authentication information included in the second set of diagnosis interaction operation authentication information as the operation information collection time period for the second smart medical user terminal to collect the diagnosis interaction operation information for the remote medical service included in the second set of diagnosis interaction operation authentication information" are similar, only the description for the step of determining the time period for acquiring each of the diagnosis interaction operation authentication information included in the second set of diagnosis interaction operation authentication information is as follows A further embodiment of the operation information collection period for the second smart medical user terminal to collect the visit interaction operation information for the remote medical service included in the second set of visit interaction operation information for the remote medical service is described.

In practical implementation, the priority comparison result of each visit interactive operation information for the remote medical service may be understood as the sequence of each visit interactive operation information for the remote medical service, such as information11, information12, information13 and information14, and the priority comparison result may be:

information11 is earlier than information12, information12 is earlier than information13, and information13 is earlier than information 14. The priority comparison result may correspond to the collection time or the generation time of the interactive operation information of different visits, and is not limited herein. Further, the visit interactive operation information marked with the first prohibited behavior identifier may be understood as the visit interactive operation information for the prohibited behavior. The first prohibited behavior identifier may be a quantization label or an alphabetical label, for example, the quantization label "1" indicates a label for the prohibited behavior behavioresult1, and the quantization label "2" indicates a label for the prohibited behavior behavioresult 2. It can be understood that, through the above contents, the diagnosis interactive operation authentication information, the diagnosis interactive operation information marked with the first prohibited behavior identifier, and the diagnosis interactive operation information for the remote medical service can be comprehensively analyzed, so that the operation information collection time period can be accurately counted.

On the basis, after the visit interaction operation information marked with the forbidden behavior mark is taken into account, the corresponding abnormal diagnosis operation identification can be performed, for this purpose, the above steps are "based on the operation information collection time period during which the first intelligent medical user terminal collects the first group of diagnosis interactive operation information for the remote medical service and the operation information collection time period during which the second intelligent medical user terminal collects the second group of diagnosis interactive operation information for the remote medical service, the method further includes performing abnormal diagnosis operation identification on the diagnosis interaction operation information for the remote medical service included in the first group of diagnosis interaction operation information for the remote medical service and the diagnosis interaction operation information for the remote medical service included in the second group of diagnosis interaction operation information for the remote medical service, and further includes the following steps: performing joint analysis on the first prohibited behavior identifier and the second prohibited behavior identifier based on the time period for acquiring the first prohibited behavior identifier and the time period for acquiring the second prohibited behavior identifier, so as to bind the first prohibited behavior identifier and the second prohibited behavior identifier with the minimum quantitative difference of the acquired time periods with each other; and performing corresponding abnormal diagnosis operation recognition on the diagnosis interaction operation information for the remote medical service, which is included in the first group of diagnosis interaction operation information for the remote medical service and corresponds to the first prohibited behavior identifier, and the diagnosis interaction operation information for the remote medical service, which is included in the second group of diagnosis interaction operation information for the remote medical service and corresponds to the second prohibited behavior identifier, based on the joint analysis result of the first prohibited behavior identifier and the second prohibited behavior identifier.

For example, the prohibited behavior identifier may be sent by a remote visit interactive object (other intelligent medical user terminal) corresponding to the target remote visit medical item to a corresponding intelligent medical user terminal, for example, the first intelligent medical user terminal MED Client1 may bind the first prohibited behavior identifier and the corresponding visit interactive operation information after obtaining the first prohibited behavior identifier sent by the remote visit interactive object, and in general, the visit interactive operation information marked with the first prohibited behavior identifier is multiple, and the visit interactive operation information marked with the second prohibited behavior identifier is multiple, so that the first prohibited behavior identifier and the second prohibited behavior identifier may be jointly analyzed based on the time period for obtaining the first prohibited behavior identifier and the time period for obtaining the second prohibited behavior identifier, for example, each first prohibited behavior identifier and each second prohibited behavior identifier are subjected to pair analysis, thereby binding the first prohibited behavior flag and the second prohibited behavior flag, which have the smallest quantization difference in the acquisition period, to each other.

