###### Abstract
[9] proposed an attack on the PACS network allowing changes in sensitive 3D imagery files using deep learning. They proposed a GAN (generative adversarial network) model helping to add or remove patterns related to lung cancer when editing 3D CT scans. The authors also mentioned use of digital signatures [10; 11] as the best way to resist such attacks. They also noted that such a feature is implemented in actual PACS systems, but often is not configured in the proper way. Therefore, the supervised domain generic approach [12] is considered more robust in tampering detection. 5. Application of User Behavior Analytics techniques [13] in Security Incident and Event Management systems. These systems contain all the data necessary to construct machine learning models, allowing discovery of patterns of abnormal activity in a dense event log, which often is considered as a big data stream [14; 15; 16; 17]. [PERSON] et al. [18] proposed methods to analyze security events, learn normal and threat patterns, construct event profiles and use common classification methods like Support Vector Machine, Random Forest and Naive Bayes, and proposed artificial neural network models to perform detection of malicious behavior in SIEM environments. The authors obtained accuracy near to 95% with an NSLKDD dataset [19] and 98-99% with a CICIDS2017 dataset [20]. Logical models are also applicable to model user behavior. [PERSON] et al. [21] proposed a model based on nonmonotonic learning allowing performance of revision of user behavior rules. They use Inductive Logic Programming machinery to train the model from examples. Since any software may have vulnerabilities, the problem of authenticity of medical data arises, i.e., whether the file in the DICOM archive is legally added and is not fabricated. All the techniques mentioned above are necessary to ensure security of the data transferred to and stored in the archive. We propose architecture of a versatile and extensible information system designed to work in a SIEM cluster with traffic interception, analytics facilitiesand alert management. The main architectural purpose is to allow integration of present and future state-of-the -art model-driven approaches of the medical data and user behavior validation mentioned in paragraphs 4 and 5 in the above. Since human life is of the highest value, all measures to ensure data security in medical information systems are aimed at ensuring the safety of life and health of patients. A dangerous situation can arise due to the actions of an intruder gaining access to the institution's network by exploiting vulnerabilities in the external perimeter, and/or overly permissive access policies within the local computer network. An attacker can not only spoil or fabricate medical images in the DICOM archive, but also harm the patient and the institution by taking over the MIS user accounts (doctors' credentials are of particular interest) and adjusting the patient's course of treatment at his own discretion. Two measures under consideration will help protect patients and doctors from misdiagnoses and the consequences of inappropriate treatment. (1) Data protection in DICOM archives eliminating influence of damaged or fake medical images on decisions made by the diagnostician. (2) Analysis of user activity making it possible to reveal the extraordinary and dangerous behavior of MIS users associated with destructive interference in the activities of doctors. Protection of a medical institution's network implies both basic perimeter protection using firewalls and access rules implemented in network equipment, as well as the DICOM archive and application server protection components with analysis of user activity, as proposed in this paper. Thus, the protection of technical objects of the infrastructure of a medical institution ensures the protection of the life and health of patients, as well as the professional reputation of specialists in particular, and the institution as a whole.