## 2 Background
### EPR-Based Investigations
However, healthcare data breaches are increasing exponentially as the technology to manage and construct digital medical records grows. As a mitigation, increasing legislation/regulation levels surrounding privacy and protection are being introduced across Europe and in the US. However, despite this increased recognition of the security challenges for this critical infrastructure network, most healthcare security systems are built on an enclosed domain, with network defence established as a perimeter. The majority of existing solutions, therefore, do not account for the detection of unauthorised access from insider threats, once log-in credentials are misused to access the data. Enhanced security safeguards are paramount for avoiding data leakage, particularly when considering the storage and processing challenges of the vast quantities of EPR data. As such, [PERSON] et al., focused on the technology behind storing EPR data, and in particular, the use of cloud-based technologies [42]. Their work focused on the optimisation of the data management process by adopting an advanced cloud storage scheme. The specific techniques involve outsourcing the reconstruction stage of a shared electronic health record to a cloud computing service provider. Whilst their experimentation was highly theoretical and focused predominantly on the data reconstruction phase of the EPR data, the results demonstrate how EPR-based data are able to leverage cloud-based technologies to optimise the data management processes. However, in this case, security considerations are not paramount in the research. However, the big data processing challenge was also acknowledged by [PERSON] et al. In this case, there was an emphasis on the investigation of a security model for the preservation of privacy within electronic medical record when deployed in a cloud-based environment [43]. Their approach involves using both a decoy technique/honeypot and encryption methodology using the Blowfish Algorithm to provide a two-factor security level. The research also demonstrated the benefits of using EPR data in a telemedicine environment, and a focus was placed on the security considerations to maintain patient privacy. With a similar security-based focus, [PERSON] et al. outlined the use of blockchain and attribute-based signature scheme technologies for the protection of the information inside EPR data. However, their approach differs to the one poised in this paper as the focus is on preserving patient privacy to ensure that both the anonymity and immutability of the information is guaranteed when communicated and accessed. Unlike this technique, our approach focuses on data misuse, anomaly detection and intrusion prevention when inside the defence perimeter. Other researchers adopted the use of blockchain architectures for the secure management of digital health records. For example, [PERSON] et al. discussed the use of a blockchain architecture for tracking the operations performed by actors within the healthcare process [44]. Whilst their proof-of-concept model is novel, the system must be coupled with both a suitable access control system and security framework. This means that it may be subject to some of the restrictions outlined in Section 2.1. The blockchain consideration as a security solution was also investigated by [PERSON] et al., who focused on the need for exchanging data between caregivers [45]. The exchange of data between different healthcare and home-care providers (for individuals with disabilities) is one of the many benefits offered by the EPR data transition. In this exchange, blockchain offers a trusted chain of components within the communication network. The use of blockchain, however, is outside the scope of this research as the focus in this paper is on pattern detection rather than end-to-end secure communication networks. Therefore, given the nature of the security considerations for EPR data-security, the following subsection is dedicated to a case study on the EPR data used in this research and its structure.