After the identifier pairing is performed, based on a joint analysis result of the first prohibited behavior identifier and the second prohibited behavior identifier, the corresponding abnormal diagnosis operation identification may be performed on the diagnosis interaction operation information for the remote medical service, which is included in the first group of diagnosis interaction operation information for the remote medical service and corresponds to the first prohibited behavior identifier, and the diagnosis interaction operation information for the remote medical service, which is included in the second group of diagnosis interaction operation information for the remote medical service and corresponds to the second prohibited behavior identifier. Further, when the abnormal diagnosis operation identification is performed, the matching degree of the identifiers in the combined analysis result of the first prohibited behavior identifier and the second prohibited behavior identifier may be analyzed first, and if the matching value corresponding to the matching degree of the identifiers is lower than the set matching value, the diagnosis interaction operation information for the remote medical service, which is included in the first group of diagnosis interaction operation information for the remote medical service and corresponds to the first prohibited behavior identifier, and the diagnosis interaction operation information for the remote medical service, which is included in the second group of diagnosis interaction operation information for the remote medical service and corresponds to the second prohibited behavior identifier, may be paired according to a first preset policy to obtain matching information, where the matching information includes a plurality of pairs of application-response operation information and key descriptions corresponding to each pair of application-response operation information, the key description can represent the limiting condition feedback information corresponding to the visit interaction operation information. In this way, the abnormal diagnosis operation detection result of the first intelligent medical subscriber MED Client1 and the abnormal diagnosis operation detection result of the second intelligent medical subscriber MED Client2 can be determined by the application-response operation information. It can be understood that, when the abnormal visiting operation identification is performed, since the combined analysis result of the first prohibited behavior flag and the second prohibited behavior flag is taken into account, in the process of respectively determining the abnormal visiting operation detection result of the first intelligent medical user end MED Client1 and the abnormal visiting operation detection result of the second intelligent medical user end MED Client2, the abnormal visiting operation detection result of the first intelligent medical user end MED Client1 and the abnormal visiting operation detection result of the second intelligent medical user end MED Client2 can be mutually identified, so that the reliability of the abnormal visiting operation identification is ensured.

In some embodiments, before the step "performing abnormal diagnosis operation recognition on the diagnosis interaction operation information for the telemedicine service included in the first set of diagnosis interaction operation information for the telemedicine service and the diagnosis interaction operation information for the telemedicine service included in the second set of diagnosis interaction operation information for the telemedicine service based on the operation information collection period during which the first smart medical user terminal collects the first set of diagnosis interaction operation information for the telemedicine service and the operation information collection period during which the second smart medical user terminal collects the second set of diagnosis interaction operation information for the telemedicine service, and obtaining the abnormal diagnosis operation detection result", the method may further include the following steps: acquiring a joint analysis result corresponding to a target smart medical user side, wherein the joint analysis result is used for expressing a joint analysis relation between the first group of the visit interactive operation information, which is collected by the first smart medical user side and is marked with a first forbidden behavior identifier, of the visit interactive operation information for the remote medical service and the second group of the visit interactive operation information, which is collected by the second smart medical user side and is marked with a second forbidden behavior identifier, of the visit interactive operation information for the remote medical service; and performing abnormal diagnosis operation identification on the diagnosis interaction operation information aiming at the remote medical service in the first group of diagnosis interaction operation information aiming at the remote medical service and the diagnosis interaction operation information aiming at the remote medical service in the second group of diagnosis interaction operation information aiming at the remote medical service based on the joint analysis result to obtain an abnormal diagnosis operation detection result.

In the above scheme, the diagnosis interaction operation information marked with the first prohibited behavior identifier, which is included in the first group of diagnosis interaction operation information for the remote medical service and is included in the second group of remote medical service and is targeted at the remote medical service, and the diagnosis interaction operation information marked with the second prohibited behavior identifier, which is included in the second group of remote medical service and is targeted at the remote medical service, are bound to each other, the diagnosis interaction operation information marked with the first prohibited behavior identifier is generated and issued to the target smart medical user side by the first smart medical user side based on the comparison result of the priority ratios of the diagnosis interaction operation information for each remote medical service and included in the first group of diagnosis interaction operation information for the remote medical service, and the diagnosis interaction operation information marked with the second prohibited behavior identifier is the second smart medical user side And generating and issuing a priority comparison result of each piece of treatment interactive operation information aiming at the remote medical service in the acquired second group of treatment interactive operation information aiming at the remote medical service to the target intelligent medical user side.

For example, the target intelligent medical Client is an intelligent medical Client except for the first intelligent medical Client MED Client1 and the second intelligent medical Client MED Client2, and for convenience of description, the target intelligent medical Client may be defined as the target intelligent medical Client MED Client3, or may be understood as a remote visit interactive object corresponding to the target remote visit medical item.

