## 2 Materials and Methods
### New Server Roles to Ensure Medical Data Consistency
#### 2.2.2 Validation of User Behavior  
The network analyzer (cluster) is designed to intercept HTTP (Hypertext Transfer Protocol) traffic and autonomously analyze incoming events generated by specialists interacting with the interfaces of the medical information system. Examples of interfaces are a radiologist's personal account, an ECG specialist's personal account and an anesthesiologist's personal account. Low-level software components rely on mitmproxy (man-in-the-middle proxy) [32] functionality to capture traffic destined for the MIS web server. All Linux functions are labeled as a LinuxKernel component in the presented UML diagrams for simplicity. The class diagram in Figure 5 illustrates the anatomy of the user behavior analysis components. All the methods are documented in Tables A6-A10. The purpose of the classes on the diagram is:  
1. HTTPInterceptor class is designed to parse HTTP packets, run content inspection and generate alerts in case of detection of dangerous user actions. This is the main class that interacts with mitmproxy. 2. UserActivityJournal class is designed to manage user activity log and provide data to analytic components. 3. IUserActivityJournal is an interface for working with the user activity log. 4. AuthenticityCheckingProvider class is designed to manage configuration and provide compliance checking functionality for the User Behavior Analysis Component (HTTPAnalyzer). User activity data is only analyzed if tracking is enabled for the respective user (trackUser method). In this case, the associated machine learning models must be initialized with a training sample of regular legal data specified by a time interval (retrainUserAuthModel method). 5. UserActivityTester class loads and uses various plugins to authenticate user activity to various medical professionals. 6. IAuthenticityModel is a common interface that every behavior validation plugin for any medical specialization must implement to provide functionality for initialization and utilization of machine learning model intended for data legality checking (trainModel, refineModel and testSeries methods). 7. MRSpecialistModel, CTSpecialistModel, AnesthetistModel are MR, CT (Computed tomography imaging), anesthesiologist specialist behavior validator plugins that implement the IAuthenticityModel interface, respectively. All classes, except for the behavior testing classes for various medical specializations (MRSpecialistModel, CTSpecialistModel, AnesthetistModel), are implemented in the HTTPAnalyzer component. Behavior validation classes for different medical specializations are implemented in separate components. The component diagram in Figure 6 illustrates the relationship between the components in the system and other software with which it interacts. For example, an application server that provides the functionality of the interfaces of specialists' personal accounts. The source of events for the latter is various client devices of specialists with a web browser. The activity of the attacker's software can also affect the state of the application server; it is denoted on the component diagram as AttackerHTTPClient, which also uses the web server like specialists' browsers. Figure 4: Analysis of incoming Digital Imaging and Communications in Medicine (DICOM) files. HTTPAnalyzer, MRSpecialistValidator, CTSpecalistValidator, AnesthetistValidator (and other user behavior validation components for various medical specializations) are packaged as separate artifacts (with corresponding names, Figure 7). They should all be deployed to the BehaviorAnalysisBackend node. These nodes should be clustered for high availability. Inbound traffic destined for the application server is intercepted at the HTTPInterceptorFrontend node and routed to BehaviorAnalysisBackend nodes for analysis with round-robin balancing. User activity log functionality can be provided by the rsyslog component, which is deployed to a separate JournalBackend node.