Trichocera maculipennis have been recently observed in the Admiralty Bay area on King George Island, South Shetlands Islands, West Antarctica, 10 years after its first record in Maritime Antarctica . Its rapid spread across the island, despite geographic barriers such as glaciers, indicates successful adaptation to local environmental conditions and suggests this species is invasive. The mode of life of T. maculipennis, observed in natural and anthropogenous habitat and in laboratory conditions, is reported. The following adaptations enabled its invasion and existence within the sewage system in Antarctic scientific stations: the ability to survive in complete darkness, male ability to mate on the substrate surface without prior swarming in flight, and adaptation of terrestrial larvae to survive in semi-liquid food. Possible routes of introduction to Antarctica and between two bays on King George Island are discussed, as well as further research leading to the containment and eradication of this species.Antarctica, with its severe conditions, is poor in terrestrial fauna species. However, an increase in human presence together with climate change may cause an influx of non-native species. Here we report a significant increase in colonized area of one of the few known invasive species to date in Antarctica. Non-native flies of  Belgica antarctica Jacobs, 1900 and Parachlus steinenii Gercke, 1889  had not revealed their presence . The insects, in large numbers, were found in one holding tank of the sewage system near the entrance to the main building of the station . The sewT. maculipennis from various European localities were compared  segment. The first four segments behind the head are secondarily divided in two; the next six into three parts. The secondary segmentation is present even in the first instar, although weakly expressed. The last, 11th segment, bears four fleshy lobes, two dorsal and two larger, ventral ones; between them, a pair of large spiracles is situated. Although trichocerid larvae are generally known to be terrestrial, the larvae of this species may thrive in a semi-liquid or liquid substrate because they can raise the anal end with spiracles above the surface; the four anal lobes  is essential; particularly their resistance or vulnerability to external conditions and the habits which enable this particular species to spread outside its genuine distribution.Trichocera species are vulnerable to desiccation and freezing or warming; according to All stages of T. maculipennis is restricted to casual observations of the adults’ appearance. In the Arctic region, the adults appeared in July to August  on the same island . Tour operators in Antarctica have strict biosecurity measures including boot washing and cleaning personal equipment, and this way of introduction is least likely. Furthermore, the eggs of all trichocerids are very delicate, short–living and immediately desiccate outside wet substrate. However, some cruise ships send fresh food as gifts to the stations they visit, so that may be a risk of repeated introduction of alien species too.T. maculipennis in the Northern Hemisphere  at the Australian Casey Station also appeared insufficient , the locations of insect occurrence will be fumigated with insecticides containing lambda-cyhalothrin. This substance is a synthetic pyrethroid which disrupts insects’ nervous system. Insecticides containing proposed chemicals belong to the long-acting substances (up to six to eight weeks), and are used for controlling adults, larvae and eggs of insects. At the Arctowski Station they will be used only inside the sewage system, without contact with natural environment. The substance breaks down into harmless compounds after six to eight weeks. UV lamps and electric flying insect killer lamps will be used inside the sewage’s cover box and in the vicinity of the sewage system to control flying adult specimens.T. maculipennis, either from the Northern hemisphere or Maritime Antarctica, the barcoding studies may establish the origin of its population on King George Island. Molecular studies are necessary to reveal the sources of fly introduction and to determine whether it was a one-off incident or possibly the result of multiple occasions. Further research on the potential influence of T. maculipennis on native fauna and their possible reproduction outside the research bases must be considered.It is necessary also to control the natural environment: trichocerids on flight, especially just above the ground, and walking on snow , and to Subsequent complex measures, taken jointly by all parties, should be implemented as soon as possible. First steps to establish an action plan to manage the non-native flies in King George Island were taken jointly by National operators of scientific stations on King George Island are aware of the problem of non-native flies, and together, are planning further works, starting with systematic monitoring. A proposed extermination protocol will be shared between operators and discussed.T. maculipennis inhabits a natural environment then the protocol will be useless, and total eradication will be extremely difficult, if not impossible. Until there is no evidence of settlement of flies in a natural environment (larvae or eggs found outside of research stations), the proposed protocol is recommended. We also recommended consideration of a ban on the import of fresh root vegetables to the Antarctic region, or at least consideration of importing clean and properly secured vegetables from known suppliers. There should also be a total ban of transfer of fresh fruits and vegetables from unknown sources, such as gifts from passenger ships or other stations.This paper presents a report of an increase in distribution of one of the few known invading species to date in Antarctica. Invasive species may have a fundamental new ecological role in the ecosystem they occupy. It looks unlikely that control or eradication can be successful, other than through the application of strict and effective biosecurity measures by the national operators using King George Island and the South Shetland Islands. As a result, a complex eradication plan is necessary, and proposed in this paper. The aforementioned methods are appropriate to apply in a sewer system or inside buildings, but if Successful long-term reproduction and range extension of a flying insect in Antarctica proves that non-native species constitute an increasing threat for the biota of one of the most isolated regions on earth. It is still unknown how dispersal occurred between ice-free regions of the island—Maxwell Bay and Admiralty Bay—and whether they spread naturally despite the geographical barrier of a glacier (least likely), or with people (and cargo) travelling between stations, or were introduced separately at each affected station. To answer that question, molecular studies are planned. Additionally, a common strategy of monitoring has already started by the national operators on King George Island. Control and eradication must be developed for King George Island, with strict biosecurity procedures stopping the further spread of this species.


Lactobacillus plantarum is prevalent in animal guts and is widely regarded as beneficial and probiotic. D. Fast et al.  make the surprising discovery that L. plantarum reduces the life span of Drosophila melanogaster and link this effect with the loss and weakened proliferation of stem cells in the Drosophila gut.The bacterium  Lactobacillus plantarum is prevalent in animal guts and is widely regarded as beneficial and probiotic. D. Fast et al.  make the surprising discovery that L. plantarum reduces the life span of Drosophila melanogaster and link this effect with the loss and weakened proliferation of stem cells in the Drosophila gut. These results are apparently at odds with published evidence for beneficial effects of L. plantarum, especially promoting high developmental rates and stimulating stem cell proliferation in young Drosophila. The among-study discrepancies highlight the context dependence of many effects of gut microbes on host health, likely influenced by host age and genotype, variation among bacterial strains, and diet. The diversity of results offers an opportunity to elucidate a fundamental mechanism(s) and the circumstances that dictate whether gut bacteria have positive or negative effects on host health. These studies also reinforce the value of Drosophila as an emerging model system for probiotic science.The bacterium  The default expectation is that the gut microbiota in a healthy animal makes a positive contribution to host health. Any microorganisms that are deleterious to the host are classified differently—as pathogens. And yet, we know that this simple dichotomy is an oversimplification, with ample evidence that the impact of many microorganisms on the host can be context dependent, varying with the genotype and physiological condition of the host, the composition and activity of other microbial taxa in the gut, and many other factors. This complexity has led to a pressing problem in microbiome science: disconcerting inconsistencies between different studies addressing a single topic and difficulties in making reliable predictions about the impact of gut microorganisms on host health.The article by Fast et al.  providesDrosophila melanogaster. Drosophila is an excellent system for fundamental discovery in microbiome science, combining the superb genetic and genomic resources of this model insect with a highly tractable microbiology. Indeed, the starting point of the study by Fast et al. was to make use of routine methods to eliminate the microbiota from Drosophila, yielding axenic (or germfree) flies, and to synthesize associations with standardized microbiota. Specifically, Fast et al.  and Acetobacter pasteurianus (Alphaproteobacteria).The focus of Fast et al.  is the gt et al.  generateDrosophila strains associated with these single bacterial taxa led to the first of two unexpected results in this study: that the flies bearing L. plantarum, but not A. pasteurianus, died prematurely relative to axenic Drosophila. Why is this result unexpected? The reason is that microbiologists, including the research community studying Drosophila microbiomes, consider L. plantarum to be a beneficial member of the gut microbiota. Representatives of this species are used very widely as a probiotic for human consumption and have documented positive effects on the growth rates of both juvenile mice and larval Drosophila raised on low-nutrient diets  may amplify the early- and late-life history tradeoff of their animal host, i.e., promote allocation to growth in early life, even though this reduces the capacity for somatic maintenance later in life  (Drosophila bearing gut microbes) relative to axenic flies, with evidence that heightened stem cell activity is associated with perturbations to the pattern of cellular differentiation and loss of barrier function of the gut epithelium in the aging fly , with elevated expression of the genes spitz and rhomboid, coding for EGF and EGF-activating peptidase, respectively (L. plantarum displayed the reverse gene expression response, predictive of reduced stem cell division rates. This interpretation was confirmed by a second set of experiments in which Fast et al. (Drosophila stem