Further, the target intelligent medical subscriber may receive the visit interactive operation information marked with the first prohibited behavior identifier and sent by the first intelligent medical subscriber MED Client1 and the visit interactive operation information marked with the second prohibited behavior identifier and sent by the second intelligent medical subscriber MED Client2, respectively. Generally speaking, the diagnosis interactive operation information marked with the prohibited behavior identifier is transmitted among different intelligent medical user terminals, and the digital medical behaviors of different intelligent medical user terminals can be integrally analyzed based on the joint analytic relationship determined by the diagnosis interactive operation information marked with the prohibited behavior identifier, so that during abnormal diagnosis operation identification, not only the diagnosis interactive operation information aiming at the remote medical service, which is included in the first group of diagnosis interactive operation information aiming at the remote medical service of the first intelligent medical user terminal MED Client1, and the diagnosis interactive operation information aiming at the remote medical service, which is included in the second group of diagnosis interactive operation information aiming at the remote medical service of the second intelligent medical user terminal MED Client1, but also the diagnosis interactive operation information aiming at the remote medical service, which is corresponding to the target intelligent medical user terminal MED Client3, can be considered, thereby ensuring the accuracy and reliability of the abnormal diagnosis operation identification.

In some examples, the visit interactive operation information marked with the first prohibition behavior identification includes visit interactive operation information corresponding to a first remote visit topic, and the visit interactive operation information marked with the second prohibition behavior identification includes visit interactive operation information corresponding to a second remote visit topic. The remote medical treatment theme can be a distinguishing label corresponding to different remote medical treatment service platforms (or corresponding intelligent medical user terminals).

In actual implementation, after the detection result of the abnormal treatment operation is obtained, the abnormal treatment operation can be identified, so that the intelligent medical user side with the abnormal treatment operation is determined, the interactive monitoring and management of the abnormal treatment operation are conveniently carried out subsequently, and normal and safe remote medical service is ensured. Based on this, after the above steps "based on the operation information collection period during which the first group of visit interaction operation information for the remote medical service is collected by the first smart medical user end and the operation information collection period during which the second group of visit interaction operation information for the remote medical service is collected by the second smart medical user end, the visit interaction operation information for the remote medical service included in the first group of visit interaction operation information for the remote medical service and the visit interaction operation information for the remote medical service included in the second group of visit interaction operation information for the remote medical service are identified by the abnormal visit operation, and the abnormal visit operation detection result is obtained", the following steps may be further performed: and transmitting the abnormal diagnosis operation detection result into a target diagnosis operation detection network to obtain a remote diagnosis behavior detection result, wherein the target diagnosis operation detection network is a neural network obtained by training the diagnosis operation detection network to be trained, and the remote diagnosis behavior detection result is used for expressing whether the abnormal diagnosis operation is covered in the abnormal diagnosis operation detection result.

For example, the target visit operation detection network may be a neural network model, such as a model with a classification function, for example, a Support Vector Machine (SVM), Naive Bayes (NB), a Decision Tree (DT), a linear classifier (LR), a K-nearest neighbor (KNN), etc., and the target visit operation detection network may be trained in advance based on a training sample set, tested based on a test set, and then optimized and improved according to a loss function/cost function (such as cross entropy loss), so as to obtain a model capable of satisfying the requirements of the present application. It is to be understood that model training is prior art and will not be described further herein.

Further, after the abnormal diagnosis operation detection result is transmitted to the target diagnosis operation detection network, the target diagnosis operation detection network can perform splitting, feature extraction, classification and identification on the abnormal diagnosis operation detection result based on the related network layer, so as to obtain a remote diagnosis behavior detection result. For example, the remote diagnosis behavior detection result may be { result1-0, result2-0}, { result1-0, result2-1}, { result1-1, result2-0}, or { result1-1, result2-1 }. The result1-0 can be used for representing that the first smart medical user end MED Client1 does not have an abnormal diagnosis operation, that is, the first smart medical user end MED Client1 does not have a remote diagnosis operation related to a prohibited behavior, the result2-0 can be used for representing that the second smart medical user end MED Client1 does not have an abnormal diagnosis operation, that is, the second smart medical user end MED Client1 does not have a remote diagnosis operation related to a prohibited behavior, the result1-0 can be used for representing that the first smart medical user end MED Client1 has an abnormal diagnosis operation, that is, the first smart medical user end MED Client1 has a remote diagnosis operation related to a prohibited behavior, the result2-0 can be used for representing that the second smart medical user end MED Client1 has an abnormal diagnosis operation, and the second smart medical user end MED Client1 has a remote diagnosis operation related to a prohibited behavior.

By the design, whether abnormal treatment operation exists at different intelligent medical user ends can be accurately and reliably determined. It can be understood that, in the actual implementation process, the detection result of the remote medical treatment behavior may further include detection results corresponding to more than 2 intelligent medical user terminals, for example, result _ i-0 indicates that the ith intelligent medical user terminal does not have the remote medical treatment operation related to the prohibited behavior, and result _ i-1 indicates that the ith intelligent medical user terminal has the remote medical treatment operation related to the prohibited behavior. Or, result _ i-N represents that the ith intelligent medical user side does not have the remote treatment operation related to the forbidden behavior, and result _ i-Y represents that the ith intelligent medical user side does not have the remote treatment operation related to the forbidden behavior.

