Entry Name: "AU-Nielsen-MC2"
VAST
Challenge 2015
Mini-Challenge 2
Team Members:
Matthias Nielsen, Aarhus University, Denmark, matthiasnielsen@cs.au.dk PRIMARY
Adil Yalcin, University of Maryland, USA, yalcin@umd.edu
Student Team: YES
Did you use data from both mini-challenges? YES
Analytic Tools Used:
Tableau
Approximately how many hours were spent
working on this submission in total?
12 hours
May we post your submission in the
Visual Analytics Benchmark Repository after VAST Challenge 2015 is complete? YES
Video:
http://matthias.rocks/vast/mc2/au-nielsen-mc2.wmv
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Questions
MC2.1 – Identify those IDs that stand out for their large volumes of communication. For each of these IDs
a. Characterize the communication patterns you see.
We have identified two IDs - 839736 and 1278894 which stand out from the rest of the IDs because the amounts of messages they send, they send messages from one location, and their transmission frequency.
The above picture shows IDs 839736 and 1278894 hourly transmission of messages. Horizontally, the picture divides messages sent into the day of transmission - Friday 6th, Saturday 7th, and Sunday 8th.
The picture shows that the two IDs are stationary (both exclusively transmits messages from the Entry Corridor) and they both send large amounts of messages. Furthermore, 839726 appears to transmit comparatively more messages on Sunday.
This we decided to look closer at the hourly transmission patterns of these two IDs:
This reveals that the transmission patterns of 839726 and 1278894 differ greatly. 839736's transmission pattern varies little during Friday and Saturday, starting at 8.00 in the morning, ending before midnight, with small peaks during the afternoon. This pattern is abruptly broken at hour 12 on Sunday, when it transmits unusual large amounts of messages.
1278894 has very steady message patterns - it transmits a large amount of messages bi-hourly five times per day. By comparing the bi-hourly amount of messages sent by 1278894 with the number of visitors to the park on that day (right barchart), it sends around two messages per visitor.
b. Based on these patterns, what do you hypothesize about these IDs?
We hypothesize that 1278894 is a transmitter that regularly sends information messages to visitors to the park. This is because the transmissions occur with a set bi-hourly frequency from 12 to 20, likely the main opening hours. We hypothesize that 839736 is a transmitter that sends alerts or emergency notifications to visitors. Generally 839736 remains relatively steady in numbers of messages transmitted, however, on Sunday after 12 it suddenly sends 23654 messages within an hour, indicating something extraordinary has happened.
MC2.2 – Describe up to 10 communications patterns in the data. Characterize who is communicating, with whom, when and where. If you have more than 10 patterns to report, please prioritize those patterns that are most likely to relate to the crime.
Note that we have excluded IDs 839736 and 1278894 from the following charts unless otherwise noted. This is because they have been assessed as being stationary senders, and we mainly focus on visitor communication in this section.
MC2.2.1 - Wetland area is most used for sending messages.
The above picture shows two barcharts: The left barchart shows how many unique ID have sent messages from respective areas of the park, the right barchart show how many sent originates from the respective areas of the park. Interestingly, this shows that even though visitors generally send messages from all over the park, they by far send the most messages from the Wet Land area. The park could consider scaling its wireless communication infrastructure accordingy.
MC2.2.2 - General hourly communication pattern
The above picture shows the hourly total messages sent over the entire weekend by all IDs except 839736 and 1278894. Overall more messages are sent on Saturday and Sunday, but Sunday has a peculiar spike in transmissions at hour 11 on Sunday. It might not be more than the hourly spikes of Saturday, but it stands out when compared to the other hours on Sunday.
MC2.2.3 - General hourly messages sent to external
If we filter all communications to messages sent to external, this spike at Sunday at hour becomes very protuded. Something of interest must have happened there, so lets zoom in on that time period:
MC2.2.4 - Minutely messages sent on Sunday from 11.00 to 12.59
This barchart shows, very interestingly, that for 15 minutes from 11.45 to 11.59 there is an extraordinary spike in messages sent to external parties. The activity starts abruptly at 11.45 and ends evenly abruptly after 11.59. We speculate that this is related to the crime, and that this spike is started by visitors telling external recipients about the crime and ended by park authorities by limiting these visitors ability to communicate with external recipients. Perhaps in an attempt to (fruitlessly) limit spread of the news of the theft.
