XR-PRISM：面向医疗领域扩展现实的数据驱动型隐私与风险影响评分指标
XR-PRISM: Data-Driven Privacy and Risk Impact Scoring Metric for Extended Reality in Healthcare
浏览论文内容
中文总结 AI 辅助
该研究针对医疗XR领域缺乏统一风险评估框架的问题，提出XR-PRISM评分指标，基于65篇文献构建四层威胁分类，发现多数对策缺乏标准化评估，该指标可透明量化医疗XR的安全隐私风险。
中文摘要 AI 辅助
扩展现实（XR）技术正通过沉浸式培训、远程会诊及患者康复等应用变革医疗领域，但其强大的感知能力与复杂的数据管道带来了独特的安全、隐私及安全风险。现有研究缺乏用于评估和优先处理这些风险的统一量化框架。我们回顾了2017至2024年间发表的65篇关于XR安全与隐私的同行评审研究，综合形成了由设备、网络、用户及云层构成的四层威胁分类法，以及对应的防御措施目录。基于此分析，我们提出了XR-PRISM，这是一个包含六个因素的加权隐私与风险影响评分指标，将威胁可能性、系统漏洞、攻击面、安全影响、隐私影响及控制有效性整合为单一可操作的风险评分。我们的分析显示，超过70%的已识别对策缺乏标准化风险评估，而记录在案的攻击中仅有不到15%需要高水平专业知识才能执行。XR-PRISM为研究人员和从业者提供了一种透明、数据驱动的方法，用于在医疗XR部署中比较、优先处理及缓解安全与隐私风险。
英文摘要
Extended Reality (XR) technologies are transforming healthcare through immersive training, remote consultation, and patient rehabilitation. However, their extensive sensing capabilities and complex data pipelines introduce distinct security, privacy, and safety risks. Existing research lacks a unified quantitative framework for assessing and prioritizing these risks. We review 65 peer-reviewed studies on XR security and privacy published from 2017 to 2024, synthesizing a four-layer threat taxonomy consisting of Device, Network, User, and Cloud layers, along with a corresponding catalog of defenses. Building on this analysis, we introduce XR-PRISM, a six-factor weighted Privacy and Risk Impact Scoring Metric that integrates threat likelihood, system vulnerability, attack surface, safety impact, privacy impact, and control effectiveness into a single actionable risk score. Our analysis shows that more than 70% of the identified countermeasures lack standardized risk evaluation, while fewer than 15% of the documented attacks require a high level of expertise to execute. XR-PRISM provides researchers and practitioners with a transparent, data-driven method for comparing, prioritizing, and mitigating security and privacy risks in healthcare XR deployments.