In some alternative and independently implementable embodiments, as shown in fig. 3, the above-mentioned STEP "transmitting the abnormal medical procedure detection result to the target medical procedure detection network to obtain the remote medical procedure detection result" may further include the following STEPs described in STEP310 to STEP 360.

STEP310, obtaining the operation detection item information corresponding to the abnormal diagnosis operation detection result.

In a related embodiment, the operation detection item information includes i operation detection items associated with each other, where i is an integer greater than 1.

And STEP320, acquiring detection disturbance item information according to the operation detection item information.

In a related embodiment, the detected perturbation item information includes i detected perturbation items associated with each other.

STEP330, based on the operation detection item information, acquiring an item key description set corresponding to an operation detection item through a first description mining network included in the target visit operation detection network.

In a related embodiment, the item key description set corresponding to the operation detection item includes multi-modal descriptions corresponding to i operation detection items.

STEP340, based on the detection disturbance item information, acquiring an item key description set corresponding to the detection disturbance item through a second description mining network included in the target visit operation detection network.

In a related embodiment, the item key description set corresponding to the detection disturbance item includes multi-modal descriptions corresponding to i detection disturbance items.

STEP350, based on the item key description set corresponding to the operation detection item and the item key description set corresponding to the detection disturbance item, obtaining the abnormal item classification condition corresponding to the operation detection item information through a differentiation processing unit included in the target visit operation detection network.

In some selective and independently implementable embodiments, based on the item key description set corresponding to the operation detection item and the item key description set corresponding to the detection disturbance item, the differentiation processing unit included in the target visit operation detection network obtains the abnormal item classification condition corresponding to the operation detection item information, which can be implemented by the following two implementation manners.

In a first embodiment, i first visual descriptions are acquired through a first staged description parsing layer included in the target visit operation detection network based on a project key description set corresponding to the operation detection project, where each first visual description corresponds to a multi-modal description corresponding to one operation detection project; acquiring i second visual descriptions through a second phased description analysis layer included in the target visit operation detection network based on the item key description set corresponding to the detection disturbance item, wherein each second visual description corresponds to a multi-modal description corresponding to one detection disturbance item; merging the i first visual descriptions and the i second visual descriptions to obtain i target visual descriptions, wherein each target visual description comprises a first visual description and a second visual description; obtaining a global visual description through a time domain processing network included in the target visit operation detection network based on the i target visual descriptions, wherein the global visual description is determined according to the i target visual descriptions and i time domain feature indexes, and each target visual description corresponds to one time domain feature index; and acquiring the abnormal item classification condition corresponding to the operation detection item information through a differentiation processing unit included in the target visit operation detection network based on the global visual description.

In a second embodiment, based on a project key description set corresponding to the operation detection project, i first visual descriptions are acquired through a first airspace processing network included in the target visit operation detection network, wherein each first visual description corresponds to a multi-modal description corresponding to one operation detection project; acquiring i second visual descriptions through a second spatial domain processing network included in the target visit operation detection network based on the project key description set corresponding to the detection disturbance project, wherein each second visual description corresponds to a multi-modal description corresponding to one detection disturbance project; merging the i first visual descriptions and the i second visual descriptions to obtain i target visual descriptions, wherein each target visual description comprises a first visual description and a second visual description; and acquiring the abnormal item classification condition corresponding to the operation detection item information through the differentiation processing unit included in the target treatment operation detection network based on the i target visual descriptions.

STEP360, determining the abnormal behavior detection result of the operation detection item information according to the abnormal item classification condition.

By such design, the abnormal behavior detection result can be accurately obtained based on the STEPs STEP310 to STEP360, so that the reliability of the abnormal behavior detection result is ensured.

For the above intelligent medical big data security risk processing method, an exemplary intelligent medical big data security risk processing device is further provided in the embodiments of the present application, and the intelligent medical big data security risk processing device may include the following functional modules: the information acquisition module is used for acquiring the doctor seeing interaction operation information which is respectively corresponding to different intelligent medical user sides and aims at the remote medical service; wherein, the operation limiting indexes respectively corresponding to the different intelligent medical user terminals have differences; and the operation detection module is used for carrying out abnormal diagnosis operation identification on the diagnosis interactive operation information corresponding to the different intelligent medical user sides and aiming at the remote medical service based on the operation information collection time periods of the diagnosis interactive operation information corresponding to the different intelligent medical user sides and aiming at the remote medical service respectively to obtain abnormal diagnosis operation detection results. It is understood that further description of the functional modules may refer to the description of the above method embodiments.