MC2.2.5 - ID 839736 - sharp rise in messages sent after 11.59
Returning briefly to ID 839736, we can see that this ID's minutely messages sent rises abruptly after 11.59. This is the exact same time that the previously described spike in messages sent by visitors to external abruptly stops. This indicates that the park administration becomes aware of the theft just after 11.59, after which it stops messages to external by a select set of IDs (perhaps to stop news of theft to spread), and takes over alerting itself.
MC2.2.6 - Location of the 289 heavy transmitters
Of the visitors sending messages to external in the 15 minute time period of 11.45 to 11.59, 289 visitors send six messages or more to external in this period.
This picture plots the locations of these 289 IDs, who transmit heavily to external recipients in the timeperiod of 11.45 to 11.59. Although they are at many areas in the park in this period, there is a clear tendency that they, as a group, have been amassed at or near the pavillion where the theft took place.
MC2.2.7 - Overview of transmissions between the 289 heavy transmitters
The above picture is for overview of communications among the 289 visitors that are heavily senders to external recipients. The same 289 IDs are plotted (unintelligibly) both horizontally and vertically. One interesting pattern that emerges from this overview, is that a subset of these 289 IDs have similar communication patterns. We have decided to look closer at the protruding vertical "lines", of which there are 34 (highlighted in the above picture).
MC2.2.8 - Communication pattern between 34 Visitors
When isolating the previously selected 32 visitors, it is clear to see that they form either a group or a part of a group, because each of these IDs have communicated with all other members in this selection. Location at th
MC2.2.9 - Movement and check-in pattern of the group of 34
We can use the movement data to verify whether this group of people behaves as a group. If we isolate this groups
MC2.2.10 - Location of the group of 34 before noon and immediately after noon.
If we isolate and look closer at the two movement sequences of this group at the groups' movements bordering the events at 12.00, we can see that the group arrives at the pavillion at around 09.45 after having entered through the northern entrance (light green).
Even though they never check in at the pavillion, they remain there until almost exactly 12.00 - when transmission of messages to external abruptly drops and messages sent by ID 839736 abruptly increases many fold. After 12.00 (dark green) they appear to go shopping at Legend of Legenodons.
We cannot determine whether this group of visitors has anything to do with the actual theft. However, it seems sure to assess that they are a well-knit group, which were at the pavillion around when an event happened that triggered heavy messaging to external recipients by visitors as well as a heavy increase in messages sent by ID 839736, which we have assessed to be an official park messaging ID.
MC2.3 – From this data, can you hypothesize when
the crime was discovered? Describe your
rationale.
Why hypothesize that the theft took place around between 11.45 and 12.00 on Sunday the 8th. We have aligned the figures used in MC2.2.4 and MC2.2.5. The top part shows the spike in messages sent from visitors to external, meaning that something must have been going on at around that time - this could be a rumor of theft is spreading and visitors are telling external recipients about it.
Furthermore, in the bottom part of the above picture we see that the abnormal large spike in messages sent by ID 839736 occurs immediately after messages sent to external stops as abruptly as it started.
We do not think that the messages sent by visitors to external is the result of an event taking place at the park, because this is the only time during the weekend there is such a peak in messages to external, as can be seen in the following picture:
Even though that the group of 34 (elaborated previously in MC2.2.7 - MC2.2.10) is present at the pavilion at the time we hypothesize that the theft has taken place (see MC2.2.10), we do not suspect that this group is directly involved in the theft.
This is because the group seemingly enjoys a long day at park after 12.00 (when we hypothesize that the theft has taken place) - immediately after they appear to go shopping at Legend of Legenodons and does not leave the park until after 23.00 (see MC2.2.9).
But because they were there at the time, they are likely relevant to question for an investigation into solving the case of the theft.