## 4 Investigation
### Discussion  
In this paper, two density-based classification techniques (DBSCAN and LOF) were employed for the detection of anomalies within EPR data. The techniques are selected with the consideration of factoring in a HIL approach. For that reason, a consideration of the visualisation of the results is also essential for providing legitimate information to the user. For the DBSCAN, the EPS was identified as 2.1 and the experimentation was subsequently conducted under this consideration. Based on the experimentation results, the recommendation is to adopt LOF for the process, due to the use of the weighted score. The addition of the weighted score also has clear benefits for the visualisation of the results, as demonstrated through the clarity of the plots presented in Figure 8, compared with those in Figure 7.  
Furthermore, as validation of the outliers detected, under consultation with the hospital providing the data, the following offers a justification for the benchmark value of 1.2 and clarification of what would be classed as normal/abnormal behaviour within the infrastructure.  
* With regard to the User ID, a user typically spends 300 s (5 min) or less performing an action on a patient. This pattern is reflected in the dataset, where the most active users rarely exceed 400 s. This would relate to the LOF score of 1. However, anomalies, such as 7000 s (almost 2 h), are recorded in the dataset, with user 685 standing out as an anomaly. These values will be recorded as outliers in the LOF process.
* In terms of the Patient ID, the dataset patterns are typically clustered around 1000-s-access patterns (17 min); however, with some notable anomalies, such as the user that accesses a patient ID for 3750 s and some even over 5000 s. As confirmed by the hospital, 1000 s is a typical time block for a patient record to be accessed and would be the LOF score of 1. Most clinic sessions last 15 min, which would confirm this observation. However, unlike with User IDs, there are no clear observations that patient IDs are accessed for longer on different devices than others.
* As confirmed under consultation with the hospital, Device ID access is typically around 400 s, with some users accessing a device for no longer than a few seconds. However, one user does perform a routine on a device for over 1600 s. Additionally, 300 s (5 min) or less is typically spent on a device performing an action on a patient. Similar observations, with varying datapoints, show that it is atypical for a device to be used for longer than approximately 600 s. Some exceptions, such as the data that are accessed for 1700 s. Therefore, 400 s is the initial benchmark for accessing devices in the dataset and would likely produce an LOF score of 1.
* Routine ID demonstrates that 400 s is the typical time spent on a device in the dataset, with some exceptions, such as the routine that is accessed for 1700 s. Due to the routines having extreme anomalies within the dataset (such as 12,000 s), the scale makes observations more challenging to determine for Routine ID. A routine appears to be typically performed in under 1000 s on a patient. Therefore, 1000 s is the initial benchmark for typical routine behaviour in the dataset.