Based on the same inventive concept, there is also provided an intelligent medical big data security risk processing system, as shown in fig. 4, the system may include an intelligent medical server 100 and a plurality of intelligent medical clients MED clients, where the intelligent medical server 100 is configured to: acquiring doctor seeing interaction operation information corresponding to different intelligent medical user MED clients respectively and aiming at remote medical services; wherein, the operation limiting indexes respectively corresponding to the different intelligent medical user end MED clients have differences; and based on the operation information collection time periods of the visit interactive operation information for the remote medical service respectively corresponding to the different intelligent medical user end MED clients, carrying out abnormal visit operation identification on the visit interactive operation information for the remote medical service respectively corresponding to the different intelligent medical user end MED clients to obtain abnormal visit operation detection results. For the description of the system, reference may be made to the description of the above method embodiments, which are not repeated herein.

It should be appreciated that the system and its modules shown above may be implemented in a variety of ways. For example, in some embodiments, the system and its modules may be implemented in hardware, software, or a combination of software and hardware. Wherein the hardware portion may be implemented using dedicated logic; the software portions may be stored in a memory for execution by a suitable instruction execution system, such as a microprocessor or specially designed hardware. Those skilled in the art will appreciate that the methods and systems described above may be implemented using computer executable instructions and/or embodied in processor control code, such code being provided, for example, on a carrier medium such as a diskette, CD-or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The system and its modules of the present application may be implemented not only by hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., but also by software executed by various types of processors, for example, or by a combination of the above hardware circuits and software (e.g., firmware).

It is to be noted that different embodiments may produce different advantages, and in different embodiments, any one or combination of the above advantages may be produced, or any other advantages may be obtained.

Having thus described the basic concept, it will be apparent to those skilled in the art that the foregoing detailed disclosure is to be considered merely illustrative and not restrictive of the broad application. Various modifications, improvements and adaptations to the present application may occur to those skilled in the art, although not explicitly described herein. Such modifications, improvements and adaptations are proposed in the present application and thus fall within the spirit and scope of the exemplary embodiments of the present application.

Also, this application uses specific language to describe embodiments of the application. Reference throughout this specification to "one embodiment," "an embodiment," and/or "some embodiments" means that a particular feature, structure, or characteristic described in connection with at least one embodiment of the present application is included in at least one embodiment of the present application. Therefore, it is emphasized and should be appreciated that two or more references to "an embodiment" or "one embodiment" or "an alternative embodiment" in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, some features, structures, or characteristics of one or more embodiments of the present application may be combined as appropriate.

Moreover, those skilled in the art will appreciate that aspects of the present application may be illustrated and described in terms of several patentable species or situations, including any new and useful combination of processes, machines, manufacture, or materials, or any new and useful improvement thereon. Accordingly, various aspects of the present application may be embodied entirely in hardware, entirely in software (including firmware, resident software, micro-code, etc.) or in a combination of hardware and software. The above hardware or software may be referred to as "data block," module, "" engine, "" unit, "" component, "or" system. Furthermore, aspects of the present application may be represented as a computer product, including computer readable program code, embodied in one or more computer readable media.

The computer storage medium may comprise a propagated data signal with the computer program code embodied therewith, for example, on baseband or as part of a carrier wave. The propagated signal may take any of a variety of forms, including electromagnetic, optical, etc., or any suitable combination. A computer storage medium may be any computer-readable medium that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code located on a computer storage medium may be propagated over any suitable medium, including radio, cable, fiber optic cable, RF, or the like, or any combination of the preceding.

Computer program code required for the operation of various portions of the present application may be written in any one or more programming languages, including an object oriented programming language such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C + +, C #, VB.NET, Python, and the like, a conventional programming language such as C, Visual Basic, Fortran 2003, Perl, COBOL 2002, PHP, ABAP, a dynamic programming language such as Python, Ruby, and Groovy, or other programming languages, and the like. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any network format, such as a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet), or in a cloud computing environment, or as a service, such as a software as a service (SaaS).

Additionally, the order in which elements and sequences of the processes described herein are processed, the use of alphanumeric characters, or the use of other designations, is not intended to limit the order of the processes and methods described herein, unless explicitly claimed. While various presently contemplated embodiments of the invention have been discussed in the foregoing disclosure by way of example, it is to be understood that such detail is solely for that purpose and that the appended claims are not limited to the disclosed embodiments, but, on the contrary, are intended to cover all modifications and equivalent arrangements that are within the spirit and scope of the embodiments herein. For example, although the system components described above may be implemented by hardware devices, they may also be implemented by software-only solutions, such as installing the described system on an existing server or mobile device.

