# An Investigation into Healthcare-Data Patterns
## 3 Investigation Methodology
### Force Directed Visualisation Algorithm
Similarly, open port values such as 0.0.0.0:0 and [::]0 are available indicating that the electronic prescribing had approximately 21.5% of its ports connected. This indicates both the electronic prescribing and domain controller, in that at any given time, most ports are open and waiting for a connection. Figure 5: Logarithmic heatmap comparing frequency of local address and foreign address counts in the domain controller (**a**), electronic prescribing (**b**) and patient administration system (**c**) servers. logarithmic heatmap comparing IP addresses (converted to integer values) of domain controller (**d**), electronic prescribing (**e**) and patient administration system (**f**) servers. Figure 6e,f presents the most frequent items of the local and foreign address values in the patient administration system dataset. Displayed in Figure 6e the most frequent items for local addresses' on the patient administration are shown. Uniquely here, the output is largely comprised of a single port, accounting for almost 37% of the total local address connections. This number then quickly decreases and the majority of the IP addresses are unique values much like the electronic prescribing dataset. Figure 6f shows the most frequent value is that of the 0.0.0.0.0 port, the [::]0 port and the asterix due to the port not having been established indicating that at this time the patient administration system had approximately 54.5% of its ports connected. Again, similarly to the domain controller and electronic prescribing datasets, the values for the foreign address have more than half the ports open. This indicates that each server has a large number of open ports, waiting for a connection to a device. ### Sankey Diagrams

Figure 7 shows a Sankey Diagram for the data. The IP address on the left hand side (source) and the count of connections on the right hind side (destination). The size of each link created is correlated to the frequency of connection of each IP address to the server. Thus, the bigger the number of connections the wider the link stablished in the Sankey is. Table 2 outlines the sankey diagram counts for each dataset. \begin{table}
\begin{tabular}{l c c c c c c c c} \hline \hline
**IP Address** & \multicolumn{8}{c}{**Sankey Diagram Counts**} \\ \hline
**Domain Controller local** & 5040 & 31 & 24 & 4 & 3 & 2 & 1 \\
**Domain Controller foreign** & 225 & 153 & 79 & 62 & 44 & 3 & 2 & 1 \\
**Electronic Patients and Medicines Administration local** & 33 & 22 & 13 & 1 & & & & \\
**Electronic Patients and Medicines Administration foreign** & 6 & 2 & 1 & & & & & \\
**Patient Administration System local** & 32 & 24 & 23 & 14 & 2 & 1 & & \\
**Patient Administration System foreign** & 64 & 2 & 1 & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Sankey diagram counts. Figure 6: Domain controller—frequency of local address (**a**) and foreign address (**b**), electronic prescribing—frequency of local address (**c**) and foreign address (**d**), patient administration system—frequency of local address (**e**) and foreign address (**f**). In the following section, a discussion of the various techniques is presented, and a proposed algorithm for visualising the data is articulated in pseudocode. Finally, results are presented and discussed. ## 5 Discussion and Proposed Algorithm

The visualisations cluster together salient points and use size to indicate potential threat levels. This gives the analyst a broad overview of the current network security at a glance. From here, the visualisation can be interacted with, explored by the analyst to investigate the data points and find in-depth technical information about each data point. The contribution of this paper is the application of the visualisation techniques to hospital network data, and the unique algorithm proposed in Section 5.2.