Medical data safety sharing platform based on inline block chain
Technical Field
The invention relates to the technical field of data security sharing, in particular to a medical data security sharing platform based on an inline block chain.
Background
Medical research and healthcare require the use of large amounts of data, such as patient history, image data, genetic data, etc.; since these data are typically scattered throughout various medical institutions, research institutions, and data warehouses, it is difficult to make efficient use of them; to solve this problem, medical data sharing has been developed; by sharing data, medical researchers and medical care workers can better understand the occurrence and development rules of diseases and develop new diagnosis methods and treatment schemes, so that the accuracy and success rate of diagnosis and treatment of the diseases are improved; medical data sharing also presents some risks that personal sensitive information sharing may lead to privacy leaks, such as medical records, genetic data, etc.; the traditional data sharing platform adopts encryption technology, access control, attack detection and other means to ensure the security and privacy of data, the traditional homomorphic encryption technology requires the platform to have higher hardware performance, the access control can not realize tracing the sharing process, and the intelligent attack detection model still has the problems of low detection precision, low efficiency and the like; therefore, designing a traceable, safe and efficient data sharing platform is a hotspot problem of current research.
Disclosure of Invention
The invention aims to provide a medical data security sharing platform based on an inline blockchain, which can effectively solve the problems.
In order to solve the technical problems, the invention adopts the following technical scheme: an inline blockchain-based medical data secure sharing platform, the platform comprising:
the data interface module is used for connecting local user equipment and is configured with an equipment vulnerability detection function;
the sharing function module is accessed to the detected equipment and executes:
performing risk detection on the data to be shared;
uploading data summary information to an outer layer block chain by a local user;
uploading data information to an inner layer block chain by a local user;
when a request end user initiates a sharing request on the outer layer block chain, the inner layer block chain is linked based on the sharing request to start an automatic sharing task;
and the resource feedback module is used for realizing data sharing transaction records and transaction tracing.
Preferably, when performing the device vulnerability detection function, performing vulnerability detection on the user device by starting an intelligent attack detection model, if a vulnerability is found, initiating an alarm, defining the network device vulnerability attack detection result as N_a, defining the first layer alarm threshold as N, and if the vulnerability is found, determining that the first layer alarm threshold is NAn alarm is initiated.
Preferably, the risk detection is: starting an intelligent attack detection model to detect data to be uploaded, if a risk is found, initiating an alarm, defining the detection result of the data to be uploaded as U_d, defining a second-layer alarm threshold as U, and if the risk is found, determining that the second-layer alarm threshold is UAn alarm is initiated.
Preferably, in the sharing function module, the outer layer blockchain is further used for recording sharing transaction information and sharing result information, and supporting all user accesses on the chain; the inner layer blockchain only supports automation operations.
Preferably, the resource feedback module further has the function of requesting the local data and the data operation result to be uploaded by the request end user, and starts the intelligent attack detection model to realize attack detection on the uploading result.
Further preferably, when attack detection is implemented on the uploading result, an alarm is initiated if a risk is found; each layer of alarm needs to manually confirm whether to release the alarm continuing task and define the detection result of the result data to be uploaded as U_r, define the second layer of alarm threshold as R, if soAn alarm is initiated.
Preferably, the platform further comprises a resource supply pool, wherein the resource supply pool is used for storing the classified attack detection results and for optimally training the intelligent attack detection model.
Preferably, the optimization training of the intelligent attack detection model is specifically as follows:
s1, acquiring a known attack characteristic data set T from a resource supply pool, and copying to form a copy set;
S2, copying the set according to the designed attack characteristic change methodPerforming operation until all features are changed to form variation set +.>;
S3, gathering the variationCombining with the known attack characteristic data set T to form a new attack characteristic set +.>;
S4, carrying out parameter selection on the intelligent attack detection model by adopting an optimization method to obtain an optimal parameter model;
s5, utilizing attack feature setThe optimal parametric model is trained.