cells. Both the number of GFP-labeled clones and the number of cells per clone were significantly lower in the flies monoassociated with L. plantarum than in axenic flies. (Consistent with predictions from previous research [L. plantarum.Surprisingly, the data of Fast et al.  do not fectively , but thet et al.  applied research , these iDrosophila life span (Although unexpected, the results of Fast et al.  are partife span , 11, 12,Drosophila declines with increasing abundance of L. plantarum relative to a second gut bacterium, A. pasteurianus. These data raise the possibility that the impact of L. plantarum on the host gut epithelium varies with bacterial load and may be influenced by interactions with other bacteria. There is the opportunity to investigate whether L. plantarum at low density stimulates stem cell proliferation but suppresses proliferation at high density and to test the contribution of bacterium-induced ROS and other immune effectors to these divergent effects of L. plantarum. Comparisons of monoassociations with two-member and more complex standardized communities (How are we to make sense of this complexity and inconsistency? I believe that the solution is 2-fold. The first is to minimize the sources of uncontrolled variation, especially to work with standardized microbiota, diet formulations, and culture conditions that are readily transferrable between laboratories. The second and complementary approach is to harness the diversity of experimental outcome as a tool to understand mechanism. One possible way forward arises from the observation of Fast et al.  that themunities  may addiDrosophila and L. plantarum will undoubtedly continue to contribute to our fundamental understanding of the interactions between Lactobacillus and animals and support the role of Drosophila as an emerging model for probiotic science.In summary, the article of Fast et al.  provides


Medical Cyber-Physical Systems (MCPS) hold the promise of reducing human errors and optimizing healthcare by delivering new ways to monitor, diagnose and treat patients through integrated clinical environments (ICE). Despite the benefits provided by MCPS, many of the ICE medical devices have not been designed to satisfy cybersecurity requirements and, consequently, are vulnerable to recent attacks. Nowadays, ransomware attacks account for 85% of all malware in healthcare, and more than 70% of attacks confirmed data disclosure. With the goal of improving this situation, the main contribution of this paper is an automatic, intelligent and real-time system to detect, classify, and mitigate ransomware in ICE. The proposed solution is fully integrated with the ICE++ architecture, our previous work, and makes use of Machine Learning (ML) techniques to detect and classify the spreading phase of ransomware attacks affecting ICE. Additionally, Network Function Virtualization (NFV) and Software Defined Networking (SDN)paradigms are considered to mitigate the ransomware spreading by isolating and replacing infected devices. Different experiments returned a precision/recall of 92.32%/99.97% in anomaly detection, an accuracy of 99.99% in ransomware classification, and promising detection and mitigation times. Finally, different labelled ransomware datasets in ICE have been created and made publicly available. The increasing resilience to antibiotics, an ageing population, the epidemic obesity, or the impact of pollution are factors that increase the difficult for hospitals and care centres to effectively care for patients globally. Hospitals are constantly incorporating technological innovations to face these aspects and improve the quality of the healthcare provided within their borders in the hospital rooms of the future. In this context, new paradigms such as the Internet of Medical Things (IoMT) , and MedMCPS refer to safety-critical interconnected medical systems that analyse patients’ vital signs gathered from medical devices, infer the state of the patient’s health, and initiate treatments issuing information to doctors or directly to medical actuators. This disruptive vision has the potential to enable in a cost-efficient way the next-generation of healthcare, which requires systems able to interoperate efficiently, safely, and securely . In thisWith the goal of making possible the MCPS vision, the ASTM F2761 standard  proposesExisting protection mechanisms like anti-viruses, intrusion detection systems (IDS), or firewalls are not suitable to detect cyberattacks performed by novel or unseen ransomware. It is due to the fact that their functioning relies on having metadata like, for example, signatures of known cyberattacks.Not all the traffic patterns generated by ransomware and malware are distinguishable from the normal traffic patterns generated by medical devices and systems with networking capabilities. In this sense, both a malware encrypting a shared folder and an application compressing the same files have a similar traffic pattern. Similarly, normal changes in the clinical environment can be misinterpreted as attacks if the detection mechanisms do not adapt properly. In addition, malware developers are increasingly using encrypted traffic to avoid payload inspection.Achieving an acceptable balance between detection and false alarm rates is a difficult task. A high false alarm rate can be rather frustrating for the administrator and a low detection rate can make the system ineffective.As it has been demonstrated, ransomware attacks present a critical cybersecurity problem affecting the healthcare discipline. Below, we highlight some of the most important open challenges oriented to the detection and mitigation of ransomware affecting integrated clinical environments :ExistingIn this context, Machine Learning (ML) techniques  based onIn order to improve the previous challenges, the main contribution of this article is the design, implementation and validation of an automatic and intelligent system to detect, classify, and mitigate ransomware attacks affecting hospital rooms of the future equipped with ICE. The proposed solution detects and classifies in real time both well-known and unseen ransomware attacks in ICE by analysing the network flows generated during their spreading phase. In addition, once the ransomware has been detected and classified, the proposed mechanism automatically mitigates it by using NVF/SDN techniques to isolate and replace infected devices, avoiding the ransomware spreading across the clinical network. Specifically, we isolate infected medical devices through the SDN paradigm as well as replace their software controllers using NFV techniques. Both the detection and mitigation mechanisms are fully integrated into our previous work, the ICE++ architecture . The ICEAnother relevant contribution of this article is a set of experiments that demonstrate the effectiveness of our solution detecting some of the most recent and dangerous malware . In this sense, the selected techniques for both anomaly detection (One-Class Support Vector Machine) and ransomware classification (Naive Bayes) obtained a high precision with known and unseen ransomware samples. Additional experiments demonstrated the viability of the proposed solution in terms of time. In the worst case, our solution detected and mitigated a ransomware attack in less than 30 s, which is an acceptable time because the fastest ransomware required more than 1 min to spread and infect ICE devices. Additionally, as a final contribution, during these experiments, a publicly available labelled dataset was created containing the traffic capture and the resulting netflows from our ICE configuration for both clean and ransomware propagation traffic . In concThe remainder of the paper is structured as follows. This section gives an overview of the cybersecurity concerns found in the current state of ICE and MCPS solutions. Historically, medical devices have been developed as stand-alone systems without communication capabilities. However, the MCPS vision is emerging to provide interoperability, safety, and security to clinical environments. In this context, key characteristics in the search for appropriate technology, regulations, and ecosystems to ICE are highlighted in . NowadayIn the literature, there are different solutions oriented to analyse and mitigate the security and privacy issues of healthcare and MCPS . In thisIn addition to the previous security mechanisms proposed in ICE, in the literature, we can find solutions in heterogeneous scenarios that leverage SDN to detect/mitigate ransomware attacks, some of them using different ML techniques for detection purposes. However, to the best of our knowledge, none of them has integrated the combination SDN/NFV with the ICE standard to be able to replace infected elements such as ICE Equipment Interfaces or ICE Supervisor in a few seconds. Moreover, the detection of the ransomware spreading in ICE with encrypted traffic has not been addressed yet.Among the ransomware mitigation solutions based on SDN, Ref.  uses SDNAnother relevant and recent paper related to SDN and ransomware is . In thisIn , the autRegarding other types of malware, the authors of  proposedThe previous solutions improve in a proactive and reactive way the cybersecurity challenges of clinical and heterogeneous environments. However, they do not consider the real-time and autonomic detection and mitigation of ransomware during its spreading phase. Additionally, these solutions are not integrated into an adaptive and flexible management architecture, which is able to manage the security mechanisms according to the contextual information . To the best of our knowledge, this paper proposes the first solution combining ML techniques to detect and classify ransomware as well as the use of NFV/SDN techniques combined with MCPS to provide a flexible management of the ICE resources in real time and on-demand.This section presents a clinical scenario that shows real issues caused by a ransomware attack affecting hospital rooms of the future. For the sake of clarity, we focus the explanation on the behaviour of the WannaCry ransomware family. However, it is important to note that the solution proposed in this paper is generic enough to detect and mitigate other families of ransomware, as it has been demonstrated in ICE Equipment Interfaces, which are attached to medical devices to enable their networking capabilities; the ICE Supervisor, focused on hosting medical applications that receive and control the patients’ vital signs; the ICE Network Controller, in charge of enabling the communications between the supervisor and the ICE equipment interfaces, as well as handling and maintaining the discovery of medical devices and their information; the Data Logger, focused on troubleshooting and forensic analysis; and External Interface, which enables the communication with external hospital resources such as Electronic Health Records (EHR). With the goal of facilitating the interoperability of the elements comprising the hospital rooms of the future and making possible the MCPS vision, the ASTM F2761 standard  proposesOver the last few years, ransomware has gained relevance as a devastating method of cybercrime in healthcare environments. Locky , SamSam To contextualize, ransomware is a type of malware that encrypts the files of infected devices (affecting