## 4 Conclusions  
The architecture of analytical clusters is used to improve functionality of SIEM environments deployed in hospitals. It is designed specifically to allow integration of validation of medical data itself and user behavior analytics to validate medical specialists' activity. The practical impact of software implementation and deployment improves the security  
Figure 9: Network infrastructure with traffic analysis.  
of sensitive medical imagery. Since there are no requirements for plugins, except of implementation of one common interface which provides ML-model management, there are no additional technical efforts when implementing any model-driven approach for data validation. This allows programmers to extend the system with new analyzers when new effective methods appear.  
Software implementation of the proposed architectural principles can form the basis of a framework designed to collect and analyze medical data for its authenticity, as well as user behavior data for its legality. The availability of such a toolkit will allow researchers working in any of these areas to simplify the tasks of collecting data and conducting experiments when debugging machine learning models.  
The development of fault-tolerant event stores is out of the scope of this article, but is one of the subjects for further research, namely optimizing the Apache Hadoop stack [41] to build an event store ready for big data analysis. The Apache Spark Mllib [42] implementations of the many machine learning algorithms provide a suitable integrated solution for use in analytic plugins. API development, implementation of thin wrappers for such use, as well as analysis and optimization of performance when handling events, is the subject of further work.  
Conceptualization, S.M.; methodology, A.L.; validation, S.M.; formal analysis, S.M.; investigation, A.L. and S.M. writing--original draft preparation, A.L.; writing--review and editing, S.M.; supervision, S.M. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Not applicable.  
The authors declare no conflict of interest.  
**Table A2.**_Cont._  
\begin{tabular}{c c} \hline
**Member Name** & **Member Purpose** \\ \hline getSeriesOfPatient & Return observed series IDs for the patient. \\ \hline releasePatientSeries & Remove the patient's series from the observation list. \\ \hline lookOnPatientSeries & Add a series of a patient to the observation list. \\ \hline observations & Hashmap with patient IDs as keys and lists of series IDs as values. \\ \hline
**Table A3.** Members of SeriesTester class. \\ \hline
**Member Name** & **Member Purpose** \\ \hline testSeries & Returns hashmap with samples IDs as keys and their legality as <boolean, boolean> values. The first boolean in the tuple is period legality, the second boolean in the tuple is content legality. \\ \hline getCheckerForSeries & Get the entry point in the appropriate plugin for specified data series. \\ \hline periodAnalyzer & An instance of PeriodAnalyzer. \\ \hline
**Table A4.** Members of PeriodAnalyzer class. \\ \hline
**Member Name** & **Member Purpose** \\ \hline setEthalonPeriod & Sets the value of the period to check conformance of the time series with it. \\ \hline getSuspiciousFiles & Returns hashmap with samples IDs as keys and their legality as boolean values. \\ \hline \end{tabular}  
**Table A5.** Methods of ILegalityChecker interface. \\ \hline
**Method Name** & **Method Purpose** \\ \hline trainModel & Train ML model for specified series with specified data interval for training. \\ \hline testSeries & Returns hashmap with samples IDs as keys and their legality as boolean values. \\ \hline \end{tabular}  
**Table A6.** The number of samples that are used in the training set is \(100\). \(100\).