## 3 Develop Technical Infrastructure and CUREX Tools
#### CUREX Platform Solution  
The CUREX solution analyzes information coming from the monitoring infrastructure to compute cybersecurity and privacy risk scores associated to the data exchange in a health domain. CUREX has five discrete areas: (i) asset and vulnerability discovery, whose goal is to discover the system's assets and any information related to their associated vulnerabilities; (ii) threat intelligence, aiming at detecting real time abnormal behaviors on users, and devices, as well as anomalies in the data in order to identify new and unknown threats; (iii) risk management, aiming at producing risk scores and optimal safeguards towards a cyber-strategy of the healthcare organization; (iv) trust enhancing, which will make use of a decentralized platform based on blockchain technology to store and share private and sensitive data, as described in [17; 18]. Particularly, the interactions between the different tools of CUREX are depicted in Figure 4. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Information Sharing Capacity** & \multicolumn{2}{c}{**POC Medical Devices**} \\  & **and Emulated Devices** & **Smartphone Addressable Information** \\ \hline Implemented 3 sectorizations (VLANs) of the IT infrastructure (managed by the general Firewall). Mounted and configured 8 servers. 3 working stations/PCs. Two hardware medical devices and one software emulator device. HIS mounted and capacity to generate simulated data in several formats (word documents, pdfs, etc.). Smartphone test application and server with access to the use case infrastructure. & \multicolumn{1}{p{113.8 pt}}{} & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Description of the information sharing capacity, POC medical devices and smartphone within the use case developments. An example considering Scenario 3, defined in Section 2, CUREX platform's enumerated actions are defined in the following ordered list below, once the CUREX solution has been deployed in the infrastructure:  
1. ADT scans the infrastructure and identifies the entities and resources that have direct connection with the HIS [18]. A list of assets (including IP addresses, open ports, services and/or operating systems running in each asset) is generated by the ADT and shared accordingly with other CUREX tools. It is worth noting that for this particular scenario, the ADT has discovered that some workstations are running outdated versions of the operating system (OS). 2. Upon reception of the asset list, VDM performs a vulnerability scanning, using as input the list of IP addresses discovered by the ADT. As a result, VDM generates a report containing a list of security vulnerabilities associated to all the hospital's resources (assets) detected in the network's hospital infrastructure [23]. In particular, the VDM report contains a list of critical exploitable vulnerabilities against the outdated OS, and it is initially shared with KEA for further analysis. 3. Upon reception of the vulnerability report, KEA performs a machine learning analysis using the log events generated in the infrastructure in order to detect new threat patterns that could potentially harm the system [24]. New threat patterns are added to the VDM, which enriches the vulnerability report to be shared with other CUREX tools. 4. TIE receives the enriched vulnerability report by the VDM and in parallel, receives logs from events originated in the end-user's infrastructure. In particular, TIE employs anomaly detection and analytics to detect intrusion and malicious activities using a variety of tools and techniques. As a result, TIE is able to generate correlated alarms indicating potential threat incidents detected in the monitored infrastructure. The generated alarms are then shared with other CUREX tools for further processing and analysis. In this example, a URL-attack is detected against one of the resources, which can potentially give uncontemplated access to the HIS database.