Similarly, it should be noted that in the preceding description of embodiments of the application, various features are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure aiding in the understanding of one or more of the embodiments. This method of disclosure, however, is not intended to require more features than are expressly recited in the claims. Indeed, the embodiments may be characterized as having less than all of the features of a single embodiment disclosed above.

Numerals describing the number of components, attributes, etc. are used in some embodiments, it being understood that such numerals used in the description of the embodiments are modified in some instances by the use of the modifier "about", "approximately" or "substantially". Unless otherwise indicated, "about", "approximately" or "substantially" indicates that the numbers allow for adaptive variation. Accordingly, in some embodiments, the numerical parameters used in the specification and claims are approximations that may vary depending upon the desired properties of the individual embodiments. In some embodiments, the numerical parameter should take into account the specified significant digits and employ a general digit preserving approach. Notwithstanding that the numerical ranges and parameters setting forth the broad scope of the range are approximations, in the specific examples, such numerical values are set forth as precisely as possible within the scope of the application.

The entire contents of each patent, patent application publication, and other material cited in this application, such as articles, books, specifications, publications, documents, and the like, are hereby incorporated by reference into this application. Except where the application is filed in a manner inconsistent or contrary to the present disclosure, and except where the claim is filed in its broadest scope (whether present or later appended to the application) as well. It is noted that the descriptions, definitions and/or use of terms in this application shall control if they are inconsistent or contrary to the statements and/or uses of the present application in the material attached to this application.

Finally, it should be understood that the embodiments described herein are merely illustrative of the principles of the embodiments of the present application. Other variations are also possible within the scope of the present application. Thus, by way of example, and not limitation, alternative configurations of the embodiments of the present application can be viewed as being consistent with the teachings of the present application. Accordingly, the embodiments of the present application are not limited to only those embodiments explicitly described and depicted herein.

Claims

1. An intelligent medical big data security risk processing method is applied to an intelligent medical server which is in communication connection with a plurality of intelligent medical user terminals, wherein the plurality of intelligent medical user terminals are in communication connection with each other, and the method comprises the following steps:

acquiring doctor seeing interaction operation information corresponding to different intelligent medical user sides and aiming at remote medical services; wherein, the operation limiting indexes respectively corresponding to the different intelligent medical user terminals have differences;

and based on the operation information collection time periods of the treatment interactive operation information aiming at the remote medical service respectively corresponding to the different intelligent medical user sides, carrying out abnormal treatment operation identification on the treatment interactive operation information aiming at the remote medical service respectively corresponding to the different intelligent medical user sides to obtain an abnormal treatment operation detection result.

2. The method of claim 1,

acquiring doctor seeing interaction operation information corresponding to different intelligent medical user sides and aiming at remote medical services; wherein, there is the difference in the operation restriction index that different wisdom medical customer end corresponds respectively, includes:

acquiring a first group of treatment interaction operation information corresponding to a first smart medical user terminal aiming at the remote medical service and a second group of treatment interaction operation information corresponding to a second smart medical user terminal aiming at the remote medical service, wherein the first group of treatment interaction operation information aiming at the remote medical service is treatment interaction operation information aiming at the remote medical service, which is obtained by the first smart medical user terminal performing a plurality of times of treatment interaction operation information acquisition on a target remote treatment medical item within a preset remote treatment trigger period, and the second group of treatment interaction operation information aiming at the remote medical service is treatment interaction operation information aiming at the remote medical service, which is obtained by the second smart medical user terminal performing a plurality of times of treatment interaction operation information acquisition on the target remote treatment medical item within the preset remote treatment trigger period, the first intelligent medical user side and the second intelligent medical user side have different operation limiting indexes aiming at remote medical services;

based on the operation information collection time periods of the visit interactive operation information for the remote medical service respectively corresponding to the different intelligent medical user sides, the visit interactive operation information for the remote medical service respectively corresponding to the different intelligent medical user sides is subjected to abnormal visit operation identification to obtain abnormal visit operation detection results, including:

based on first wisdom medical user side gathers the first group is to the operation information collection period of the interactive operation information of seeing a doctor of telemedicine service with the second wisdom medical user side gathers the second group is to the interactive operation information of seeing a doctor of telemedicine service collection period, to the interactive operation information of seeing a doctor to telemedicine service that the first group includes to the interactive operation information of seeing a doctor of telemedicine service with the second group is to the interactive operation information of seeing a doctor to telemedicine service that the interactive operation information of seeing a doctor of telemedicine service includes and is carried out unusual operation of seeing a doctor and discernment, obtains unusual operation detection result of seeing a doctor.

