the work is devoted to the topical issue of building an information system for consolidating knowledge of Chinese image medicine, which would contain comprehensive and objective information of this health-improving direction of folk and complementary medicine. The verbal and descriptive modeling of the consolidated resource was carried out, its functional diagram was built, and the actors and their roles in this resource were graphically visualized. The security threats and respective mitigations have been identified to enhance the information system modeling phaze.
Currently, there is an active integration of conventional (Western, traditional) medicine and
alternative (folk, complementary) medicine in the world, as conventional (Western) medicine is
becoming increasingly dependent on technological solutions that are expensive and not always
effective or have side effects. Instead, integrative medicine supports holism and many simple
methods of prevention and treatment, which are the basis of traditional medicine and are
gaining popularity among patients. Medical tourism is also actively developing in order to find
alternative and complementary medical care; there are attempts to use the latest computer
technologies and artificial intelligence [
0000-0002-6559-0721 (S. Lupenko); 0000-0002-8340-913X (O. Orobchuk); 0000-0002-9542-6279 (I. Kateryniuk); 0000-0003-1323-6448 (R. Kozak); 0000-0001-9187-5758 (H. Lypak)
© 2023 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0).
by 25.1% per year on average from 2023 to 2030 [
For the further development of integrative medicine, it is necessary to ensure access to the
specific knowledge of traditional medicine, the possibility of its research and scientific
interpretation, since most of this knowledge is empirical or in sources accessible to a limited
number of people. This is the state of affairs in alternative and complementary medicine, which
has several thousand years of experience in prevention and healing and is gaining interest
around the world. This task is in line with the WHO strategy [
Modeling an information system for the consolidation of CIM knowledge as a means of preserving the unique knowledge and empirical experience of Chinese image therapists is an urgent and important task for the further popularization and effective functioning of CIM, as well as its digitalization. The full-functional practical implementation of such a consolidated system is a complex technological and organizational task, so at the initial stage we will focus on verbal and descriptive modeling, which will be supplemented by a functional diagram and graphical visualization of the main actors of the system and their roles. Attention will also be paid to the security issues of the future web application, in particular, current threats will be highlighted and countermeasures will be suggested.
Despite the fact that the protection of patients' personal data is of paramount importance in the
healthcare sector, there are almost no protected consolidated resources for non-traditional types
of healthcare. Many researchers have dealt with the use of protected consolidated resources (N.
Borysova, G. Kalytych, M. Bondarenko, M. Middleton, S. Land, B.Greene, R. Rouse,
J.Castagnetto, R. Niedner, D. Sawadogo, R. Champagnat, P. Estraillier, C. McCord and others).
However, they focused only on general approaches or certain aspects of their practical
implementation [
In this study, we will follow the approach outlined in [11]. In the author's interpretation, the process of data consolidation consists in the systematic integration of various types of information resources obtained from many sources, which has the properties of integrity, consistency, completeness and which forms an adequate information model of the subject area. It is this approach that will allow for high-quality analysis, logical and semantic processing, and effective use of this information both in the study of the conceptual apparatus, methods and means of treatment and diagnosis of CIM, and in its development as a scientific component of integrative medicine.
The first steps in this direction have already been taken: for example, the authors analyzed the methods of extracting and electronically recording the diagnostic and therapeutic experience of image therapists; in [12], a computer ontology of CIM based on an axiomaticdeductive strategy for organizing CIM knowledge to solve the problem of their semantic heterogeneity was developed. However, the absence of a unified knowledge base significantly complicates the accumulation, systematization, qualitative analysis of diagnostic and therapeutic information, and, accordingly, in-depth research and construction of a scientific theory of this medical practice. The information system of knowledge consolidation for the subject area of CIM should play the role of a kind of repository containing pre-found, filtered by the criteria and processed information [13], which fully and relevantly reflects the theoretical and practical knowledge of CIM.
Such consolidated information should be presented in a form convenient for the user, at a time determined by him/her, regardless of his/her location, and provide him/her with a holistic picture of the problematic issue with the ability to track its development in dynamics, some immediate solutions to problems and information needs of a particular clientele or social group that may not be able to effectively access and use this knowledge as available in several documents or in another form [14].
It should be noted that it is difficult to consolidate knowledge of Chinese image medicine for a number of objective reasons: territorial dispersion of knowledge; different forms of knowledge storage (a small share in paper form and the lion's share empirical knowledge of image therapists); lack of formalization, heterogeneity, and contradictory knowledge; lack of unification of diagnostic and treatment methods.