Further preferably, the attack characteristic change method is as follows: using copy setsCalculating a Chebyshev distance formula to obtain a distance threshold; copy set->Substituting a distance threshold value into a Chebyshev distance formula to obtain a plurality of groups of unknown attack characteristics, calculating the characteristic variation direction and variation range, and screening the plurality of groups of unknown attack characteristics according to the calculation result to finally obtain a variation set of the unknown attack meeting the requirements>。
Further preferably, the parameter selection is performed by adopting an optimization method, and the obtaining of the optimal parameter model is specifically as follows:
s1, taking the model detection accuracy as an optimization objective function, and taking the corresponding parameter set as an optimal parameter set when the detection rate is highest;
s2, giving a parameter change range, and dividing parameters in a smaller interval;
s3, randomly selecting a group of parameter sets p for model training, and storing the parameter sets p and model accuracyIs an optimal value;
s4, producing a random rotation direction vector i and corresponding step length C (i), wherein the parameter set p is shifted by the step length C (i) in the rotation direction to produce a new parameter set;
S5, calculatingModel accuracy of->Comparison->And->The parameter set with higher storage accuracy is the latest optimal parameter set;
s6, repeating the steps S3-S5 until the accuracy rate is not changed, wherein the current parameter set is the optimal parameter of the model.
The invention has the beneficial effects that: according to the invention, different information uploaded by a local user is classified and transmitted to the outer layer block chain and the inner layer block chain through the sharing function module, and when a request end user initiates a sharing request on the outer layer block chain, an automatic sharing task is started based on the linkage of the sharing request, so that the safety of data sharing and traceability of transactions are ensured, and an alarm function is arranged in the data interface module, the sharing function module and the resource feedback module, so that a three-layer attack alarm architecture is realized, the safety monitoring of the whole data sharing process is realized, meanwhile, the interaction between the user and an alarm system is allowed, the fault tolerance of the system is improved, and further the comprehensive maintenance of the whole data sharing process is realized.
In addition, according to the invention, through the arrangement of the resource attack pool, the intelligent attack detection model can be optimized and trained, so that the performances of model precision, efficiency and the like are greatly improved.
Drawings
The accompanying drawings are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate the invention and together with the embodiments of the invention, serve to explain the invention.
In the drawings:
FIG. 1 is an overall flow chart of the present invention;
FIG. 2 is a schematic diagram of a shared functional module in the present invention;
FIG. 3 is a schematic diagram of an optimization process of the intelligent attack detection model in the invention;
FIG. 4 is a flow chart of a multi-layered alarm system architecture according to the present invention.
Detailed Description
The present invention will be specifically described with reference to examples below in order to make the objects and advantages of the present invention more apparent.
It should be understood that the following text is merely used to describe one embodiment or several specific embodiments of the present invention for secure sharing of medical data based on an inline blockchain, and is not intended to limit the scope of the present invention in any way.
In an embodiment, as shown in fig. 1, a medical data secure sharing platform based on an inline blockchain includes a data interface module, a sharing function module, a resource feedback module and a resource supply pool;
the data interface module is used for connecting local user equipment and is configured with an equipment vulnerability detection function, and vulnerability detection is carried out on the user equipment by starting an intelligent attack detection model, wherein the vulnerability detection of the user equipment is characterized in that a large number of TCP SYN connection requests and UDP data packets in network traffic are generated;
behavior of frequently accessing a particular URL, using an unknown protocol, within the device log; software information in the device;
the security strength of the weak password of the device; whether or not there is an un-patched;
the detected device enters a shared function module, as shown in fig. 2, which is a schematic diagram of the shared function module;
the sharing function module accesses the detected equipment and executes:
firstly, carrying out risk detection on data to be shared;
the detection characteristics of the data to be uploaded by the user are as follows:
the log of the local equipment includes the relevant user login information, access time, IP address and data operation record; whether deviating from the mean, standard deviation, or being in the extreme percentile; whether the data exhibits a distinct peak or long tail distribution; whether certain data points have extremely high or low values is rare or unusual; whether a data point is abnormal in its change from surrounding data points;
then uploading the data abstract information to an outer layer block chain by the local user, wherein the outer layer block chain is used for recording sharing transaction information and sharing result information besides the data abstract information and supporting all users on the chain to access;
uploading data information to an inner layer block chain by a local user, wherein the inner layer block chain only supports automatic operation and does not support access;
when a request end user initiates a sharing request on the outer layer block chain, the inner layer block chain is linked based on the sharing request to start an automatic sharing task, such as transmission, mining, storage and the like;
the resource feedback module is used for realizing data sharing transaction record and transaction tracing, and also has the functions of requesting a user to upload local data and data operation results, and starting an intelligent attack detection model to realize attack detection on the uploading results;
and the resource supply pool is used for storing the classified attack detection results and optimally training the intelligent attack detection model according to the calibrated attack characteristics.
