# An Investigation into Healthcare-Data Patterns
## 3 Investigation Methodology
### Force Directed Visualisation Algorithm
The fundamentals of ForceAtlas2 are intended to be simplistic, nodes repulse and edges attract continuously, while the layout is running and can be manipulated by the user while running. This 'live' spatialisation provides the user with an intuitive understanding of the layout process, whilst allowing the user to employ a trial-error approach in exploring the data. Figure 2(b) displays the algorithm performed on the data using the Yifan Hu Multilevel layout [25]. In this case, the repulsive forces on a node from a cluster of nodes are approximated by a Barnes-Hut calculation [29], which treats them as a super-node. As the graph shows, visualising the raw data provides a challenging insight into security detection. The identification of anomalous behaviour for one device is arduous due to the volume of data present. Additionally, there is no clear differentiation between low-risk data, and medium to high-risk data,which may indicate a potentially malicious device. Therefore, the visualisation of the data without being pre-filtered provides a limited insight into network behaviour; as the data is dense, with no clear indication of anomalous data points to be highlighted for security analysts. Figure 3c,d depict visualisations of data connections for the EP system at the Liverpool hospital. In Figure 3c the data is processed through the Frutcherman-Reingold layout algorithm, which simulates the graph as a system of mass particles [26]. The nodes are mass particles and the edges are springs between the particles. The arrows on the visualisation represent weighted edges, where there are two or more edges between two vertices, with the larger arrows representing more edges. In Figure 3d the algorithm performed on the data is the Yifan Hu Multilevel layout [25]. Figure 3c,d demonstrates that, at a glance, current industry standard visualisation algorithms cannot present the data in a meaningful way without first pre-processing the data. Advanced data analytics techniques would, therefore, allow the data to be filtered in such a way that the resulting visualisations would highlight the potential security risks more clearly in the data [30]. Figure 3e,f presents visualisations of data connections for the PAS system at the Liverpool hospital. Figure 3e displays the PAS data visualised through the 'OpenOrd layout' algorithm, which expects undirected weighted graphs and aims to distinguish clusters of data [28]. It is based on the Frutcherman-Reingold [26] algorithm. In Figure 3f, the Yifan Fu layout algorithm is applied. In Figure 3e,f, even with a much smaller dataset, it is shown the data is still unmanageable. It is unreasonable to expect the user to identify which operators are potentially high-threat, what the data points tell the user about the overall state of the system, and the anomalies within it. In order to demonstrate the interconnectivity of the three datasets, the data is combined into a single dataset and visualised. Figure 4 presents visualisations of data connections for the DC, EP and PAS systems at the Liverpool hospital. In Figure 4a, the data is visualised through the Frutcherman-Reingold layout. In Figure 4b, the OpenOrd layout algorithm is used to visualise the data. In Figure 4c, the Yifan Hu Multilevel layout algorithm is presented. Figure 3: Domain controller data with ForceAtlas2 algorithm (**a**) and Yifan Hu Multilevel layout algorithm (**b**);electronic prescribing data with Frutcherman–Reingold layout algorithm (**c**) and with Yifan Hu Multilevel layout algorithm (**d**); patient administration system data with OpenOrd layout algorithm (**e**) and with Yifan Fu Multilevel layout algorithm (**f**). The visualised data presents snapshots from three servers of the hospital networks, representing only a small section of the hospital network infrastructure. The hospital has currently 274 servers, a combination of both physical and virtual servers, providing specialist applications and functions across the hospital network.