the availability of data and/or device) and requests a ransom to decrypt the files and avoid information losses. Recent ransomware attempts to exploit system vulnerabilities to spread out rapidly through the networks and affect as many devices or machines as possible. This propagation process is much more harmful when the number of systems is significantly larger. Nowadays, there are several families of ransomware with important differences in terms of encryption and spreading behaviours. One of the most recent and malicious families is WannaCry. This ransomware spreads automatically across the network by exploiting a vulnerability in the MS Windows based Server Message Block (SMBv1). Despite this vulnerability having already been fixed by Microsoft, it is critical to have mechanisms able to detect unseen or known ransomware exploiting well-known or undetected vulnerabilities. Otherwise, hospital rooms of the future equipped with a large number of interconnected medical devices and computational systems will suffer ransomware attacks, affecting the patients’ safety and privacy.Spreading phase: The WannaCry ransomware attempts to spread itself across the hospital network to infect vulnerable medical devices and computers. For that goal, WannaCry uses EternalBlue, an exploit developed by the National Security Agency (NSA) that attacks a vulnerability of the MS Windows based Server Message Block (SMBv1) protocol. After a successful exploitation, the DoublePulsar payload is sent to run remote code and infect the medical devices and computers connected to the ICE network.Encryption phase: It can be performed before, in parallel, or after the spreading phase (depending on the ransomware version and family). During this phase, the medical database as well as other data files are encrypted. Once the process is completed, WannaCry asks for a ransom to decrypt the medical database. Ransomware belonging to the WannaCry family generates and saves a new RSA key pair, which is used to encrypt the medical database and the target data files. Once the previous files are encrypted, WannaCry deletes the original ones, and communicates with an Onion server using a Tor server to transfer the encryption keys. When the ransom is paid, WannaCry obtains the decrypted RSA private key from the Onion server and decrypts the ransomed files.As an example and to illustrate the ransomware impact in the hospital room of the future, we consider that the ICE Supervisor becomes infected by WannaCry. As it has been demonstrated at the beginning of this section, this situation is not unreal and it can happen due to plugging external devices with malicious or infected files, social engineering, weaponized files, or phishing. Once the ICE Supervisor is infected, WannaCry attempts to connect to a predefined domain. If the site was registered, the ransomware is not executed, acting as a killswitch. In contrast, if the connection fails, the ransomware starts with the following two phases:As it has been explained in This section presents the design details of our intelligent and automatic solution to detect, classify and mitigate ransomware attacks in hospital rooms of the future. Having in mind the clinical scenario defined in The following subsections, together with The Monitoring module is in charge of acquiring in real time the network traffic generated by medical devices and systems belonging to ICE, calculating network flows, grouping them in a time sliding window and computing a feature vector from each group or batch of flows.The Offline Model Generation module, in contrast to the rest of modules, requires human supervision. It is only executed during the system bootstrapping, or when it is required to update the existing ML models due to the detection of a new ransomware. This module receives feature vectors for a given period of time , generates a dataset suitable for the training process, selects the proper ML algorithms to detect and classify ransomware in ICE, and trains those algorithms.The Analyser module receives the trained ML models from the previous module and uses them to evaluate in real time the current feature vectors. The anomaly detection method will identify traffic pattern novelties , whereas the classifier will label the traffic coming from known ransomware.The Decision & Reaction module combines the evaluations of the two ML models to estimate the risk of having an active ransomware attack. For that, it uses rules, predefined by the system administrator, to decide in real-time proper mitigation actions like, for example, the isolation and replacement of infected medical devices, or the retraining of ML models.This is the first module of our system and focuses on monitoring in real time and continuously network packets exchanged between the medical devices and databases of ICE. After that, network packets are processed and translated to network flows. The main reason for using network flows is because some pieces of clinical data travel encrypted, even certain ransomware cyphers its spreading traffic, which makes it useless to inspect the network packets. In this point, it is important to consider that we define a network flow as all the traffic exchanged in both directions, during a given connection sharing the same values of source IP, destination IP, source port, destination port and protocol.The Flow Exporter  and the medical application (ICE Supervisor). In these cases, our flow collector is configured to generate a new network flow periodically (triggered by a timeout that prevents a large flow from appearing only once), which would affect the performance and detection time of our solution see . In our The Flow Collector  is to label the datasets according to its purpose, and to divide them into training, validation and test. This is clearly necessary in the case of our supervised classification method. On the other hand, for the anomaly detection method, there is no need of an explicit labelling for the training. However, in this case, it is required an explicit labelling to evaluate the performance of both the detector and the classifier. More specifically, the anomaly detector needs a binary label , whereas the classifier needs as many labels as classes. Subsequently, a first feature selection is done by computing the Pearson’s correlation coefficient for each pair of components in the feature vector. This correlation matrix of the dataset allows us to identify sets of highly-correlated features and keep just one feature of each set. This procedure is done in both 3.3A and 3.3B steps. An additional feature selection stage could reduce significantly the number of features of the datasets. However, this phase is not carried out on the datasets used with the anomaly detection methods. The main reason is that a more aggressive feature selection procedure based on the already-known ransomware classes could discard features useful for detecting future anomalies. This additional feature selection is only carried out on the dataset for the supervised ransomware classifier (3.3A). To this end, we use a Random Forest (RF)  supervisThis component is in charge of determining the most suitable detection and classification techniques for ICE in terms of performance (steps 4.A and 4.B). For that goal, below we show the variety of initial methods considered for both classification and anomaly detection.Anomaly detection techniques–One-class Support Vector Machine (OC-SVM), –Local Outlier Factor (LOF), –Isolation Forest (IF), Probabilistic classification techniques –Neural Network (NN),–Naive Bayes (NB),–Random Forest (RF).Regarding the anomaly detection (step 4.A), our system uses the OC-SVM technique. OC-SVM belongs to the class of boundary-based classification algorithms. The training process of this method consists of finding a function which defines a boundary surrounding the normal traffic patterns of our ICE. This function returns a positive value for points belonging to the inner area defined by the boundary, and a negative value for outsiders. The anomalous traffic pattern generated by the ransomware propagation ought to fall in the negative side.On the other hand, with regard to the probabilistic classification techniques (step 4.B), the goal is to determine to what extent they can deal with ransomware sharing key spreading aspects with the samples used in training. In this sense, probabilistic classification methods, whose output is an estimation of the likelihood of the vector belonging to each class that can help to reach this goal. Even if an input vector does not belong to any known class, the probability distribution provided by the algorithm can give some useful information to the system administrator about the behaviour of the potential malware. In this sense, the proposed system uses Naive Bayes because it provided the best probability estimation of the belonging of the new samples to the class with the most similar traffic pattern. Analyser module.Once the best ML techniques have been selected, this component is in charge of re-training the ML techniques  with the whole dataset (not only the training subset) in order to obtain a model that takes advantage of all the samples available. These processes are performed by steps 5.A and 5.B of In the anomaly detection model case (step 5.A), an automatic retraining process can be triggered if the configuration of the ICE changes significantly . On the other hand, the supervised classifier needs a human-driven dataset generation process to be updated.Decision & Reaction module which will interpret the results and will react in consequence to mitigate the potential ransomware attack.The Analyser is the module that evaluates in real time each incoming feature vector from the medical devices and systems of ICE by means of previously trained models . The output of the anomaly detection  allows the system administrator to predefine rules that control in real time and on-demand the mitigation reactions. These rules consist of two lists of predicates: the antecedent and the consequent. If all the predicates of the antecedent part take the Boolean value true, all predicates in the consequent part are evaluated. The antecedent considers conditions related to the Analyser outputs and the consequent indicates the action taken over the datasets, NFV or SDN paradigms to mitigate the ransomware.In the context of our hospital rooms of the future equipped with ICE, we define three types of mitigation rules: Control plane, Data plane and Hybrids.v is the feature vector evaluated by the two models; Control plane rules are used to manage the different components and modules making up the control plane of the ICE++ architecture. Among the potential actions taken by these policies, we highlight the retraining of ML models when unseen ransomware strains are detected, the set-up of new time windows, or the management of the architecture hardware resources. As an example, the next rule retrains the Anomaly Detector ML model when a new medical device is integrated into ICE. In this particular situation, the rule indicates that the anomaly detector needs to be retrained if it has detected an anomaly and the classifier considers that it is more likely that the vector belongs to normal traffic:Data plane rules are oriented to control the medical devices, systems, EHR, and medical applications