Without a single resource, these problems will only get worse, because as the number of image therapists in the world increases, each of them will interpret their cognitive experience in their own way. This will increase contradictions, inconsistencies, and subjectivity in this already difficult to understand and scientifically comprehend area of traditional medicine, and thus will be an obstacle to the formation of the scientific direction of CIM and its integration into integrative medicine.
We believe that the most convenient physical embodiment of the CIM knowledge consolidation system is a web portal that will integrate the found and filtered data from the CIM field and provide a convenient search by specified criteria for this data, followed by the formation of an information product in response to a user's request.
The main components of the consolidated information resource of any industry are a database of information sources of a given subject area and an automated information retrieval system as a means of interaction with it. It is proposed to use the developed CIM ontology [15], as well as digitized materials (articles, research results, descriptions of practical cases of image therapists, etc.) The concept of "consolidated information" covers information resources obtained from several sources and systematically integrated of various types, and the ontology allows them to provide the properties of completeness, integrity, consistency and to create an adequate information model of the problem area for the purpose of its analysis, processing and effective use in decision support processes.
In our study, data consolidation also means the collection of data from geographically distributed or multi-platform data sources into a single data warehouse for the purpose of further processing, analysis, and use in an ontology. It should be borne in mind that this data is often unstructured (it can be data from various documents, reports and web pages), which is inherent in CIM. At the same time, it is possible to restructure and organize this knowledge based on the recommendations and consultations of future users - practicing.
As for remote resources outside the database, they should be presented in digital format and/or equipped with detailed descriptions – metadata created according to the relevant standards. The metadata exchange system will ensure that the database of the CIM knowledge consolidation information system is constantly updated, through which end users will be able to access the necessary information resources through advanced search. Taking into account the specificity of the CIM knowledge data, its empirical nature and the dispersion of the available recorded data, it is necessary to agree on the format of presentation of metadata of these information resources.
Tasks to be solved by the information system of knowledge consolidation of the CIM are the following tasks: comprehensive satisfaction of information needs of a wide range of users regardless of their location; consolidation, structuring, preservation of large volumes of CIM-information reflecting not only in-depth historical knowledge of the industry, but also the current state of scientific research (scientific articles, conference materials, experimental results, etc); criterion-based search for CIM information (e.g., by symptoms, methods of exposure to the body, etc;) ensuring effective exchange of CIM information both between image therapists and interested users (patients, doctors representing other medical fields); ensuring the protection of patients' personal data (in terms of diagnosis) and copyright (in terms of research and experimentation results).
The primary tasks of the preparatory stage in the development of an information system for the consolidation of Chinese traditional medicine knowledge are to establish the process of extracting knowledge from experts and formalizing it; it is also important to unify and internationalize the CIM terminology.
Given the specificity of CIM knowledge data, its empirical nature, and the scattered nature of the available recorded data, it is necessary to harmonize the format for presenting metadata of these information resources.
We will build a functional diagram of the information system for consolidating knowledge of Chinese image medicine using the IDEF0 methodology [16] (Fig. 1).
Block A1 "Consolidation of information in the knowledge base" receives information from various sources. From the Image Therapist subsystem comes diagnostic and therapeutic data that is already ontologically "formatted".
Articles by image therapists, scientific articles, and other documents go through the process of adding tags (block A0) before they are included in the knowledge base [17, 18]. The tags are immediately applied by the automatic tagging module (based on AI), and the expert group later checks and corrects the tags if necessary.
Module A2 provides the user with the resulting information, which depends on the user's role and request. Thus, unauthorized users will be able to view publicly available materials, authorized users will have access to their diagnostic and therapeutic information, image therapists will have access to information about their patients, experimental results, etc.
In order to ensure the efficient use and maintenance of the CIM knowledge consolidation system, it is necessary to identify the main actors and define their roles in the system. Let's show this in a use-case diagram (Fig. 2). The first actor is the "Authorized User", which can be an image therapist who has advanced capabilities of using the resource (for example, adding materials) and an ordinary user who is only granted the right to view information without modifying it. Given the specifics of the subject area, it is advisable to use an authentication system with sets of rights and privileges for each type of actor.
The "Administrator" actor performs most of the functions in the system: it works with content (adding, editing, deleting), with users (granting and editing access rights, changing status), with interface settings, performs SEO optimization, and provides the necessary security parameters. It is granted a set of rights that includes the sets of rights of lower-level actors (image therapist and end-user). A more limited set of rights is granted to the Image-therapist actor (these users have the right to enter diagnostic and therapeutic information), and an even more limited set of rights to the end-user actor (who has the opportunity to expand it by becoming an image-therapist and receiving confirmation of the status upgrade from the administrator).