3. The method of claim 2, wherein before the abnormal visiting operation detection result is obtained, the method further comprises, during an operation information collecting period based on the first smart medical user terminal collecting the first set of visiting interaction operation information for the telemedical service and an operation information collecting period based on the second smart medical user terminal collecting the second set of visiting interaction operation information for the telemedical service, performing abnormal visiting operation identification on the visiting interaction operation information for the telemedical service included in the first set of visiting interaction operation information for the telemedical service and the visiting interaction operation information for the telemedical service included in the second set of visiting interaction operation information for the telemedical service:

acquiring a first group of diagnosis interaction operation authentication information corresponding to the first intelligent medical user side and a second group of diagnosis interaction operation authentication information corresponding to the second intelligent medical user side;

determining a time period for acquiring each diagnosis interaction operation authentication information included in the first group of diagnosis interaction operation authentication information as an operation information collection time period for the first smart medical user terminal to collect the diagnosis interaction operation information for the remote medical service included in the first group of diagnosis interaction operation information for the remote medical service,

and the number of the first and second groups,

and determining the time period for acquiring each diagnosis interaction operation authentication information included in the second group of diagnosis interaction operation authentication information as an operation information collection time period for the second intelligent medical user side to collect the diagnosis interaction operation information for the remote medical service included in the second group of diagnosis interaction operation information for the remote medical service.

4. The method of claim 3,

determining a time period for acquiring each diagnosis interaction operation authentication information included in the first group of diagnosis interaction operation authentication information as an operation information collection time period for the first smart medical user terminal to collect the diagnosis interaction operation information for the remote medical service included in the first group of diagnosis interaction operation information for the remote medical service, the operation information collection time period including:

determining the time period for acquiring the diagnosis interaction operation information marked with the first prohibited behavior identifier as the time period for acquiring the diagnosis interaction operation information for the remote medical service corresponding to the diagnosis interaction operation information marked with the first prohibited behavior identifier, which is included in the first group of diagnosis interaction operation information for the remote medical service, on the premise that the first group of diagnosis interaction operation authentication information includes the first intelligent medical user side based on the diagnosis interaction operation information marked with the first prohibited behavior identifier, which is generated and issued by acquiring the priority comparison result of each diagnosis interaction operation information for the remote medical service included in the first group of diagnosis interaction operation information for the remote medical service;

determining a time period for acquiring each diagnosis interaction operation authentication information included in the second group of diagnosis interaction operation authentication information as an operation information collection time period for the second smart medical user terminal to collect the diagnosis interaction operation information for the remote medical service included in the second group of diagnosis interaction operation information for the remote medical service, the operation information collection time period including:

the second group of diagnosis interactive operation authentication information comprises that the second intelligent medical user side determines the time period for acquiring the diagnosis interactive operation information marked with the second prohibition behavior mark as the time period for acquiring the diagnosis interactive operation information corresponding to the remote medical service and corresponding to the diagnosis interactive operation information marked with the second prohibition behavior mark, wherein the time period for acquiring the diagnosis interactive operation information marked with the second prohibition behavior mark is included in the second group of diagnosis interactive operation information corresponding to the diagnosis interactive operation information marked with the second prohibition behavior mark.

5. The method of claim 4, wherein the identifying the abnormal medical treatment operation between the first set of the medical treatment interaction operation information for the telemedicine service and the second set of the medical treatment interaction operation information for the telemedicine service based on the operation information collection period during which the first smart medical user terminal collects the first set of the medical treatment interaction operation information for the telemedicine service and the operation information collection period during which the second smart medical user terminal collects the second set of the medical treatment interaction operation information for the telemedicine service comprises:

performing joint analysis on the first prohibited behavior identifier and the second prohibited behavior identifier based on the time period for acquiring the first prohibited behavior identifier and the time period for acquiring the second prohibited behavior identifier, so as to bind the first prohibited behavior identifier and the second prohibited behavior identifier with the minimum quantitative difference of the acquired time periods with each other;

and performing corresponding abnormal diagnosis operation recognition on the diagnosis interaction operation information for the remote medical service, which is included in the first group of diagnosis interaction operation information for the remote medical service and corresponds to the first prohibited behavior identifier, and the diagnosis interaction operation information for the remote medical service, which is included in the second group of diagnosis interaction operation information for the remote medical service and corresponds to the second prohibited behavior identifier, based on the joint analysis result of the first prohibited behavior identifier and the second prohibited behavior identifier.

