# An Investigation into Healthcare-Data Patterns
## 3 Investigation Methodology
### Force Directed Visualisation Algorithm
Of these, there are 5 domain controller servers, 4 patient administration system servers and 2 electronic prescribing servers. With the ultimate aim of the process to capture snapshots at regular intervals on all the hospital servers the visualised data demonstrates that this is problematic due to the sheer quantity of data. Once the data has been visualised, interactions between the user and the visualisation itself are a challenge. For this reason, captured network data needs to be pre-filtered in order to simplify the visualisation and the visualisation process. ### Heatmaps

In Figure 5, several heatmaps are presented, comparing frequency of local address and foreign address counts in the datasets. Additionally, in Figure 5, a comparison of IP addresses (converted to integer values) are presented. Calculating the integer value of an IP address is calculated by breaking the address into 4 octets and using the following equation:

\[\left(firstoctet*256^{3}\right)+\left(secondoctet*256^{2}\right)+\left(thirdoctet *256\right)+\left(fourthoctet\right) \tag{7}\]

Representing the data as a logarithmic heat-map is an approach for identifying data points of interest. Using a logarithmic scale, lower-scale values are not compressed down into the congested section of the graph where the unique values would be challenging to identify. However, the density of the dataset prohibits valuable insights from being derived. Producing a real-time heatmap would be inefficient, as frequencies would need to be calculated in real time. IP addresses would also need to be converted into integers in real time, and this is a computationally intensive process. Additionally, as many of the IP values are within the same range, as they are communicating locally within the hospital. In comparison to Figure 4, individual data points cannot be visualised separately, as they all fall on the same point on the heatmap, with only colour range to represent density. This approach is inefficient for visualising hospital network data. Figure 4: Full dataset with Frutcherman–Reingold algorithm (**a**), OpenOrd layout algorithm (**b**) and Yifan Hu Multilevel layout algorithm (**c**). ### Boxplots

Figure 6 presents histograms of the most frequent items of local and foreign address values in the domain controller dataset. Displayed in Figure 6a the frequency for local addresses' on the domain controller is shown. The output is varied, where the most significant IP address item counts comprise around 4% of the local IP address ports. Of the IP addresses, 89.84% in the dataset are unique values. In Figure 6b, the common most value is that of an asterisk due to the port not having been established indicating that at this time the domain controller had approximately 11.4% of its ports connected is presented. These ports are comprised of unique values displaying the port number of the remote computer to which the socket is connected. In the case of this dataset, all port numbers begin with the IP ranges used within the hospital, which indicates that all devices connected to the domain controller are devices on site and hospital network. Figure 6c,d presents the most frequent items of local and foreign address values in the electronic prescribing dataset. Displayed in Figure 6c the most frequent items for local addresses' on the electronic prescribing is shown. The output is varied with the largest IP address item counts comprise around 7% of the local IP address ports. There are 3 sets of two value counts, with the rest being unique values; however, the electronic prescribing dataset is the smallest of the three datasets. Figure 6d depicts the most frequent value is that of an asterisk due to the port not having been established. There are comparable data patterns between the data trends in foreign address frequencies for the electronic prescribing data in Figure 6d and for the domain controller displayed in Figure 3b.