【摘要】 目的 针对智慧医院网络安全合规防护滞后、新型威胁识别能力不足的痛点，构建基于动态威胁建模的医疗网络安全运营体系，为医疗行业网络安全可控运营提供技术支撑。方法 搭建“全域资产感知-智能分析决策-协同响应闭环”三层核心架构，融合主被动采集技术实现医疗全场景资产自动化发现与标签化管理；引入安全检测大模型与思维链推理完成多源安全数据深度融合研判；依托人工智能（AI）智能体、SOAR编排与云地协同机制构建人机协同处置流程，将安全事件平均响应时间（MTTR）压缩至5分钟以内。结果 该体系在某三级甲等医院落地应用后，实现日均告警降噪率99%、告警自动化处置率99%、高危事件闭环率100%，大幅提升了未知威胁的检出与响应效率。结论 该体系实现了医疗网络安全从静态合规向动态防护、单点防御向协同联动的转型，可为智慧医院安全运营提供可复制推广的解决方案。更多还原

【Abstract】 Objective To address the challenges of lagging compliance protection and insufficient capability in identifying emerging threats in smart hospital cybersecurity, this study proposes a healthcare cybersecurity operations framework based on dynamic threat modeling, providing technical support for controllable security operations in the medical industry. Methods A three-layer core architecture—“global asset awareness, intelligent analysis and decision-making, and coordinated response in a closed loop”—was established. By integrating active and passive data collection technologies, automated discovery and labeling management of healthcare assets across all scenarios were achieved. A large security detection model combined with chain-of-thought reasoning was introduced to enable deep fusion and analysis of multisource security data. Furthermore, an AI-agent-driven, SOAR-orchestrated, and cloud-edge collaborative mechanism was employed to build a human-machine collaborative response process, reducing the mean time to respond(MTTR) to within five minutes. Results After deployment in a tertiary hospital, the system achieved a 99% daily alert noise reduction rate, a 99% automated alert handling rate, and a 100% closure rate for high-risk incidents, significantly improving the detection and response efficiency for unknown threats. Conclusion The proposed framework enables the transformation of healthcare cybersecurity from static compliance to dynamic protection, and from isolated defense to coordinated operations, providing a replicable and scalable solution for security operations in smart hospitals.更多还原