of ICE. Potential reactions could be the isolation of infected medical devices or systems, the replacement of medical controllers, or the communication management. As an example, the next rule indicates that a medical device must be isolated and replaced if an anomaly has been detected and the classifier certainly believes that the vector belongs to one of the known ransomware. In other words, the ICE is experiencing a propagation stage of a ransomware sufficiently similar to one of the known samples:Hybrid rules are a combination of the two previous families. The consequence of these rules implies changes in both control (ICE++ Architecture) and data hospital rooms of the future devices and systems. The next rule shows an example where it is required to isolate and replace a medical device as well as retrain the classifier model. In this case, the Anomaly Detector says that there is an anomaly and the Classifier is not able to establish a classification with enough guarantees. This situation is provoked by an attack conducted by an unseen ransomware, which behaviour is not similar to any of the well-known ones:The Reaction and Notification component (step 8) is in charge of interacting with two different modules. On the one hand, it interacts with the Offline Model Generation module when it is required to retrain a given ML module. On the other hand, it interacts with the Orchestrator module see  to schedThis section describes the ICE++ architecture, and how it integrates the modules making up the proposed solution to detect, classify, and mitigate ransomware in ICE  and the ICE System Management. The OSS deals with the logic of the ICE system. This element provides the system administrator with an interface to define the rules controlling the architecture behaviour. On the other hand, the rules are provided to the ICE system management in order to identify concrete actions and orchestrate their enforcement.Monitoring, Analyser, Decision and Reaction, and Orchestrator. They are in charge of detecting and mitigating ransomware attacks in ICE. ME applications: ICE components  to replace infected systems of the hospital room of the future.ME services: For example, an ME service could be in charge of assuring the level of security of the ICE elements. In particular, it could establish specific authentication mechanisms to ICE applications or determine a particular security protocol  between the ICE elements.Network infrastructure: For example, virtual SDN-based networks to isolate infected ICE components. Another alternative could be the automatic management of the network communication to block ransomware attacks.The ICE system management is composed of the next elements: Finally, the Orchestrator is responsible for scheduling and triggering the previous countermeasures as well as maintaining an overall view of ICE status .Mobile edge host and the Mobile edge host level management.This level focuses on running the mitigation countermeasures  in ICE. This level is composed of two elements: the Mobile edge applications, a Mobile edge platform, and a Virtualization infrastructure. ME applications could be instantiated as the ICE element defined by the ICE framework as well as some applications oriented to improve the security of the clinical scenario. Applications run as virtual machines (VM) and containers on top of the virtualization infrastructure allocated at the edge of the network. This fact provides our solution with the flexibility, efficiency, and low latency required by ICE. The virtualization infrastructure can use the hardware resources of computers, BeagleBones Black, or even medical devices, depending on the scenario configuration. ME applications interact with the ME platform to consume and provide services. Specifically, the ME platform is a set of essential services required to run ME applications on a particular virtualization infrastructure. These services can be specific for given applications or even shared among some of them. Examples of services could be secure communication protocols (like Transport Layer Security) or traffic rules control.On the one hand, the ME host provides ICE with compute, storage, and services for running ME applications. To reach it, this entity contains Mobile edge platform manager and the Virtualization infrastructure manager. The ME platform manager is responsible for managing the life cycle of applications, including informing the ME orchestrator of relevant application related events. The Virtualization Infrastructure Manager is responsible for allocating, managing and releasing virtualized  resources of the virtualization infrastructure, as well as collecting and reporting performance and fault information about the virtualized resources.On the other hand, the ME host level management is composed of two elements: the Networks level is the lowest one and it contains two elements: the Networks and the Networks management. Networks contain the physical infrastructure required to provide connectivity between the different ME applications. The Networks management contains the SDN Controller, which is able to monitor and manage in real time and on-demand the communications of ME applications.Finally, the ICE Administrator, Clinicians & Operators, and Patients. The ICE Administrator is responsible for defining the logic of the system in a high level. The rules defined in The actors composing the proposed architecture are: Orchestrator enforces the mitigation actions taken by the second rule defined in Once the main components of the architecture has been explained, this section shows how the Regarding the enforcement of the rule in charge of replacing and isolating the infected medical device, the Orchestrator receives the notification and interacts with the virtualization infrastructure manager (VIM) to create the new ICE Equipment Interface in the available hardware located in our hospital room of the future . In this point, the Orchestrator interacts with the SDN Controller to add a new rule in the flow tables of the network switch and drop the packages belonging to the spreading phase of the ransomware (step 8). Finally, the SDN controller confirms the Orchestrator that the flow tables have been modified with the new rule (step 9). The time required to perform the deployment of a new ICE Equipment interface in different hardware resources has been calculated in This section presents a pool of experiments focused on demonstrating the viability of our intelligent and automatic solution in charge of detecting, classifying and mitigating ransomware attacks in hospital rooms of the future.There are two main aspects that should be considered to measure the viability of our proposal: how good our system is at detecting ransomware threats and how effective our system is at mitigating a ransomware propagation. The detection aspect is tightly related to the discriminative power of the trained ML algorithms. On the other hand, the mitigation aspect is related to both the time needed to detect the propagation and the ability to mitigate the ransomware before it manages to infect other medical devices and systems. To measure both aspects, firstly we have designed and deployed a realistic scenario where a hospital room of the future equipped with ICE is infected with different ransomware. After that, we performed some experiments to measure the detection and classification precision as well as the time required to mitigate the ransomware. The experiments were carried out on OpenICE, the open source implementation of the ASTM F2761 (ICE) , proposeFive medical devices able to acquire different vital signs of patients and apply treatments. The medical devices are simulated using ICE Equipment Interfaces of the OpenICE v1.0.0  softwareOne clinical database storing medical data such as EHR. The database is distributed across the machines with MS Windows. Additionally, there is a clinical information system in charge of reading and writing the database content through the SMBv1 protocol of Microsoft.One closed-loop application  implemenThe Monitoring module of the ICE++ architecture. This module has been deployed on a dedicated machine with Ubuntu 16.04 that receives all the ICE network traffic. To implement the flow exporter, we have used Argus v3.0.8.1 , which iThe Analyser module of the ICE++ architecture has been deployed in a dedicated machine with Ubuntu 16.04. The Anomaly Detection module uses Scikit-learn v0.20.0, which provides efficient implementations of the three evaluated ML methods. Similarly, the Ransomware Classification module, based on Naive Bayes, has been implemented also in Scikit-learn.The Decision and Reaction components of ICE++ runs on another Ubuntu 16.04 machine and we have used SWRL (Semantic Web Rule Language)  to definOne SDN-enabled router in charge of managing the communications of the previous elements through a private network. In addition, the router also enables some external communication through the Internet to allow doctors and caregivers to control remotely specific components of the clinical scenario.This section describes the design, deployment and initial set-up of our hospital room of the future to obtain a suitable dataset that allows us to perform some experiments. These experiments are aimed to measure the performance of the detection/classification methods as well as the time required to detect and mitigate different ransomware attacks. The designed scenario has the following elements:The previous elements were fully virtualized in a physical server where OpenStack  and OpenOnce our scenario was designed and deployed, the next step was to test our detection and mitigation solution in this scenario. To this end, we decided to select four of the most dangerous and recent malware affecting clinical environments. Specifically, three ransomware strains  and one cryptomining malware (PowerGhost). Once selected, we used two of them (WannaCry and Petya) to train our solution, and the other two to test its generalization power. WannaCry  is a welOnce the ransomware selection was performed, the next step was to create suitable datasets to later measure the performance of our detection and classification solution. For that, we captured six hours of clean network traffic from our hospital room of the future equipped with ICE. Then, we cloned four times our scenario. The ICE Supervisor machine of each scenario was infected with a different ransomware . The traffic generated in each ICE scenario during the ransomware spreading phase was captured in a different dataset. In the end, we had five datasets, one with the clean traffic dataset and four with the ransomware traffic. These datasets are one of the relevant contributions of this paper and they can be downloaded in . The amoFinally, it is well-known that some anomaly detection techniques do not work efficiently with large amounts of samples. Therefore, to avoid this restriction from affecting the technique selection process, we made up each dataset by taking all the anomalous samples  plus 100,000 randomly extracted clean samples , keeping the original order. In this way, we also reduce the imbalance of the dataset significantly. Each dataset was then partitioned into three contiguous subsets: training (80%), validation (10%) and test (10%). Usually, each subset of this partitioning is