Research Initiation Award: Towards Realizing a Self-Protecting Healthcare Information System for the Internet of Medical Things

研究启动奖为传统黑人学院和大学的教师提供支持，他们正在建立一个研究项目。期望该奖项有助于进一步提高教师的研究能力和效率，改善其所在机构的研究和教学，并使本科生参与研究经验。萨凡纳州立大学获得的奖项在许多领域具有潜在的更广泛和社会影响。该项目旨在开发自主安全管理框架，并应用该框架实现自我保护的医疗信息系统（HIS）。全面的自我保护系统将使医疗机构能够自主评估其潜在的安全风险，启动预防机制，实时检测入侵和应对网络攻击，从而保持正常的性能，增强患者数据的安全性和隐私性。本科生将获得研究经验，研究将被整合到一些网络安全课程中。该研究旨在采用计算技术实现自我保护医疗信息系统（SPHIS），该系统可以在很少或没有人为干预的情况下自主评估系统安全风险，启动预防机制，检测实时入侵并对网络攻击做出反应。最终，SPHIS将维持医疗物联网（IoMT）生态系统的正常运行，并增强患者数据的安全性和隐私性。将建立物联网网络安全实验室和医疗信息系统云测试平台，以利用现实世界的网络攻击验证SPHIS的自主特性和功能。该研究将确定网络攻击，并使用时间序列预测方法初始化预警模块，并根据IoMT设备的功率利用率变化发送攻击警报。因此，当系统处于正常和已知的网络攻击情况下时，IoMT设备的功耗将离线收集。电力数据将通过数据挖掘技术建立IoMT生态系统的正常行为区域，并使用无监督学习技术帮助识别异常行为和检测网络攻击。当HIS受到未知攻击时，IoMT设备的电力数据将被在线收集，并通过网络取证分析工具对电力数据进行分析。攻击模式将被添加，以更新入侵检测模块。开发动态入侵响应系统，选择最优的防御和保护机制来减轻网络攻击。这项研究有望改变目前的HIS网络安全状态，从准备不足转变为防御新出现的网络攻击。这项研究也将有助于网络安全人员的发展，并提高医疗机构的安全意识。

Research Initiation Awards provide support for faculty at Historically Black Colleges and Universities who are building a research program. It is expected that the award helps to further the faculty member's research capability and effectiveness, improves research and teaching at her home institution, and involves undergraduate students in research experiences. The award to Savannah State University has potential broader and societal impact in a number of areas. The project seeks to develop an autonomic security management framework and apply the framework to realize a self-protecting Healthcare Information System (HIS). The comprehensive self-protection system will enable HISs to autonomously assess their potential security risks, initiate prevention mechanisms, detect realtime intrusions and react to cyber attacks, thus maintaining normal performance and enhancing patient data security and privacy. Undergraduate students will gain research experiences and the research will be integrated in a number of cyber security courses.The research seeks to adopt computing technology to realize a Self-Protecting Healthcare Information System (SPHIS) that can autonomously assess system security risks, initiate prevention mechanisms, detect real-time intrusions and react to cyber attacks with little or no human intervention. Eventually the SPHIS will maintain the Internet of Medical Things (IoMT) ecosystem's normal performance and enhance patients' data security and privacy. An Internet of Things cyber security lab and Healthcare Information System cloud testbed will be built to validate the SPHIS autonomous feature and functions using real-world cyber attacks. The research will determine cyber attacks and use time series forecasting methods to initialize early warning modules and send attack alerts based on the variation of power utilization of IoMT devices. Power consumption of IoMT devices thus will be collected offline when the system is under normal and known cyber attack situations. The power data will be used to set up the IoMT ecosystem's normal behavior region by data mining techniques, and help to identify abnormal behaviors and detect cyber attacks using unsupervised learning techniques. The power data of IoMT devices will be collected online when the HIS is compromised by unknown attacks, and the power data will be analyzed by a network of forensics analysis tools. The attack patterns will be added to update the intrusion detection module. A dynamic intrusion response system will be developed to select the optimal prevention and protection mechanisms for mitigating cyber attacks. The research promises to change the current HIS cyber security state from poorly prepared to well defended against emerging cyber attacks. This research will also contribute to development of the cyber security workforce and enhance security awareness in healthcare organizations.