## 2 Materials and Methods
### New Server Roles to Ensure Medical Data Consistency
#### 2.2.3 Place of Server Roles in Network Infrastructure  
Figure 9 illustrates the place of network analyzers (clusters) in a typical hospital network infrastructure.  
Figure 6: Component diagram of the subsystem for analysis of users’ behavior.  
New server roles TCP Interceptor Frontend, Legality Analysis Backend, together with the existing DICOM Archive and DICOM Archive Database, form a PACS cluster for which it is advisable to allocate a separate VLAN1 (Virtual Local Area Network). Traffic that was previously directed to the DICOM Archive must be directed to the TCP Interceptor Frontend. After passing through the Legality Analysis Backend, it is directed to the DICOM Archive automatically: this is the default behavior. The latter aspect is regulated by a separate option to allow alternative analytic cluster deployment. Traffic directed directly to the DICOM Archive can be duplicated on the TCP Interceptor Frontend using port mirroring on the managed switch. In this case, routing packets from the Legality Analysis Backend to the DICOM Archive would be redundant and should, therefore, be disabled.  
New server roles HTTP Interceptor Frontend, Behavior Analysis Backend and Journal Backend, together with the existing Web Server, form a Workplaces Servers Cluster, for which it is advisable to allocate a separate VLAN2. Traffic that was previously directed to the Web Server must be directed to the HTTP Interceptor Frontend. After passing through the Behavior Analysis Backend, it is directed to the Web Server automatically: this is the default behavior. The latter aspect is regulated by a separate option to allow an alternative analytic cluster deployment. Traffic directed directly to the Web Server can be duplicated to the HTTP Interceptor Frontend using port mirroring on the managed switch. In this case, routing packets from the Behavior Analysis Backend to the Web Server would be redundant and should, therefore, be disabled.  
Traffic routing rules, including between VLNs, should be developed taking into account the specifics of the location of specialists' workplaces, and should not be overly permissive in order to reduce the network attack surface.  
The DICOM archive, application servers, and the proposed components of their protection, form a centralized system intended for deployment within the local computer network of a medical institution. The databases required for the functioning of the protected components (DICOM Archive Database and other databases of the MIS application servers), as well as the user activity log (Journal Backend), cannot be moved outside the LAN perimeter, since they require connections with low time delays. They contain all the medical data that comes to the institution and are generated within it, being the subject of interest of this work. The system has decentralized analytical cluster subsystems to provide horizontal scalability and improve fault tolerance.  
Figure 7: Deployment diagram of the subsystem for analysis of users’ behavior.  
The initial start-up of system functions requires the participation of a medical specialist. The patient's medical data in the DICOM archive, as well as MIS user activity data, are only analyzed if tracking is enabled for the respective patient or user and the associated machine learning models are trained with an appropriate sample specified by a specialist with a time interval. After this, the system's behavior boils down to continuous automatic analysis of incoming big data streams and issuing warnings in case of detection of unwanted activities, e.g., suspicious DICOM files or dangerous user actions.  
Figure 8: Analysis of user activity.