created by a random selection from the original dataset; however, in our case, the high correlation between close vectors made the contiguous split more appropriate. The resulting datasets were subsequently cleaned, and an unsupervised feature selection, consisting of dropping highly correlated features, was carried out as explained in This section performs an experiment to select the most appropriate anomaly detection method. Considering the five datasets acquired and explained in the previous section and the three potential anomaly detection methods listed in The first step was to select a set of representative anomaly detection techniques: OC-SVM, LOF and IF. Each one of these algorithms detects anomalies by attempting a different strategy. OC-SVM is a boundary-based technique and its description can be found in Every ML training procedure requires a feature engineering stage. In semi-supervised anomaly detection methods, only unsupervised feature selection procedures can be used . Otherwise, the feature selection process would be biased by the set of known ransomware, and it might discard features useful in future scenarios. This is the main reason why we did not select a subset of features by using our labelled dataset.True Positive (TP): Number of anomalies correctly detected.True Negative (TN): Number of normal samples correctly classified as normal.False Positive (FP): Number of normal samples incorrectly detected as anomalies.False Negative (FN): Number of anomalies incorrectly classified as normal.In order to calculate which of the previous three algorithms has the best detection performance, a metric of such performance should be defined. Given that anomalies are supposed to be rare, the accuracy is not considered a representative performance metric. In anomaly contexts, precision, recall and F1-score give more information about the detection performance of a model. To define these metrics, some concepts should be previously defined:Precision, indicates what percent of the predicted anomalies were actual anomalies,Recall or sensitivity, defines what percent of actual anomalies where predicted,F1-score, shows the trade-off between the precision and recall regarding the anomaly class,False Positive Rate (FPR),Below, we show the metrics proposed to measure the anomaly detection technique performance. F1-score is the harmonic average of precision and recall. Its result is closer to the lowest of the two values; therefore, it includes information about how balanced precision and recall are. In anomaly detection problems, both precision and recall are important. A low precision score tells us that we are generating a large number of false positives, and a low recall indicates that we are missing many anomalies:A key aspect of the training of every ML algorithm is the hyper-parameters optimization. Specifically, in our clinical environment, there are two sets of hyper-parameters: one of them associated with the anomaly detection model, and the other related to the classification model. In both cases, a set of hyper-parameters was selected to be tuned. Then, a grid search in the hyper-parameter space was carried out in order to figure out which configuration achieved the best performance. With regard to our anomaly detection algorithm, a list of the considered hyper-parameters can be found in The performance results are summarized in Besides the anomaly detection method, our system also considers a ransomware classifier. This section focuses on showing the experiments focused on selecting the most appropriate classifier in terms of performance.Three probabilistic well-known supervised classifiers were selected to be evaluated: Neural Network, Naive Bayes and Random Forest. Following the same methodology and metrics followed in the anomaly detector selection, the three algorithms were trained and validated. The selection process with these models was performed using only three datasets: Clean, WannaCry and Petya. The corresponding training and validation subsets were used to train the models in the hyper-parameter tuning phase. A grid search in the hyper-parameters allowed us to find the configuration providing the best performance for each model. The list of hyper-parameters considered is showed in It should be noticed that there is a hyper-parameter called Feature Selection. Since our classification dataset is properly labelled, we can do a more advanced feature selection by means of a Random Forest (RF). Before the training procedure, an RF is trained to obtain an estimation of the importance of each feature in the classification process. This importance score allows us to drop every feature with an importance below a given threshold  and the classifier (Naive Bayes) are selected, another critical aspect is to measure how much time these techniques need in order to evaluate, in real time, a current feature vector and decide whether it is an anomaly or not. At this point, it is important to remember that both processes  are performed in parallel and their outputs are subsequently combined by the rules defined in Regarding the anomaly detection system deployed in the analyser module of our ICE++ architecture , we measThis section demonstrates the suitability of the proposed solution when a ransomware, affecting our hospital room of the future equipped with ICE, needs to be mitigated. Specifically, we have performed several experiments with the goal of measuring the time required by the ICE++ architecture to deploy, launch and configure an ME application with a new ICE Equipment Interface of OpenICE that simulates a medical device  CPU i7-3770 at 3.40 GHz. The operating system is Ubuntu 16.04 LTS Desktop; andServer with 64 GB or RAM, a 36 Core Intel(R) Xeon(R) CPU E5-2697 v4 at 2.30 GHz, and Ubuntu 16.04 LTS Server as an operating system.To deploy and configure the ICE Equipment Interface, we used the following three different configurations of hardware:Creation of three VM with 1 GB of RAM, a single-core CPU, and 10 GB of hard disk, each one of them using OpenStack.Installation of three operating systems with different capabilities , each in its own VM.Installation and configuration of the ICE Equipment Interface simulating a medical device, on top of the previous operating systems.Measurement of the time required to instantiate each previous VMs in each piece of hardware equipment.Measurement of the time required to launch and configure a simulated medical device in the ICE Equipment Interface running on top of the hardware equipment.For each one of the previous hardware configurations, we developed and launched an OpenICE instance using VM and containers. The first experiment focused on measuring the time required to deploy the ICE Equipment Interface on top of different VMs. For that purpose, we followed the next steps:At this point, it is important to clarify that, due to the limited computational resources of the Raspberry Pi 3, this device was not able to host virtual machines.Java SE Runtime Environment 8 (library required by OpenICE) to execute the version 0.7.0 of OpenICE. After implementing and configuring the Docker, we measured the time required to deploy and launch a simulated medical device of OpenICE. After performing the previous experiment with VMs, we carried out an additional experiment with containers. Specifically, we deployed the ICE Equipment Interface of OpenICE in a Docker that uses One of the main conclusions obtained after performing the previous experiments is that the time required to deploy the ICE Equipment Interface is inversely proportional to the amount of computational resources needed. However, it is important to keep a trade-off between resources and economical cost. Therefore, the Raspberry Pi 3 is not suitable for real-time medical scenarios where ransomware spreads quickly, and medical devices must be deployed considering critical time restriction. In contrast, medical scenarios with other requirements in terms of latency can be perfectly managed by the Raspberry Pi 3. Another conclusion we can extract from This section demonstrates that our solution is able to detect and mitigate the previous families of malware  in an acceptable time. We consider as acceptable any time lower than the required by the ransomware to spread across ICE and infect the second medical device or machine.As a conclusion, we have demonstrated that our intelligent and automatic solution is suitable for detecting and mitigating the spreading phase of different ransomware families in real time. In this context, the performed experiments provide promising results in terms of time and precision to avoid different ransomware from spreading across the integrated clinical environments.This paper presents an automatic, intelligent and real-time system able to detect, classify, and mitigate ransomware attacks in hospital rooms of the future. The proposed solution is fully integrated with the ICE++ architecture, our previous work, and makes use of Machine Learning techniques to detect and classify the spreading phase of ransomware attacks affecting ICE. Another relevant contribution of this paper is the proposed mitigation mechanism, which considers NFV/SDN paradigms to stop the spreading by isolating and replacing infected medical devices and systems.On the other hand, a pool of experiments have demonstrated the suitability of our solution detecting some of the most recent and dangerous malware . The selected techniques, OC-SVM and Naive Bayes, have proved able to detect and classify ransomware affecting ICE. OC-SVM obtained the 92.32% of precision and 99.97% of recall in anomaly detection, whereas Naive Bayes obtained a 99.99% of classification accuracy. Both of them were evaluated with known and unseen ransomware samples. Additional experiments demonstrated the viability of the proposed solution in terms of time. In the worst case, our solution detected and mitigated a ransomware attack in 29.7 s, which is acceptable because the ransomware required at least 63.1 s to spread and infect other devices. Finally, different labelled ransomware datasets in ICE have been created and made publicly available.As the next step, we are already working on the evaluation of our proposal with new ransomware families having more complex spreading behaviour patterns. In this context, the inclusion of new anomaly detection and classification techniques will be required to maintain the accuracy level obtained as output of this work. Additionally, we plan to extend our solution and analyse the encryption of shared folders, where the ransomware traffic patterns could be seen as time series data and classified by deep learning methods like Long Short-Term Memory neuronal networks (LSTM). We will also include ML techniques to detect the infection/encryption ransomware stages by means of particular system call patterns and internal processes executed on the medical devices. The combination of the solution proposed in this paper (focused on detecting the ransomware spreading phase) together with the analysis of the infection/encryption phase will improve the robustness and accuracy of our detection system. Another line of work that we are considering is the automatic generation of signatures and metadata to feed existing countermeasures such as IDS and anti-virus in real time and avoiding massive ransomware from spreading.


