# An Investigation into Healthcare-Data Patterns
## 3 Investigation Methodology
### Force Directed Visualisation Algorithm
For example, with regards to the domain controller dataset, once the data has been processed for most frequent IP values as in Figure 8, this data can be investigated further. This process would identify and remove superfluous low-risk data connections in order to present further, refined data visualisations. Doing so would present the data without unnecessary noise cluttering the visualisation and leaving only the relevant and potentially malicious data connections highlighted for the situational awareness analysts. For example, with a value count of 225, representing almost 4% of the local address IP values are of a single IP Address open on port 445. This data point therefore, can be isolated in the four separate netstat command datasets to determine which foreign address devices these are connecting to and which processes are running, in order to determine their potential risk. Once this data point is isolated it becomes clear that this local IP Address is connecting to a number of hospital devices with the hospital prefix, and that foreign addresses that were resolving to a device name with a hospital device name prefix, initially suggesting that this could be ignored. The netstat was unable to obtain ownership information of the binary program involved in the creation of the connection on every value of these IP connections using the netstat -b parameter. This is due to netstat not having the necessary administration privileges to call this information. Through the use of the hospital's resource monitor, and checking the active TCP Connections against current processes with network activity, the process running on this port can be determined as the server message block (SMB). The SMB operates as an application-layer network protocol, which is used for providing shared access between nodes on a network, such as access to shared files, printers and serial ports. In May 2017, the WannaCry ransomware campaign exploited an SMB vulnerability on Port 445. The exploit enabled the malware to use worm-like network propagation, encrypting files and demanding ransom payment, unless the system had been patched by Microsoft security bulletin MS17-010. The attack resulted in network downtime for 48 UK hospitals, with 6 suffering disruption lasting several days [7]. ### Algorithm

The pseudocode for the proposed algorithm is presented below in Algorithm 2. The aim of the algorithm is to remove low-risk data points, with the aim of producing medium-high risk data points to be visualised for the benefit of the security analyst. It performs 4 key steps to achieve this, (1) selection control, (2) data pre-processing, (3) data analysis, and (4) visualisation. Figure 8: Domain controller—frequency of local address. The algorithm is also presented visually in Figure 9.

Figure 9: System Design Framework. ### Results

Having isolated the foreign address values not resolving to a hospital device or server name with a known prefix, there were two discernible data points worth investigating further. The first is a connected to a device/server with a notably unusual name. While this may be benign it would still be worthwhile leaving in data points like this in the visualisation system, in order to highlight this unusual data connection to a cyber security analyst and the hospital IT team. A noteworthy factor is a foreign address value, to which the device name cannot be resolved by netstat; it returns an IP Address. So this connection is established to the most frequent IP address value assigned by the domain controller. Yet the device name cannot be resolved by netstat, nor can the program which initiated the connection. Through filtering the data in this way, a prominent data point becomes apparent. The other most common address values present in the domain controller dataset, in Figure 9, have value counts of 153, 79, 62 and 44 respectively. With the exception of a value of count 3, all other local address IP values in the dataset have counts of 2 or fewer.