As a web-application in cloud environments, the information system's security layer for CIM needs to be correctly established and meticulously planned. A variety of information security and cybersecurity risks must be addressed in order to protect the information system for CIM as a whole and each component in particular. Since the knowledge database's processed and collected data is a valuable asset, appropriate security measures must be developed and implemented.
Because the information system for CIM works with personal health data, best security practices consistent with industry standards and laws must be applied by default. One of the most important stages of system modeling, security by design, means that security requirements must be determined so that engineers can create a workable and secure system. Threat modeling serves as a valuable approach to determine security requirements. By utilizing this method, security needs can be identified, threats and vulnerabilities can be discovered, and their impact and severity can be assessed. This enables the prioritization of effective solutions and measures. The application of this method extends to various areas such as software, networks, databases, and APIs.
In the context of the information system for CIM and user personal data, the STRIDE [19, 20] threat modeling methodology has been employed to identify and characterize inherent threats and vulnerabilities. To further analyze the architecture depicted in Figure 2, a general data flow diagram and threat model, as shown in Figure 3, have been developed. The applications and technologies discussed in paper [21] are examined within this framework. For the purpose of this research, all components of the diagram have been thoroughly analyzed to address potential attack surfaces that the information system devices may encounter. The study investigates whether there are any threats and risks to the system components and the data processed within the system, considering its availability via the Internet.
Table 1 provides a comprehensive overview of the threats and countermeasures associated with the information system for CIM. This valuable resource assists software engineers and security experts in designing and enhancing the system's security.
Knowledge Data Base
A malicious actor can take advantage of inappropriate access management which can lead to the data confidentiality and integrity got compromised
Apply appropriate access controls (e.g. RBAC), Encrypt sensitive data at rest, Keep software components updated Information System for
CIM Administrator Administrator
Request / Response for Administrator
Authorized
User User Request / Response for
User E-learning
System
An attacker can exploit the vulnerabilities of program system components, resulting in an attacker’s escalation of privileges or system getting unavailable to authorized user An attacker might attempt to takeover the administrator credentials and access the system, resulting in an attacker will access the system’s data and configurations A malicious actor can intercept traffic sent between the administrator and the information system, which might result in a malicious actor will be able to modify or read the data
Perform security tests and vulnerability scanning to identify and fix vulnerabilities, Apply principles of least privilege, Regularly monitor and analyze the performance and availability of the system, Implement protection DDoS attacks Implement two-factor authentication (2FA), Use secure browsers and strong passwords, User awareness and vigilance against phishing Validate and sanitize user input to prevent injection attacks, Implement data integrity mechanisms,
Encrypt sensitive data in transit An attacker might attempt to capture Implement two-factor the authorized user credentials and authentication (2FA) access the system, resulting in an Use secure browsers and strong attacker will access or change the users’ passwords information User awareness and vigilance
against phishing A threat actor can try to modify or read the data sent between the authorized user and the information system, which might lead to the user request and response data will be modified and/or compromised A poisionous person may install the malicious server and impersonate the elearning system, resulting in the information system will receive incorrect data
Validate and sanitize user input to prevent injection attacks, Implement data integrity mechanisms, Encrypt sensitive data in transit Use strong authentication mechanism, Use antivirus and firewall protection, Use signature and timestamping techniques in the audit records
E-learning Data In / Out Expert System of CIM
Expert Request / Response System of Research in
CIM Research Request / Response
A malicious actor can intercept traffic sent between the e-learning system and the information system, which might result in a malicious actor will be able to modify or read the input/output data An attacker can deploy the malicious server and impersonate the expert system of CIM, resulting in the information system will receive malicious data or code A threat actor can try to change or capture the data sent between the expert system for CIM and the information system, which might lead to the expert request and response data will be modified and/or compromised A malicious actor can install the nasty server and impersonate the system of research in CIM, leading to the information system will receive malicious data or software An attacker may eavesdrop the communication between the system of research in CIM and the information system, which might result in a malicious actor will be able to modify or read the research request and response data
Secure communication protocols, Implement protection mechanisms against DDoS attacks, Implement data integrity mechanisms Use strong authentication mechanism, Use antivirus and firewall protection, Use signature and timestamping techniques in the audit records Secure communication protocols, Implement protection mechanisms against DDoS attacks, Implement data integrity mechanisms Use strong authentication mechanism, Use antivirus and firewall protection, Use signature and timestamping techniques in the audit records Secure communication protocols, Implement protection mechanisms against DDoS attacks, Implement data integrity mechanisms
By adopting this approach, the modeling of the information system ensures the protection of sensitive data and privacy-related information from the growing risk of cyber-attacks targeting IoT-enabled industrial systems. Moreover, it offers traceability in cyber security and privacy audits, enabling organizations to showcase their compliance with applicable regulations.