Employees on board must be highly qualified in order to be able to independently meet the different work requirements during the three voyage stages of a ship . In this study, the activity profiles of the various occupational groups on container ships are presented according to the voyage stages.As part of a maritime field study on 22 container ships in the North Sea area, the work processes of four different professional groups on board were evaluated, and a list of activity profiles was compiled. Directly after a voyage stage, the 323 seafarers participating in the study recorded the duration of each task within the recent voyage stage. The average proportion for each activity was determined and presented as a job activity profile.According to this profile, the diversity of tasks for the nautical officers and the deck ratings differ between the voyage stages. For watch officers, the focus of activity during port stay is on the preparation and monitoring of the loading process. During river and sea passages, more than 50% of the working time consists of monitoring the navigation area and about 10% of navigation. The main tasks for deck ratings during port stay include (preparation and follow-up) activities for loading and unloading the vessel and, during the other voyage stages, cleaning, painting and maintenance work on the ship. The activity profile for technical officers and engine room ratings less often differs significantly between the various voyage stages. There are numerous control, repair and maintenance tasks during the entire voyage.The established activity profiles show that the work diversity, especially among nautical officers and deck ratings, differs with a variety of requirements between the voyage stages. The activities of all four occupational groups varied most during port stay and less during the sea passage. To prepare maritime trainees for the expected job-related requirements and to identify the most suitable opportunities for recreation during a voyage, future maritime studies about stress on board should take the differences in the activities between occupational groups and the voyage stage into account. The crew of a merchant ship is on its own on the high seas. Therefore, all necessary activities, be it those involved in maintaining the ship, in loading operations  or in providing for the crew on board  have to be carried out independently by the ship’s crew , 2.Container ships are usually equipped with their own workshop so that the necessary tools and materials for regular maintenance and repair work on board are available. The large dimension of the ship’s operating system, the loading and transport of sometimes several thousand ship containers, the physical effects of the ship’s movements and last but not least the permanent influence of corroding salt water are a great burden on the ship. To reduce wear and tear and thus premature aging of the ship, the effort for maintenance and repair work on board should not be underestimated .In addition to these routine tasks, unpredictable job demands often arise on board . In the case of major technical damage, qualified specialists on land can be called in at the nearest port, if necessary. The next, often foreign port is sometimes only reached after several days at sea and there is no certainty that the necessary know-how or the required replacement material are available there. Any deviation from the planned course of a ship is associated with significant operating costs . A longeDue to long-term separation from their families permanent influences of physical effects on the high seas  and long working hours, seafarers normally experience a high stress level during their shipboard stay over several months at a stretch –7. SeverTo date, there is no percentage-weighted analysis as quantitative measure available about the activities for crews aboard container ships as the most prominent vessel type in merchant shipping . In partAn examiner with experience in seafaring accompanied 22 sea voyages on German container ships . During the voyages, 323 seafarers were asked about their typical activity profile on board (participation rate 88.5%). More than 95% of German shipping companies had previously been contacted. Out of these shipping companies, 12 were randomly selected and considered to be representative (in terms of crew structure and underlying safety standards) of the German fleet of container ships with current deployment in the coastal area.The study sample consisted of 67 nautical officers, 158 deck ratings, 55 technical officers and 43 engine room ratings. The average age of the exclusively male crew members was 38.2 years (± 11.7 years). Participation in the study was completely voluntary and the data collected was anonymous. All participants gave their written informed consent before taking part in this study. The study was approved by the Ethics Committee of the Hamburg Medical Association (no PV4395).Two maritime psychologists had conducted several standardized interviews with seafarers , shipping companies  and maritime stakeholders about the activities of the different occupational shipboard groups. Beside this information, several maritime job-descriptions have been used to develop an activity profile list for the different occupational groups during the three voyage stages. At the end of a typical voyage stage, the seafarers taking part in this study recorded the proportion of working time spent on tasks with each of the listed activities in the protocol. They also had the opportunity to enter additional activities in this list that had been relevant during their recent voyage stage.p-values were two-sided, and a p-value of < 0.05 was considered to be statistically significant.The answers about the activities during the past voyage stage were presented as average percentage with standard deviation (SD). In those cases, in which the percentage values in two voyage stages were higher than 0%, the statistical significance of these differences was calculated using the Mann-Whitney U test. Significant findings were presented in the Figs. p > 0.05) were observed in the activity profile on board of feeder ships or large container ships , the data were merged together.No seafarer entered any additional task in the given job activity list. Figures As illustrated in Fig. During the river and sea passage, more than 50% of the working time consists of monitoring / watching of the navigation area and about 10% of navigation. Furthermore, these voyage stages are used, to a greater extent, for documentation and administration work. During the river passage, the supervision of the mooring and unmooring as well as arrangements with the pilot take up additional working time.There are also differences between voyage stages in the job activity profile for deck ratings. In port, the main tasks are (preparation and follow-up) activities for loading and unloading the vessel. In addition, security and watchkeeping tasks are required to a considerable extent Fig. . During During the river passage, the deck ratings are assigned as helmsmen (to operate the rudder according to the pilot/captain’s instructions) and to assist the pilot in the transfer. Furthermore, in this voyage stage and especially during sea passage, more repair and maintenance work is conducted on deck. Above all, the sea passage is often used to carry out cleaning, painting and maintenance work on the ship.In comparison to nautical officers, the profile of the technical officers less often differs significantly between the various voyage stages. Their tasks include control, repairs and maintenance throughout the entire voyage. The bunkering of fuel and the takeover of equipment represent important tasks for the technical officers during stays in port.The start and operation of the ship’s engine  takes a long time both during port stay and during river passage Fig. .The average working day of the engine room ratings is characterized by a high degree of routine with a high proportion of repair and maintenance activities in the engine room and on deck. Except for a slightly larger proportion of cleaning and painting work during sea passages, no noteworthy differences were observed in the activity profile between the various voyage stages Fig. .Developing job descriptions and planning seafarers’ work schedules necessitate good knowledge of the shipboard activities. The fact that none of the 323 participants surveyed entered any further relevant activities concerning their recent phase of voyage episode indicates that the activity profile list provided according to the previously conducted interviews and job descriptions is complete. When selecting the phase of voyage to be evaluated, the examiners emphasized that a period with a normal workload was needed in order to determine the activities of a routine operation. Certainly, there are also phases with exceptional workloads on board. However, the research focus of this study was not on those phases.The approach of this study from the perspective of occupational science has shown that nautical officers and deck ratings have a higher variety of activities which differ between voyage stages. In comparison, the activities of the employees in the engine room varied less, which suggests a higher degree of routine tasks for these professional groups. Disturbances or irregularities of the ship’s engine naturally make immediate alterations to their job activities necessary.The activities of all four occupational groups varied most during port stay and less during the sea passage. This has already been previously described . This coSupervisory and control tasks are a focal point of job activity for nautical and technical officers , 17. As Depending on the rank of the officer , additional activities  exist, which are not differentiated in this study. Since some repair services can only be conducted when the engine is stopped, there is also a somewhat greater amount of repair and maintenance work for engine room personnel during port stay.While the deck personnel  perform duties on the bridge, on deck, in the loading area and partly also in the port, the engine room personnel stay almost exclusively in the engine department and adjoining workshop (below deck). During port stay, the nautical officers, in particular, have external professional contact with port authorities, shipping companies, charterers and pilots.It is assumed that the activity profiles on other types of ships  are different from those on container vessels. This type of ship was chosen in this study as container ships are of great and increasing importance for global trade . In addiAnother difference in work requirements can be found between smaller feeder container ships and large container ships, as the latter often use land-based personnel during port stay to relieve the crew of the ship in this voyage stage , 18. CorAs a limitation of this study, inactive time or breaks of the seafarers were not recorded. Thus, it is not possible to demonstrate the actual distribution of time allocated to different tasks during the day. The findings of this study confirm the assumption that the activities during the sea passage varied less, which may probably lead to a lower stress level compared to port stay or the river passage. However, due to the fact that the stress load of the activities in the different voyage stages was not weighted or objectified, a job risk-assessment is not possible on the basis of this study. Furthermore, work intensity cannot be derived from this study as the various job activities require different degrees of effort. This was, however, not an objective of the present study and should be focused on in future field studies on board, taking into account the knowledge gained here.This study demonstrates the distribution and differences of the tasks of the shipboard crews during the various voyage stages. The activities of all four occupational groups varied most during port stay and less during the sea passage. It could be assumed that the high diversity between the voyage stages may indicate stronger job-related stress, but the study design used is not suitable for analysing or confirming this hypothesis. To prepare maritime trainees for the expected job-related requirements and to identify the most suitable opportunities for refreshing during a voyage, future maritime studies about stress levels should take the differences in the activity profile between occupational groups and the voyage stages into account.


