# An Investigation into Healthcare-Data Patterns
## 3 Investigation Methodology
### Force Directed Visualisation Algorithm
Figure 7: Domain controller—frequency of local address (**a**) and foreign address (**b**), electronic prescribing—frequency of local address (**c**) and foreign address (**d**), patient administration system—frequency of local address (**e**) and foreign address (**f**). ### Visualisations

Situational awareness of network data enables end users to be able to identify where further cyber security systems need to be put in place. In addition, identifying where best practices and policies can be implemented minimises the risk of a cyber-attack; such as scanning attacks, injection attacks and jamming attacks (as detailed in Section 2, B), on highly confidential personal data. Through removing irrelevant data from the dataset, only pertinent and useful data is analysed. For example, each of the datasets used have more than half of their foreign address data points 'Open', waiting for a connection to be made. When processed, this creates a large amount of unwanted noise in the visualisation which can be removed and potentially replaced with a figure representing the percentage of the dataset whose data points are open. This allows cyber security analysts attention to be focused on the more important, and potentially threatening data points. In addition to running a netstat command [31] using the command-line tool on the servers, a number of additional parameters were included in the command (-nab). These parameters are defined as follows:

* -n--This parameter displays the active TCP connections expressed numerically (in order to quantify the foreign address values for visualisation purposes). * -a--This parameter displays all the active connections and TCP and UDP ports on which the server is listening. * -b--This parameter defines the binary (executable) program name involved in creating the connection or listening port. For each of the three datasets, four separate netstat commands were executed. The four netstat commands were conducted firstly without any parameters, secondly with the parameters -nab, thirdly with the parameters -b, and finally with the parameter -n. The first command returns a dataset which attempts to determine the names of the foreign address's, so that the devices which the servers are connected to are known. The -nab command displays all TCP connections numerically alongside the executable involved in creating the connection. The -b command displays TCP connections with named foreign address values. Finally the -n command produces a clean dataset for visualisation purposes and to compare to the first three command datasets. Advanced data analytics techniques are used to further refine the data, removing the low-threat data from the unique data points above. This allows cyber security analysts to focus their attention on only the data points that are presenting any clear potential of moderate to high level threat, and differentiating between the two at the within top level visualisation. These algorithms filter the initial datasets in order to remove noise from the visualisation in order to present salient points to the analyst. The analyst then explores the visualisation and marks the highlighted data as either safe, or as malicious and pertaining to a certain attack type. Additionally, through the use of information rich packet data captured at regular minute intervals, the visualisation draws from a wider database and highlight commonalities between them. Rather than simply showing clusters of all data, data has been processed and cleaned, so that only clusters with moderate to high level threats are present. As such, the visualisations further enable the situational awareness of network activity, over time, to become clearer. The visualisation clearly highlights any unidentified foreign address IP, regularly connecting to a local address IP or several IP addresses, for further investigation. Comparing the four netstat command datasets, for each server after initially processing the data, enables it to become clearer.