# An Investigation into Healthcare-Data Patterns
## 2 Background Research
### Data  
In this section, a sample of TPC socket connection data from a real-world hospital is presented. A sample of netstat snapshot data conducted on three servers, the Active Directory Domain Controller, the Electronic Prescribing System and the Patient Administration System is presented. Additionally, for each dataset, the most recurring items for both local and foreign addresses are shown. The hospital has currently 274 servers, a combination of both physical and virtual servers, providing specialist applications and functions across the hospital network. The three servers used for the purpose of this proof-of-concept paper are chosen from two reasons; (1) they are the most active servers on the network, and (2) their potential value to a malicious attacker. For example, if the attacker is able to infiltrate the active directory domain controller, then they have access to an authentication certificate and access to the wider hospital network. By accessing the electronic prescribing system, the attacker has access large quantities of pharmaceutical drugs. Additionally, by accessing the patient administration system, intrinsically valuable and confidential medical data would be reachable. If an attacker were to, instead, attempt to shut down any of these servers through a DDoS attack, it could limit the ability of legitimate medical professionals to provide appropriate patient care and could potentially lead to patient harm.  
The data used for this research is a single snapshot of the domain controller server and comprises of 590 established connections of 5688 total ports. The data is gathered using the netstat command and is further discussed in Section 5.1. In Table 1, a sample of analysed netstat data is shown displaying (i) the connection type, (ii) the IP source connecting to the DC, (iii) the target of the IP address (the DC server), and (iv) the state of the connection. All data presented is anonymised. The data is a single snapshot of the domain controller server and comprises of 590 established connections of 5688 total ports.  
In Table 1 a sample of the netstat data is shown, displaying the connection type, the IP source connecting to the EP, the target of the IP address (the EP server) and the state of the connection. The data is a single snapshot of the domain controller server and comprises 18 established connections of 88 total ports.  
\begin{table}
\begin{tabular}{l l l l l l l l l} \hline \hline  & \multicolumn{3}{c|}{**Active Directory Domain Controller**} & \multicolumn{3}{c}{**Electronic Prescribing System**} \\ \hline Proto & Local address & Foreign address & State & Proto & Local address & Foreign address & State \\ \hline TCP & 0.0.0.*** & 0.0.0.0 & LISTENING & TCP & 0.0.0.0*** & & & & \\ TCP & ***.*** & 16:53 & 0.0.0.0 & LISTENING & TCP & ***.*** & 197:39 & 0.0.0.0 & LISTENING \\ TCP & ***.*** & 16:135 & ***.*** & 148:5317S & ESTABLISHED & TCP & ***.*** & 197:8194 & ***.*** & 133:50176 & ESTABLISHED \\ TCP & ***.*** & 16:135 & ***.*** & 51:63068 & ESTABLISHED & TCP & ***.*** & 197:8194 & ***.*** & 133:50326 & ESTABLISHED \\ TCP & ***.*** & 16:135 & ***.*** & 92:29550 & ESTABLISHED & TCP & ***.*** & 197:8194 & ***.*** & 133:50640 & ESTABLISHED \\ \hline \hline \end{tabular}
\end{table}
Table 1: Transmission control protocol (TCP) socket connections sample data (anonymised).