Entry Name: "CRPGL-Médoc-MC3"

VAST Challenge 2014
Mini-Challenge 3

Team Members:

Nicolas Médoc, Centre de Recherche Public – Gabriel Lippmann, medoc@lippmann.lu
Mickaël Stefas, Centre de Recherche Public – Gabriel Lippmann, stefas@lippmann.lu

Student Team: NO

Team Number: 36

Streaming User ID: medoc@lippmann.lu

Analytic Tools Used:

Stanford CoreNLP, developed by The Stanford Natural Language Processing Group, University of Stanford.

Esper developed by EsperTech.

The Apache Tomcat server, developed by the Apache Software Foundation.

AngularJS maintained by Google and community.

Google Maps Javascript API developed by Google.

D3.js developed by Mike Bostock.

D3's StackedGraph Visualization initially developed by Mike Bostock and adapted for the challenge.

D3's Focus + Context initially developed by Mike Bostock and adapted for the challenge.

Approximately how many hours were spent working on this submission in total?

400 hours

May we post your submission in the Visual Analytics Benchmark Repository after VAST Challenge 2014 is complete?

YES

Video:

Video

Questions

Please note - this challenge contains a question that is time-dependent. Within 3 hours of starting the final data stream, send an email to VASTChal2014MC3@vacommunity.org containing your answer to question MC3.1. Please include a copy of your answer to MC3.1 in your final answer form also. Your answers to MC3.2 and MC3.3, along with your video, are due July 8.

The responses to these questions should be incrementally built, as you (the contestant) acquire information from each streaming data segment you receive. Your submission will answer these questions in consideration of all of the streaming data segments.

MC3.1 - Within 3 hours after start the final data stream, send an email to VASTChal2014MC3@vacommunity.org containing:

a. An image showing the streaming data in your visual analytics tool. In this image, identify an event of interest that you intend to investigate further.

b. The content of the final message in the data stream

In the third streaming segment we discovered the following end of the “Black Van” story that we will investigate further in the MC3.2 and MC 3.3 response.

At the end of the second segment of the stream, a black van that exchanged guns shots with police of Abila, seemed to have hostages. In the third stream, we learn that 2 hostages, one woman and one man, were in the van. The terrorists are arrested and the hostages are successfully set free. This is easily visible in the screenshot took from our tool during the third segment of stream.

Our tool is composed of two parts that can be visualized simultaneously on a dual-monitor setting. The first part allows to visualize streaming messages from MicroBlogs through two dynamic ThemeRivers. The upper river is dedicated to historical analysis. The lower river provides situation awareness in real time. The second part shows the map of Abila City in which the ControlCenter messages (circle shapes) and the MicroBlog messages with informed coordinates (square shapes) are represented. The bar chart at the top shows the temporal distribution of messages. When we select a time range in the bar chart all the shapes associated to messages covered by this period are highlighted with a thick border.

Figure 0.

The Historical Theme River (HTR) covers the period from the beginning until the current time. The Current Theme River (CTR) covers the last 5 minutes of the stream. In both, one layer represents the number of messages written by one MicroBlog user. In the CTR, we select user "megaMan" from the list of active users around 9:15 PM (see the peak of activitity at 21:15 in the following figure) and display his messages, where we can read the end of the "Black Van" story. In the Map visualization, we can read another version of the story written by user "truccotrucco", a user that we followed from the beginning of the "Black Van" story. This user is represented by the biggest square on the left.

The last message is the following: "RT @KronosStar There has been an explosion from inside the apartment building. Several people are down. #KronosStar #DancingDolphinFire #AFDHeroes""

MC 3.2 - Describe the timeline of up to five major events that you discover in the streaming data. This timeline should include information from all three segments of the data stream if needed. Use specific microblog records and call center data to support your description, but do not simply mimic back the data stream. Provide a concise description of important participants, locations and durations. Focus your response on the events themselves, rather than on the individuals reporting the events. Please limit your answer to no more than ten images and 1500 words.

Our tools allow the user to explore the timeline of message content at different time granularities and for different aspects. Indeed, as messages stream in, the tool computes and maintains frequency matrices, for different aspects of the messages in each time granule, for example the number of times each author appears per minute. Instead of author frequencies, the tool could also count the frequency of hashtags or named entities extracted by the Stanford CoreNLP library (persons, locations, organizations). In our ThemeRiver visualization, the analyst can choose any of these aspects to analyze. For the response to MC3.2 and MC3.3, we have buit the screenshot with our tools without a stream connection to have the messages of all three segments available. For this reason, we have deactivated the Current Theme River. However the video demonstrates the live behavior of the tool by connecting to the second segment of the stream with the Current ThemeRiver component activated.

Event 1: the rally in the city park

Figure 1.

In the first segment of the stream, the main event is the rally organized by the POK in the Abila City Park. To discover what is happening during this rally the more significant aspect to use is the Person mentioned in the messages, extracted with NER. Indeed, each peak corresponds to a new sequence of events in the park. By clicking on one person (shown as a layer in the river), the messages that mention him/her are displayed.

We discover that Sylvia Marek is the leader of POK, she starts with an introductory speech around 17:17, followed by Lucio Jakab around 17:26. Then the music band Viktor-E is playing. And finally the two last peaks correspond to the speech of Prof. Lorenzo Di Steffano and Dr Audrey McConell Newman. By analyzing the author aspect of messages, we can discover the identity of speakers during this time. In the map visualization, we can locate the Park with the highlighted square shapes at the bottom left that corresponds to Microblog users (truthforcadau and truccotrucco) who talk about the POK Rally. We learn that the N. Parla Street is closed (see the blue line in the street), and that a lot of cops are present but they don't do anything.

Event 2: the building on fire

Figure 2.1.

