# An Investigation into Healthcare-Data Patterns
## 2 Background Research
### Security Challenges
Visualisations are used in order to leverage the perceptual abilities of the user, in order to find features in network structures and data. To process datasets, visualisation algorithms are employed to understand stand-out behaviours. Security is crucial to the long-term viability of networked medical devices [15]. These medical devices have the potential to be tampered with, reprogrammed by unauthorised users or subject to device-specific hazards. Devices can be targeted through their firmware upgrades or through connections to the network interface when connected through remote attacks in addition to local attacks. For example, telemetry data of an implantable cardiac defibrillator can be read and reprogrammed remotely [15]. There are obvious physical hazards and privacy implications for these attacks. Security concerns for implanted medical devices (IMDs) are particularly challenging due to the potential for patient injury or death due to adversarial tampering [20]. Additionally, high-profile medical device malfunctioning could cause loss of life due to network compromise or medical device tampering. To detect abnormal data behaviours, visualisation techniques can be used to provide both awareness and modelling capabilities for the benefit of computing in critical infrastructures [11]. Data analytics enables meaningful inferences to be extracted from raw data, and facilitates cost savings and faster decision support [21]. Visualisation techniques allow an analyst to visualise abnormalities in a dataset due to the shape or colour of data patterns, and to do so quickly and efficiently [22]. The challenges facing healthcare security are as follows, a lack of labelled data from previous attacks; constantly evolving attacks and analyst's limited investigative time and budget [23]. Current solutions employ either analyst driven solutions, or unsupervised machine learning solutions. Both of these solutions are not sufficient on their own. Analyst driven solutions often lead to a high number of false negatives, due to their reliance on human judgement, besides delays between attack detection and the implementation of countermeasures [23]. Similarly, unsupervised machine learning solutions are insufficient due to their high number of false positive alarms, which lead to alarm fatigue and distrust by analysts [23]. The data used in this paper is real-world network data from a Liverpool-based hospital network employing over 4000 staff. The data collected is a snapshot of the network infrastructure using the network statistics (netstat) command-line in order to capture incoming and outgoing transmission control protocol (TCP) data. TCP data was captured as it allows for two hosts to establish a connection and exchange data streams. This TCP data was captured using the netstat command with the command line utility. This was done for ease of use and data simplicity to demonstrate the proof-of-concept. In future work, the intention is to use information rich data packets, captured using a packet sniffing network monitoring tool. As the investigation shows, the volume and type of data within healthcare infrastructures presents a significant challenge for security analytics. AI\({}^{2}\) is a cyber-security machine learning system, which improves its accuracy over time through feedback from security analysts [23]. AI\({}^{2}\) consists of the following four components. Firstly, a big data processing system, which quantifies the behaviours and features of raw data [23]. Secondly, an outlier detection system, which learns a descriptive model of data features extracted via unsupervised learning, using either density, matrix decomposition or replicator neural networks [23]. Thirdly, a feedback mechanism and continuous learning, which incorporate analyst input through a user interface [23]. The system highlights the top \(k\) outlier events or entities and tasks the analyst with identifying whether they are malicious; the feedback is then input back into the supervised learning module.