The rapid advancements in health care can make it difficult for general physicians and specialists alike to keep their knowledge up to date. In medicine today, there are deficiencies in the application of knowledge translation (KT) in clinical practice. Some medical procedures are not required, and therefore, no value is added to the patient’s care. These unnecessary procedures increase pressures on the health care system’s resources, reduce the quality of care, and expose the patients to stress and to other potential risks. KT tools and better access to medical recommendations can lead to improvements in physicians’ decision-making processes depending on the patient’s specific clinical situation. These tools can provide the physicians with the available options and promote an efficient professional practice. Software for the Evolution of Knowledge in MEDicine (SEKMED) is a technological solution providing access to high-quality evidence, based on just-in-time principles, in the application of medical recommendations for clinical decision-making processes recognized by community members, accreditation bodies, the recommendations from medical specialty societies made available through campaigns such as Choosing Wisely, and different standards or accreditive bodies.The main objective of this protocol is to assess the usefulness of the SEKMED platform used within a real working clinical practice, specifically the Centre intégré de santé et des services sociaux de l’Outaouais in Quebec, Canada. To achieve our main objective, 20 emergency physicians from the Hull and Gatineau Hospitals participate in the project as well as 20 patient care unit physicians from the Hull Hospital. In addition, 10 external students or residents studying family medicine from McGill University will also participate in our study.The project is divided into 4 phases: (1) orientation; (2) data synthesis; (3) develop and validate the recommendations; and (4) implement, monitor, and update the recommendations. These phases will enable us to meet our 6 specific research objectives that aim to measure the integration of recommendations in clinical practices, the before and after improvements in practices, the value attributed by physicians to recommendations, the user’s platform experience, the educational benefits according to medical students, and the organizational benefits according to stakeholders. The knowledge gained during each phase will be applied on an iterative and continuous basis to all other phases over a period of 2 years.This project was funded in April 2018 by the Fonds de soutien à l’innovation en santé et en services sociaux for 24 months. Ethics approval has been attained, the study began in June 2018, the data collection will be complete at the end of December 2019, and the data analysis will start in winter 2020. Both major city hospitals in the Outaouais region, Quebec, Canada, have agreed to participate in the project.If results show preliminary efficacy and usability of the system, a large-scale implementation will be conducted.PRR1-10.2196/11754 The rapid advancements in health care can make it difficult for general physicians and specialists alike to keep their knowledge up to date. In medicine today, there are deficiencies in the application of knowledge translation (KT) in clinical practice. The Canadian Institutes of Health Research (CIHR) defines knowledge translation as “a dynamic and iterative process that includes synthesis, dissemination, exchange and ethically sound application of knowledge to improve the health of Canadians, provide more effective health services and products, and strengthen the health care system” .KT is of critical importance, considering the numerous gaps between what we know and the actual care delivered. The CIHR has come to the conclusion that “it has become clear that the creation of new knowledge often does not, on its own, lead to widespread implementation or impacts on health,” .In fact, the best evidence and best practices promoted by scholarly institutions and organizations are not always implemented, and some patients do not receive the most appropriate treatment. According to the Choosing Wisely campaign, it is estimated that up to 30% of examinations, treatments, and interventions performed in Canada are potentially useless or harmful . Some stThroughout the world, including Canada, it is increasingly recognized that some medical procedures are unnecessary and provide no added value to the treatment . These uThe Choosing Wisely campaign aims to help clinical practitioners and patients engage in dialogue about unnecessary examinations, treatments, and interventions and to make stronger and more efficient choices regarding quality care. This initiative is now implemented in 18 countries across the world, including Canada, where several recommendations have been issued pertaining to a wide range of clinical specialties, which enable an improved information exchange on best practices -15. SeveThe challenge for the health care system is to help physicians adequately implement exemplary practices. For professional guidelines to be implemented and to improve the quality of care, it is essential that doctors become aware of the existence of these practices through appropriate methods of dissemination and implementation in day-to-day practice.Furthermore, the transfer of theoretical knowledge and practical experience from one context to another is a focus in medical education -23. ThisSome models proposed in recent years promote the development of CoP and the continuity of patient-centered care -33. ThesA CoP is defined as a group of individuals who are interacting to share information, experiences, models, views, advices, and best practices, as well as to solve problems and extend their knowledge in an area of practice in which they share a common interest . Each meInformation technology (IT)–enabled CoP can support the knowledge learning and sharing activities within interdisciplinary health care teams. A study based on the Hoyman model demonstrated how computer applications can ensure the continuity and flow of the care .KT tools and access to the guidelines can guide and improve physician decision-making processes depending on specific clinical situations of the patient. These tools can provide them with the available options for care, ultimately helping them promote a more efficient professional practice ,27,39-41IT–enabled CoP can support learning and knowledge sharing within health care teams as well as promote best practices in a variety of clinical areas ,27,40-42Systematic reviews have demonstrated the value of support tools for integrated clinical approaches . StudiesAn innovative platform was created in the Outaouais Region in Quebec, Canada, in 2014. Initially used in the emergency area, this platform is now being assessed at the institutional level and is an integral part of the Centre intégré de santé et des services sociaux de l'Outaouais and Relations and Educational Research Department (RERD) approach. Software for the Evolution of Knowledge in MEDicine (SEKMED) is an interactive and dynamic working Web platform employing a multidimensional approach to knowledge, which considers the various dimensions linked to clinical practice such as scientific, organizational, professional, and experiential. The solution also allows collaboration and interactions through an iterative and continuous process of knowledge generation supported by the involvement of CoP.The platform aims to facilitate the coordination of efforts deployed by members of a CoP, the accreditation and standards bodies, within an advanced Wiki-type tool dedicated to the creation, aggregation, and updating of interactive resources supporting the patient’s clinical history intake, physical examination, differential diagnosis consideration, take over, and therapeutic or orientation processes by the clinical practitioners. Moreover, these resources are, then, made available, as per the just-in-time principles, directly in the clinical practitioners’ processes using an ontological recognition engine which recognizes the terms associated with resources.SEKMED assists clinical practitioners in their efforts to stay up-to-date and enables the integration of best practices as well as a better use of diagnostic and therapeutic resources. This project is destined to clinical practitioners but it can be interfaced with other health professions. There is an introductory video about the SEKMED platform .Note that every section of the menu could be accessed by clicking in the SEKMED logo so that we can choose the appropriate section.SEKMED aims at giving the clinician a representation of all the different elements that constitute its practice and facilitate the exchange with the community they are a part of. Those elements are represented in the different sections of the platform and are represented in the dashboard that we see in The following is a brief description of every section:Resources: Here we can search for specific resources in one community or in other communities. Resources are built by the community with tools that are provided. They are formatted in a way to be immediately clinically useful. A resource could be an interactive template for history taking, physical examination, investigation, treatment, and recommendation to patients. It can also be references or educational videos that are provided in the clinical process, following the just-in-time principle. Filters could be applied during that search . This process is completely distinct from the discovery of resources in the clinical setting. It is also where one can decide to add a resource. It is where the process of creation happens.Communities: A list of all communities, my own communities, and pending request to adhere to one. The concept of community is important when we understand that the content that will be made available to the clinician is dependent on the fact that he or she is a member of one of them specifically.SEKMED Café: A section where you can interact with your community. .PDF: A section facilitating storage of PDF. From there, they can be made available to the communities. Note that most resources are not PDF, but it is often the start of the evolution from a more static to fully interactive template.Patients: Index of existing patients.Episodes: When a patient is selected, an episode is created for every specific encounter. Here, we can find a list of the still opened episodes, or search for one based on different criteria.Latest Tasks: A list of the resources a community would like to see implemented. Each task links to a real document. This document only has a title and, in some cases, instructions for specific objectives associated. This document, in task, is then attributed or available to the members of the community of practice as a specific project.New resources: A list of the most recent resources created.Tweets: The Twitter feed of the community.The SEKMED platform allows the creation of different kinds of resources, permitting the integration recommendations from normative or accrediting bodies. As shown in As shown in In certain cases, a full template or an algorithm could represent the recommendation of a normative body or an organization . It is tThe certification needs to go to a review committee. The editing process is then blocked for the CoP. The certificate is set in advance, and the process for adding it is fairly simple.The main objective of the pilot project is to assess the usefulness of the SEKMED platform in the implementation of medical recommendations recognized by the members of CoP, accreditation bodies (Association des médecins d'urgence du Québec or AMUQ), a campaign such as Choosing Wisely and standards bodies (INESSS) in clinical practice in real health care settings within the province of Quebec, Canada.As part of the project, SEKMED will be assessed with 3 CoP: (1) emergency physicians, (2) general medicine patient care unit physicians, as well as (3) external students and residents studying family medicine. Group 1 will be composed of 20 emergency physicians from the Hull Hospital and the Gatineau Hospital. Group 2 will have 20 patient care unit physicians from