The modeled information resource will define the real semantics of the CIM sphere, which will allow to present computerized data in a form convenient for human perception; will ensure integration of data and knowledge and their reuse, in particular, will help in the development of more multifunctional and interoperable information systems in the field of CIM. Role distribution of user functions by with the help of a precedent diagram will allow to clearly formulate requirements for to the practical implementation of the CIM web resource.
A proposal has been put forward for the development of a secure-by-design information system. In order to tackle potential vulnerabilities, an analysis of the system components has been conducted through threat modeling, with a focus on identifying and addressing any extended attack surfaces that the system may face. Protecting this web application from attacks is especially important because it processes patient medical data, and this will help prevent leakage of confidential information and unauthorized access. Robust cyber security measures ensure the safety of sensitive data while maintaining patient trust and compliance with regulatory requirements.
A promising direction for further development of such a consolidated resource is its intellectualization with elements of machine learning (the ability to establish a preliminary diagnosis of patients based on the entered symptoms and obtaining advice on treatment with the use of CIM methods), which will be implemented in the expert system of CIM, which is a part of the integrated ontology environment CIM. [8] O. Kymytsia, "Formation of consolidated information resources of architectural organization", 2016. [9] J. Hagberg, K. Hulthén, "Consolidation through resourcing in last-mile logistics", Research in Transportation Business & Management, 45, 100834, 2022. [10] O. Maruhno, N. Kunanets, A. Rzheuskyi, A. Legeza, Sport area information resources consolidation project, ECONTECHMOD: An International Quarterly Journal on Economics of Technology and Modelling Processes, volume7(4), 2018. [11] Zh. Babenko, Preparation of consolidated information as a direction of transformation of library activities, Scientific works of Kamianets-Podilskyi National University named after Ivan Ohienko, volume 5, 2018. [12] S. Lupenko, V. Pasichnyk, N. Kunanets, O. Orobchuk, M. Xu, The Axiomatic-Deductive Strategy of Knowledge Organization in Onto-based e-learning Systems for Chinese Image Medicine, Proc. 1st International Workshop on IDDM, Lviv, volume 2255, 2018. [13] N. Kunanets, V. Dobrovolska, N. Filippova, K. Parviz, H. Lypak, O. Duda, L. Dubrovina, Designing the Repository of Documentary Cultural Heritage, Conf. on Computer Science and Information Technologies, Springer, Cham (2020): 1034-1044. [14] A. Azarova, A. Shiyan, S. Murza, A. Kudlyk, T. Kostyuk, Development of a secured consolidated information resource for the analysis of the market for the provision of services by medical laboratories in Ukraine" Bulletin of KhNU. Technical Sciences, No. 6 (279) (2019): 105-109. [15] S. Lupenko, O. Orobchuk, M. Xu, The Ontology as the Core of Integrated Information Environment of Chinese Image Medicine, Advances in Computer Science for Engineering and Education II, volume 938, 2019. [16] Research Anthology on Recent Trends, Tools, and Implications of Computer Programming,
IGI Global, 2020. [17] Knowledge Base A Complete Guide, The Art of Service - Knowledge Base Publishing, 2020. [18] The Complete Guide To Understand IDEF Diagram. URL: https:// www.edrawmax.com/article/the-complete-guide-to-understand-idef-diagram.html. [19] R. Khan, K. McLaughlin, D. Laverty, S. Sezer. STRIDE-based Threat Modeling for CyberPhysical Systems. In 2017 IEEE PES: Innovative Smart Grid Technologies Conference Europe (ISGT-Europe): Proceedings Institute of Electrical and Electronics Engineers Inc. (2018) 1-6. URL: https://doi.org/10.1109/ISGTEurope.2017.8260283. [20] Lechachenko T., Gancarczyk T., Lobur T., Postoliuk A., Cybersecurity Assessments Based on Combining TODIM Method and STRIDE Model for Learning Management Systems, CEUR Workshop Proceedings, volume 3468, 2023. [21] Lupenko, S., Orobchuk, O., Kateryniuk, I. Development of the Structure of the Ontooriented Database of Information System «Image Therapist». CEUR Workshop ProceedingsThis link is disabled (2023): 261–270.