An intrusion detection model for hospital business flow data based on loss-oriented and multimodal active learning

With the popularization of information technology, the level of hospital informatization is constantly improving, but with it comes a variety of security issues. Therefore, intrusion detection system has become an important means to ensure the normal operation of hospitals. First, due to the specificity and complexity of hospital business, the traditional hospital intrusion detection model has poor feature extraction of business flow data, and it is difficult to identify normal and abnormal samples, which leads to low accuracy of the model; then, for the samples that are difficult to be classified by the traditional detection model resulting in false alarms, manual intervention is often required, which is too costly and costly, and the model's dynamic updating capability is poor. To address the above problems, this paper proposes a hospital business flow data intrusion detection model (MAL) based on loss-oriented and multimodal active learning. First, this paper designs a multimodal hospital business flow data feature extraction module based on multimodal heterogeneous convolution and fuses the heterogeneous features to make full use of the complementarity of multimodal information and improve the comprehensiveness and accuracy of the model. Secondly, this paper proposes a loss-oriented adaptive active learning sampling algorithm (L-SADS), which accelerates the learning process by introducing a loss value to guide the sample collection and intelligently selecting the samples that have the greatest contribution to the model enhancement. Finally, this paper designs a multimodal-based active learning module to enhance decision boundary learning while improving annotation efficiency by combining L-SADS with a representative sampling strategy. Experimental results show that the model achieves an accuracy of 0.9871 and 0.9994 on real hospital business flow data and public healthcare system intrusion dataset, respectively.