As shown in fig. 3, the optimization process of the intelligent attack detection model is schematically shown, and the optimization training of the intelligent attack detection model is specifically:
s1, acquiring a known attack characteristic data set T from a resource supply pool, and copying to form a copy set;
S2, copying the set according to the designed attack characteristic change methodPerforming operation until all features are changed to form variation set +.>;
S3, gathering the variationCombining with the known attack characteristic data set T to form a new attack characteristic set +.>;
S4, carrying out parameter selection on the intelligent attack detection model by adopting an optimization method to obtain an optimal parameter model;
s5, utilizing attack feature setTraining an optimal parameter model;
the attack characteristic change method comprises the following steps: using copy setsCalculating a Chebyshev distance formula to obtain a distance threshold; copy set->Substituting a distance threshold value into a Chebyshev distance formula to obtain a plurality of groups of unknown attack characteristics, calculating the characteristic variation direction and variation range, and screening the plurality of groups of unknown attack characteristics according to the calculation result to finally obtain a variation set of the unknown attack meeting the requirements>;
For example, assume that an attack is known to be characterized byPost-varietal characteristics are as followsThe chebyshev distance formula is:
wherein a and B are features in sets A and B, +.>Corresponding vector coordinates; next to this, the process is carried out,calculating the minimum distance threshold in set A +.>Maximum distance threshold->,/>Confirm the characteristic expansion range, ++>Determining a characteristic expansion direction; randomly selecting features in set A>Substituting the formula to calculate the corresponding expansion characteristic +.>The method comprises the steps of carrying out a first treatment on the surface of the The calculation process is looped until all known features are expanded.
The optimization method comprises the following steps:
s1, taking the model detection accuracy as an optimization objective function, and taking the corresponding parameter set as an optimal parameter set when the detection rate is highest;
s2, giving a parameter change range, and dividing parameters in a smaller interval;
s3, randomly selecting a group of parameter sets p for model training, and storing the parameter sets p and model accuracyIs an optimal value;
s4, producing a random rotation direction vector i and corresponding step length C (i), wherein the parameter set p is shifted by the step length C (i) in the rotation direction to produce a new parameter set;
S5, calculatingModel accuracy of->Comparison->And->The parameter set with higher storage accuracy is the latest optimal parameter set;
s6, repeating the steps S3-S5 until the accuracy rate is not changed, wherein the current parameter set is the optimal parameter of the model.
In addition, in another embodiment of the secure sharing platform of the present invention, as shown in fig. 4, a flow chart of a multi-layer early warning system architecture is provided, and a three-layer attack alarm architecture is built in the platform, specifically:
the first layer alarm is arranged at the data interface module, the user equipment is accessed to the system, vulnerability detection is carried out on the user equipment, if the vulnerability is found, the alarm is initiated, the network equipment vulnerability attack detection result is defined as N_a, the first layer alarm threshold is defined as N, and if the vulnerability is found, the first layer alarm threshold is defined as NThen an alarm is initiated;
the second layer of alarm is arranged at the shared functional module, the data to be uploaded is detected, if the risk is found, the alarm is initiated, the detection result of the data to be uploaded is defined as U_d, the threshold value of the second layer of alarm is defined as U, and if the risk is found, the second layer of alarm is defined as UAn alarm is initiated.
The third layer of alarm is arranged at the resource feedback module and used for detecting the result to be uploaded, if the risk is found, the alarm is initiated, the result to be uploaded is defined as U_r, the second layer of alarm threshold is defined as R, and if the risk is found, the alarm is initiatedThen an alarm is initiated;
each layer of alarms needs to manually confirm whether to release the alarm continuing task or not by a user, so that the safety monitoring of the whole data sharing process is realized; meanwhile, the user is allowed to interact with the early warning system, and the fault tolerance of the system is improved.
While the embodiments of the present invention have been described in detail with reference to the drawings, the present invention is not limited to the above embodiments, and it will be apparent to those skilled in the art that various equivalent changes and substitutions can be made therein without departing from the principles of the present invention, and such equivalent changes and substitutions should also be considered to be within the scope of the present invention.