the Hull Hospital, and the third group will consist of approximately 10 external students and residents in family medicine from McGill University.The project will focus strictly on (1) the research over a 24-month period, (2) the ethical and scientific endorsement of the project; (3) the employment of students; (4) the recruitment and training of participants; (5) the initial implementation of the 6 specific objectives through the analysis and interpretation of quantitative and qualitative data generated during the study; (6) continuous improvement; and (7) the dissemination of results within health care work environments as well as stakeholders and academic audiences.The project will be completed in 4 phases . The knoThis will consist in the consultation and mobilization of participants in the 3 CoP to better understand the culture, practical settings, values, and preferences, as well as to identify their local decision-making needs at the clinical and practical level. Three work teams will then be created to represent each CoP: (1) emergency physicians; (2) patient care unit physicians; as well as (3) external students and residents in family medicine. Each community will be represented by a voluntary champion. All participants will complete training during this phase to familiarize themselves and master the SEKMED platform’s functions. Each will receive a user guide with up-to-date content presenting among other things, video clips and screenshots to ensure a better understanding of the platform.This will aim to rigorously collect, integrate, and synthesize the recommendations provided by the members of each community of practice, accreditation bodies (AMUQ), and standards bodies (INESSS and Choosing Wisely). Recommendations are based on 3 types of data: scientific, contextual, and experiential. An initial information search will be conducted with each team to identify the educational and informational content, templates, forms, follow-up sheet, decision-making algorithms, and other relevant resources used by the CoP. A second information search will be undertaken with accreditation and standards bodies only with the vision to compile a comprehensive list of recommendations for each specialty.This will consist in mobilizing work teams to (1) collect and integrate scientific information, within the implementation context  and practical experience context , and better understand the values and preferences of each community of practice; (2) verify if the recommendations are available or not. If they are available via the accreditation and/or standards bodies, they can be considered as they stand or be adapted for local usage; (3) propose recommendations in a concise manner that are lacking and have not been listed by members of each CoP, by accreditation bodies, or by standards bodies but are deemed useful, relevant, acceptable, and applicable in the field by teams; (4) select recommendations from a list provided by accreditation and standards bodies that meet the CoP’s clinical and practical needs; and (5) review and validate all recommendations that are considered essential to the practice and relevant to be applied and monitored on the SEKMED platform (Phase 4).In the final phase of the project, recommendations will be implemented, monitored, and updated. The implementation step aims to integrate, disseminate, and transfer recommendations across the SEKMED platform so that users may use them in their own CoP. Implementation support strategies will be available at this stage to promote ownership and facilitate the dissemination of the recommendations. The monitoring step will measure the degree of implementation of recommendations and their impact on clinical practices, care, and services management as well as the health and well-being of populations. Finally, the last step consists in making regular updates with working teams, ensuring continuous access and use of the best evidence and the recommendations provided by accreditation and standards bodies in clinical practice by sharing and making them available. Following phase 4, there will be an iterative and continuous process, starting at phase 2, throughout the project.The 4 phases described above will enable us to meet our 6 specific research objectives. The recommended data collection methodology aims to achieve deliverables based on qualitative and quantitative methods. This triangulation of methods is vital for an understanding of complex phenomena, and it allows data enhancements, questioning, monitoring, and verification . Some auThis objective was to measure the integration of recommendations in clinical practices. This objective will demonstrate through SEKMED the uptake of medical recommendations in clinical practices. This will enable us to determine if users really take ownership and integrate the recommendations into their daily work. To do so, we will export the SEKMED data in a Microsoft Excel file to produce descriptive statistics. The information provided by the data will allow us to measure the monthly progress of the following indicators:The number of recommendations used by each physician in clinical practice.Percentage of specific recommendations used at specific clinical situations,Percentage of physicians who are still using recommendations in clinical practice.This objective was to measure the before and after improvements in practices. The objective aims to compare improvements in practices, before and after the intervention, by using medical recommendations. We will be using the same approach as Specific Objective 1 for the data extraction, analysis, and processing.The following indicators will be measured:The number of new recommendations integrated into the platform that is used by physicians;Average and median time required for the integration of recommendations in a work environment.This objective was to measure the value attributed by physicians to recommendations. This objective will appraise the overall value (experience and satisfaction) attributed by physicians to recommendations provided by members of the community of practice, as well as accreditation and standards bodies in their field of practice. A total of 4 focus groups will be held during the project. The data collected with the first 2 specific objectives will be discussed at each focus group. This approach aims to foster reflective practices in providing an opportunity to step back and collectively review the experiences and the participants’ point of view on this practice and how it facilitates the KT process.Our approach must be flexible to produce the desired change and to adapt to the situation while allowing knowledge development, experience sharing, and ideas exchange to ultimately find solutions to common health care problems -61. The This objective was to measure the user’s platform experience. This objective will measure the user’s experience with the platform. The user experience is defined as an individual’s perception and response resulting from his or her use or the anticipated use of a system . This unThe research team will administer a questionnaire after each experimental period with the tool. We have chosen to analyze the data using the partial least squares structural equation modeling (PLS-SEM) to verify and refine the proposed theoretical models. PLS-SEM is a second generation multivariate statistical analysis method. Although first generation techniques usually rely on traditional research statistical methods such as regression and analysis of the variance, second generation techniques compensate the first generation techniques’ shortcomings by notably taking the errors in measurement into account. PLS is relevant for our project because it is used for exploratory assessment purposes such as the analysis of trends and the identification of relationships.This objective was to measure the educational benefits according to medical and external students. This objective consists of assessing the attitude and intent of external students and residents in family medicine toward the educational benefits of SEKMED. We will administer the same questionnaire used for Specific Objective 4. We will also organize focus groups to learn about the user’s experience in the adaptation and learning process. A total of 4 focus groups will be held during the project.Several studies have shown that IT promotes the adoption of a pedagogical approach which places the student or the learner at the center of the learning process. IT indeed provides the innovative means, not only for the dissemination of knowledge, but also for the exploration of learning strategies promoting competency development—access to information, real-time communication, and exchange with CoP. Many papers focus on experimentation with a Wiki, but fewer studies explain the rationale and the pedagogical foundations ,68. SeveThis objective was to measure the organizational benefits according to stakeholders. This objective will assess the attitude and intent of the RERD and the stakeholders toward the changes resulting from the use of the platform and the achievement of their specific objectives. In view of the specificity of this objective and the target audience, an interview guide will be developed and validated before its use. The interview guide will measure the attitude and intent of the RERD and the stakeholders toward the changes resulting from the use of SEKMED and the achievement of their specific organizational objectives.RERD will benefit from a tool facilitating the transfer, mobilization, and validation of knowledge gained within the organization while driving innovation. In support of all management bodies governing the clinical practice, they will be able to monitor medical and social interventions more rigorously in real time. Statistical functions and the ability to extract granular data actually make it possible to assess all medical acts, track changes, and implement best practices while also validating the application and the relevancy of the recommendations issued by the organization or the accreditation and standards bodies. In other words, all actions performed by caregivers become traceable and measurable.Stakeholders supporting the clinical practices are the Directorate of Professional Services, Directorate of Multidisciplinary Services, and the Nursing Directorate. As mentioned above, SEKMED has the ability to extract data at the granular level, which reduces the amount of time they require to complete specific tasks. As an example, the review of medical records, also known as audits, will be improved owing to the ability to track all actions performed by a health care professional. SEKMED also promotes the dissemination, among clinical practitioners, of clinical tools and best practices, thus simplifying their implementation and training needs. To conclude, these data allow the development of follow-up and performance indicators that will facilitate the monitoring activities performed by management bodies supporting the clinical practice.This project was funded in April 2018 by the Fonds de soutien à l’innovation en santé et en services sociaux for 24 months. Ethics approval has been attained, the study began in June 2018, the data collection will be complete at the end of December 2019, and the data analysis will start in winter 2020. Both major city hospitals in the Outaouais region, Quebec, Canada, have agreed to participate in the project.If results show preliminary efficacy and usability of the system, a large-scale implementation will be conducted.The expected benefits generated by this protocol on the improvement of care and service delivery are as follows:The use of better evidence and recommendations issued by the accreditation and standards bodies in clinical practice, by continuously sharing and making them available within the context of their implementation.To gain efficiencies in the dissemination, usage, and update of institutional protocols.Gaining efficiencies for clinical practitioners.The rationalization of the resource and budget use.The efficient harmonization of practices.The improvement of the teaching quality.The use of granular data to assess the quality of the act as well as administrative and research purposes.