# An Investigation into Healthcare-Data Patterns
## 2 Background Research
### Security Challenges  
Security threats within healthcare have farther reaching implications for healthcare than other industries [16]. Due to the increased adoption of trends such as the use of mobile, social and cloud, the ease for hackers to infiltrate the healthcare infrastructure massively increases [16]. The boundaries for healthcare systems are evolving, with many patients having the option of accessing their healthcare data from home PCs and mobile devices which increase the attack surface significantly. Medical data must be private, with data misuse and violation detected in order for to release and share data to authorised parties and public institutions [17]. Medical devices are used for innovative solutions to find a cure, enabling quality of life and improving efficiency in patient care [16]. However, these devices, in particular sensors within the body, have limited resources and therefore inadequate capabilities to self-protect. Traditional approaches to endpoint security are no longer viable in the modern threat landscape [16]. Attack models have changed, from attacks on single PCs, to large-scale attacks on entities through advanced persistent threats. Such attacks involve zero data exploits; spear phishing, watering hole models and encrypted side channel methods to infect systems. In addition to attacking systems, modern malware have adopted and evolved evasion techniques, such as malware packing, obfuscation and polymorphism [16]. Modern malware models in healthcare scenarios become particularly malicious [16]. Techniques, such as ransomware, which restricts access to computer systems and demands a ransom for the restriction to be removed, can be life threatening in healthcare scenarios. Scanning attacks involve adversaries perusing devices within the network to gather meaningful information to launch a sophisticated attack upon an infrastructure [18]. These scans commonly include, IP address scanning, port scanning and version scanning. Health Level 7 (HL7) is an interoperable standard which allows disparate healthcare application store exchange, integrate, share and retrieve clinical and administrative data [18]. With regard to healthcare infrastructures, an adversary can carry out segment scanning on HL7 information to learn personal identifiers, order numbers or patient visit information [18]. Spoofing attacks involve malicious users masquerading as legitimate [18]. Masquerading is a passive spoofing attack where attackers exilarate legitimate account credentials and then log in. Impersonation is an active spoofing attack, sometimes known as a  
Figure 2: Network infrastructure for remote access. replay attack, wherein attackers capture authentication traffic and replay the traffic to gain access to the healthcare infrastructure. Injection attacks involve exploiting vulnerabilities of structured query language (SQL), JavaScript and other computer programs to successfully insert untrusted data [18]. In doing so, attackers may gain access to healthcare databases, attack web users and to propagate viruses. Additionally, they may inject malicious segments commands or responses to reduce the security of healthcare infrastructures. Broken authentication and session management involve attackers exploiting vulnerabilities in authentication mechanisms to assume the identities of legitimate users [18]. A brute force attack is an example that takes advantage of weak passwords and small encryption keys, ultimately allowing a malicious user to perform all the functions available to a legitimate user. Denial of service attacks (DoS) involve exhausting system and network resources to make them unavailable [18]. For example, a flooding-based DoS sends a large number of packets to a web server, in doing so, legitimate requests are blocked as the CPU is overwhelmed. Cyber-threat monitoring systems employ intrusion detection systems (IDSs) as network sensors [19]. IDSs statistically analyse the time of the attack, the source of the attack, the destination of the attack, and can visualise the result.