## 3 Methodology
### Benchmark Profiling Using LOF  
The defining of benchmark behaviours is required in order to distinguish between what is classed a normal behavioural pattern and those which should be classed as abnormal/unauthorised access. Once initial benchmarking values are set, this would tailor the system to the hospital's unique behavioural trends. This process could, theoretically, be provided by the hospital through consultation. However, to provide a more distributable/accessible approach, it can be calculated as detailed in this section, where the initial benchmark values for each of the ID types are defined by the actual LOF approach with a HIL for confirmation. The advantage of using LOF over other techniques is that LOF is concerned with exposing the anomalous data points. It achieves this by measuring the local deviation. In this way, data points that are a deviation from the norm are revealed [46]. In terms of EPR data, density-based outlier techniques recognise points that are deviations from related others in a single data range. This means that techniques such as LOF are beneficial for use in datasets where there might be many different professions or roles present. LOF, in particular, is advantageous over proximity-based clustering, as it considers the degree of deviance from the norm through analysing the density of one coefficient against its neighbours, whereas, if a global outlier technique is employed, a further correlation of the different hospital roles with each other would be required in order to detect irregular behaviours. The local outlier factor (LOF) calculation process involves five stages (as outlined further in [46]). Stage one concerns the \(k\)-distance computation. This is the calculation of the Euclidian distance of the \(k\)-th nearest object from \(\mathbf{p}\) (an object). Next,  
Figure 4: (**a**) Device, (**b**) Patient, (**c**) Routine, (**d**) User. the \(k\)-nearest neighbour set construction for \(\mathbf{p}\) (Set \(k\)NN(\(\mathbf{p}\))) is constructed by objects within \(k\)-distance from \(\mathbf{p}\). Thirdly, a reachability distance computation for \(\mathbf{p}\) is required; where the reachability distance of \(\mathbf{p}\) to an object \(\mathbf{o}\) in \(k\)NN(\(\mathbf{p}\)) is defined in (2) and d(\(\mathbf{p}\), \(\mathbf{o}\)) is the Euclidian distance of \(\mathbf{p}\) to \(\mathbf{o}\). \[reach-distk(\mathbf{p},\mathbf{o})=max\{k-distance(\mathbf{o}),d(\mathbf{p}, \mathbf{o})\} \tag{2}\]  
The _lrd_ computation for \(\mathbf{p}\) is the local reachability density (_lrd_) of \(\mathbf{p}\), defined in (3). \[lrd_{k}(\mathbf{p})=\frac{k}{\Sigma_{0\in kNN(\mathbf{p})}reach-distk(\mathbf{ p},\mathbf{o})} \tag{3}\]  
The final stage is the LOF computation for \(\mathbf{p}\), where the local outlier factor of \(\mathbf{p}\) is computed as displayed in (4). \[LOF(\mathbf{p})=\frac{\frac{1}{k}\Sigma_{0\in kNN(\mathbf{p})}lrd_{k}(o)}{lrd_ {k}(\mathbf{p})} \tag{4}\]  
However, other solutions could be adopted, for example, DBSCAN. DBSCAN is a cluster analysis method that divides a dataset into \(n\) dimensions and forms an \(n\)-dimensional shape around each datapoint creating data clusters. ```
1. Function: DBSCAN ()
2. Parameters include (Data, EPS, MinPts)
3. IF SetOfPoints is Unclassified
4. ClusterID = nextID(NOISE);
5. Function: SetOfPoints.size()
6. FOR i from 1 to, Point = SetOfPoints(i);
7. IF Point is Unclassified THEN
8. IF ExpandCluster(SetOfPoints, Point, ClusterID, Eps, MinPts) THEN
9. ClusterID = nextID(ClusterID)
10. END FOR
11. Return DBSCAN classification
```  
**Algorithm 2** DBSCAN  
The clusters are then expanded by including other datapoints within the cluster and adding their n dimensions in the cluster. It requires two parameters: (1) \(\epsilon\)--the minimum distance between two points to be considered neighbours and (2) MinPoints--the minimum number of points which form a dense region. Any datapoints that do not fall within a cluster can be handled as an outlier. This process is outlined in Algorithm 2, which shows a high-level DBSCAN pseudocode.