6. The method of claim 2, wherein before the abnormal visiting operation detection result is obtained, the method further comprises, during an operation information collecting period based on the first smart medical user terminal collecting the first set of visiting interaction operation information for the telemedical service and an operation information collecting period based on the second smart medical user terminal collecting the second set of visiting interaction operation information for the telemedical service, performing abnormal visiting operation identification on the visiting interaction operation information for the telemedical service included in the first set of visiting interaction operation information for the telemedical service and the visiting interaction operation information for the telemedical service included in the second set of visiting interaction operation information for the telemedical service:

acquiring a joint analysis result corresponding to a target smart medical user side, wherein the joint analysis result is used for expressing a joint analysis relation between the first group of the visit interactive operation information, which is collected by the first smart medical user side and is marked with a first forbidden behavior identifier, of the visit interactive operation information for the remote medical service and the second group of the visit interactive operation information, which is collected by the second smart medical user side and is marked with a second forbidden behavior identifier, of the visit interactive operation information for the remote medical service;

the diagnosis interactive operation information marked with the first prohibited behavior identifier, which is included in the first group of diagnosis interactive operation information for the remote medical service and is quantized with the smallest difference in time periods, is bound with the diagnosis interactive operation information marked with the second prohibited behavior identifier, which is included in the second group of remote medical service and is marked with the second prohibited behavior identifier, the diagnosis interactive operation information marked with the first prohibited behavior identifier is generated and issued to the target medical user side by the first intelligent medical user side based on the intelligent result of the priority ratio of the diagnosis interactive operation information for each remote medical service, which is included in the first group of diagnosis interactive operation information for the remote medical service and is acquired by the second intelligent medical user side based on the acquired diagnosis interactive operation information, and the diagnosis interactive operation information marked with the second prohibited behavior identifier is generated and issued to the target medical user side The second group of diagnosis interactive operation information aiming at the remote medical service comprises a priority comparison result of each diagnosis interactive operation information aiming at the remote medical service, and the priority comparison result is generated and sent to the target intelligent medical user side;

and performing abnormal diagnosis operation identification on the diagnosis interaction operation information aiming at the remote medical service in the first group of diagnosis interaction operation information aiming at the remote medical service and the diagnosis interaction operation information aiming at the remote medical service in the second group of diagnosis interaction operation information aiming at the remote medical service based on the joint analysis result to obtain an abnormal diagnosis operation detection result.

7. The method of any one of claims 4 to 6, wherein the visit interaction operation information marked with the first prohibited behavior identifier comprises visit interaction operation information corresponding to a first remote visit theme, and the visit interaction operation information marked with the second prohibited behavior identifier comprises visit interaction operation information corresponding to a second remote visit theme.

8. The method of claim 2, wherein after the abnormal visiting operation identification is performed on the visiting interaction operation information for the telemedicine service included in the first set of visiting interaction operation information for the telemedicine service and the visiting interaction operation information for the telemedicine service included in the second set of visiting interaction operation information for the telemedicine service based on the operation information collection period in which the first set of visiting interaction operation information for the telemedicine service is collected by the first smart medical user terminal and the operation information collection period in which the second set of visiting interaction operation information for the telemedicine service is collected by the second smart medical user terminal, and the abnormal visiting operation detection result is obtained, the method further comprises:

and transmitting the abnormal diagnosis operation detection result into a target diagnosis operation detection network to obtain a remote diagnosis behavior detection result, wherein the target diagnosis operation detection network is a neural network obtained by training the diagnosis operation detection network to be trained, and the remote diagnosis behavior detection result is used for expressing whether the abnormal diagnosis operation is covered in the abnormal diagnosis operation detection result.

9. The method of claim 2, wherein the first smart medical user terminal comprises a digital end device; the second intelligent medical user side comprises a platform medical service terminal; before obtaining a first set of visit interaction operation information for the telemedicine service corresponding to the first smart medical user terminal and a second set of visit interaction operation information for the telemedicine service corresponding to the second smart medical user terminal, the method further comprises:

instructing the digital terminal equipment to perform information analysis on a group of remote medical information contents acquired by the digital terminal equipment to obtain the number of a group of remote medical treatment items in the target remote medical treatment item and corresponding treatment interactive operation information aiming at the remote medical treatment items;

generating a first group of treatment interactive operation information aiming at the remote medical service according to the number of the group of remote treatment items and the corresponding treatment interactive operation information aiming at the remote treatment items;

on the premise that the target intelligent medical user side comprises a platform medical service terminal, instructing the platform medical service terminal to perform service analysis operation on a group of remote medical information contents acquired by the platform medical service terminal to obtain a group of auxiliary remote medical services;

and generating a second group of treatment interactive operation information aiming at the remote medical service according to the group of auxiliary remote medical services.

10. An intelligent medical server, comprising a processor and a memory; the processor is in communication with the memory, the processor reading the computer program from the memory and operating to perform the method of any of claims 1-9.