###### Abstract  
The problem of consistency of medical data in Hospital Data Management Systems is considered in the context of correctness of medical images stored in a PACS (Picture Archiving and Communication System) and legality of actions authorized users perform when accessing MIS (Medical Information System) facilities via web interfaces. The purpose of the study is to develop a SIEM-like (Security Information and Event Management) architecture for offline analysis of DICOM (Digital Imaging and Communications in Medicine) archive integrity and users' activity. To achieve amenable accuracy when validating DICOM archive integrity, two aspects are taken into account: correctness of periodicity of the incoming data stream and correctness of the image data (time series) itself for the considered modality. Validation of users' activity assumes application of model-driven approaches using state-of-the-art machine learning methods. This paper proposes a network architecture with guard clusters to protect sensitive components like the DICOM archive and application server of the MIS. New server roles were designed to perform traffic interception, data analysis and alert management without reconfiguration of production software components. The cluster architecture allows the analysis of incoming big data streams with high availability, providing horizontal scalability and fault tolerance. To minimize possible harm from spurious DICOM files the approach should be considered as an addition to other securing techniques like watermarking, encrypting and testing data conformance with a standard. DICOM archive; data validation; user behavior analytics; distributed systems; network traffic interception +
Footnote †: journal: Medical Data Management Systems  
Definition). An idea to propose a formal language to express IODs is not new [2]. Modern software like dcm4 che [3] supports this validation. 2. Watermarking medical images. The method proposed in [4], based on a reversible watermarking technique, provides authentication and self-correction by dividing an image into two regions: Region of Interest (ROI) and Region of Noninterest (RONI). Then, the ROI is embedded into the RONI so that any change of the image may be detected and can be self-restored back to the original image by extracting the ROI from the RONI. The work [5] proposes a security technique with patient authentication support, information confidentiality and integrity based on reversible watermarks. To provide integrity checking an MD5 (Message Digest 5) hash of the image is computed. Reversibility is achieved with compressed an R-S-Vector determined from the image (consists of bits indicating regular (1) or singular (0) state of a group of pixels). A watermark providing confidentiality and authentication services is constructed by aggregating the compressed R-S-Vector, the hash value and the patient ID. It is encrypted with AES (Advanced Encryption Standard) and embedded into medical images. 3. Encryption of DICOM files. The work in [6] proposes the following algorithm for providing confidentiality, integrity and authenticity of the header and pixel data of DICOM images: an encryption and signature creation procedure, and a decryption and signature verification procedure. [PERSON] and [PERSON] [7] developed a framework proposing two different approaches to ensure cloud data security: the Extensible Authentication Protocol for authentication, and the Rijndael Encryption Algorithm used to encrypt sensitive data. [PERSON] et al. [8] proposed a framework to secure transfer and storage of medical images on the cloud by using hybrid (a combination of symmetric and asymmetric encryption algorithms. Their scheme consists of separate stages of hashing the DICOM header with SHA-3 (Secure Hash Algorithm 3) and encrypting pixel data with the result of the previous stage using an XTEA (eXtended Tiny Encryption Algorithm) algorithm. 4. Application of artificial intelligence (AI) machinery to detect malicious tampering of medical data. [PERSON] et al.