In Figure 2.1, we see a peak in the bottom ThemeRiver starting around 18:40. After zooming on this period, we can explore in detail the layers corresponding to the users. It appears that user "HomelandIlluminations" has an increasing thickness. By clicking on him/her, the messages reveal that the building named "Dancing Dolphin" is on fire. In the map visualization, we can locate this event reported by the Fire Departement (a highlighted pink circle on the right) and by a MicroBlog user around the same position (highlighted blue square).

Event 3: the black van pursuit

Figure 3.1.

In the map visualization (picture 3.1), the MicroBlog user "brewvebeenserved" is highlighted around 19:20 (underneath the tooltip "currently displayed"). This user reports that a "crazy driver hits a guy on a bike". At 19:25, we find in the Theme River dubious messages writen by "trollingsnark": "TADA! Stage 3..." and "Next round of deportation beginning". Is this Microblog user the manager of the terrorist operations? We will analyze that further in the MC3.3 question.

Figure 3.2.

Ten minutes later (picture 3.2), another user is highlighted in the map visualization, "sofitees". He reports that a crazy driver is coming into the gelatogalore parking, followed by gun shots. At the same time, if we explore the themeriver layer, user KronoStar reports that the Abila police are in pursuit of an eratic driver. He also writes that the police have cornered the driver with shot fired. If we go back to the map visualization, we can replay and visualize the pursuit. By dragging the selected period in the timeline from 19:20 to 19:40, the ControlCenter messages are successively highlighted. We can hence distinguish the path took by the "crazy driver".

Event 4: the restaurant parking

Figure 4.1.

In Figure 4.1, the selected period starts at the highest level of the peak, when the "Black Van" arrives in the Gelatogalore parking and finishes at the end of second segment of the stream, when we learn that the Van contains the hostages. By exploring the ThemeRiver, we discover one of the main users that relates the scene, "megaMan". After exploring highlighted shapes in the map, we identify another user, "truccotrucco", that is in the Gelatogalore restaurant. By exploring the messages of these two contributors we learn that the crazy man has shot a cup.

Figure 4.2.

In Figure 4.2, we learn around 20:00 by user truccotrucco in the map visualization that he can't hear "the guy in the van that yelling at cops". In the ThemeRiver visualization, by switching the Y axis to the Hashtag aspect, we discover the term "hostage". The corresponding message is written by Sara Nespola. She reports that the guy said "he has a hostage".

Event 5: the hostage liberation

Figure 5.1.

In Figure 5.1, the selected period in the timeline covers the period from 20:00 to 20:40. By analyzing alternately the highlighted shapes in the map visualization and the different aspects of messages, we learn that the Police and the terrorists are in negociation phase. The main user that reports this phase is megaMan (see the messages selected from the ThemeRiver). During this period, we learn in the map visualization that user sofitees is evacuated by the cops, but we learn nothing about the negotiations.

Figure 5.2.

In Figure 5.2, we cover the period from 21:00 to 21:30. By exploring the Hashtags, "APD" (Abila Police Departement) seems to take importance. The deactivated blue messages correspond to re-tweet messages and we consider that we can ignore them. We have observed that lots of MicroBlog users produce only re-tweet messages. Through the four original messages displayed, we finally learn how this story ends: two terrorists, one male and one female have surrendered to the police and two female hostages have been rescued.

MC 3.3 – Select one of your five major events from question MC 3.2 that you consider to be most likely to provide additional clues to the investigation of the GASTech disappearances. Describe the roles of the participants. Describe how other events you identified in MC3.2 may have influenced your selected event. Provide a hypothesis and evidence as to whom you suspect as being directly involved in the GAStech disappearances, either as perpetrators or victims. Please limit your response to no more than five images and 500 words.

In our response to MC3.2, we have reported a dubious user, "trollingsnark", who seems to be the coordinator of the terrorist operations. We will now try to show the evidence of our hypothesis by establishing a link between certain messages of this user and the different sequences of events.

Figure 6.1.

Firstly, we discovered user "trollingsnark" when the segment two was treaming. In Figure 6.1, the Current Theme River displays the authors that are writing during the five minutes before 18:37. In this view, we can configure an option ("New layers" checkbox) that highlights the items of the selected aspect (e.g. new authors in this example) that don't exists in the history. Therefore when user trollingsnark writes his first message, his layer in the Current Theme River is highlighted. This is a mean to support analyst in achieving situation awareness. Hence, by clicking on the user, we found his first message to be quite ironic. We have noted other ironic users such as chocnibs, footfingers or FriendsofKrono, but we will see that trollingsnark is peculiar.

Figure 6.2.

In the Historical Theme River of the three segments (Figure 6.2), by searching and filtering the user list with the name of the user of interest, we visualize his activity in a global overview. So we directly conclude that his activity starts around 18:30 and stops around 19:30. Furthermore we are alerted by the third message that is really ironic.

Figure 6.3.

After zooming around the peak concerning the "Dancing Dolphin" Building that is on fire (Figure 6.3), we see that the activity of this user started ten minutes before the fire broke. Another message that alerts us is the fifth, which appears on screen appear at 18:56:02: "There we go. False flag operation entering stage 2". This seems to mean that the fire may be a diversion. This message arrives five minutes after the "POLICE UNIT DISPATCHED" message appear in CenterControl (highlighted pink circle in the map visualization).

Figure 6.4.

Finally, the last evidence consists of the messages appearing during the last twenty minutes before the crazy driver hits the bike rider (Figure 6.4). At 19:20, the last stage is launched by this message "Watch for stage 3. Stage 3 everybody !". In the map visualization, we see that the crazy driver is seen the first time at 19:20 by brewvebeenserved.

Figure 6.5.