VAST
Challenge 2015
Mini-Challenge 2
Team
Members:
Bruno Schneider, University of Konstanz, bruno.schneider@uni-konstanz.de PRIMARY
Carmela Acevedo, University of Konstanz, carmela.acevedo@uni-konstanz.de
Fabian Fischer, University of Konstanz, fabian.fischer@uni-konstanz.de
Juri Buchmueller, University of Konstanz, juri.buchmueller@uni-konstanz.de
Daniel Keim, University of Konstanz, daniel.keim@uni-konstanz.de
Student Team: YES
Did you use data from both mini-challenges? NO
Analytic
Tools Used:
Tableau.
Python/Javascript web application
developed by the team.
Command line text analysis tools.
Approximately how many hours were spent working on this submission in total?
100 hours
May we post your submission in the Visual Analytics Benchmark Repository after VAST Challenge 2015 is complete? YES
Video:
Questions
MC2.1 – Identify
those IDs that stand out for their large volumes of communication. For
each of these IDs
a.
Characterize the communication patterns you see.
b.
Based on these patterns, what do you hypothesize about these IDs?
Limit your
response to no more than 4 images and 300 words.
Both IDs 1278894 and 839736 were the top message senders with interesting and peculiar patterns. They both send messages only from the ‘Entry Corridor’ but receive messages sent from all over the park.
We have hypothesized that 1278894 is responsible for the Cindysaurus Trivia Game since it:
· Sends and receives messages from roughly one third of the visitors.
· It has a very regular pattern sending messages only on the even hours of the day after 12m only at exactly multiple of five minutes.
· Users answer after some minute(s) and they get another message, repeating this behavior until the hour is over.
We believe that interested users receive the questions from an automated system only during these periods of time and proceed to answer.
Our hypothesis for the 839736 ID is that it has to do with user communication with park/guest services. A high amount of messages are sent to this ID throughout the whole day without any clear pattern. It is clear that users send messages to this ID to which it replies after some minutes. Since this ID does not move from the Entry Corridor and no one person can constantly answer messages we believe this is related to the park administration. Another hint of this is that there are two peaks of communications on Sunday, when we think the crime was discovered, from the Wet Land (the location of the pavilion entrance). It seems that users were concerned and sent messages to the administration to address them.
Figure 1.1: messages sent from ALL visitors to ID 1278894, All days, All locations
Figure 1.2: messages sent from ID 1278894 to ALL, All days, Entry corridor
Figure 1.3: messages sent from ALL to ID 839736, Sunday, All locations
Figure 1.4: messages
from ID 839736 to ALL, Sunday, Entry corridor
MC2.2 – Describe
up to 10 communications patterns in the data. Characterize who is communicating,
with whom, when and where. If you have more than 10 patterns to report, please
prioritize those patterns that are most likely to relate to the crime.
Limit
your response to no more than 10 images and 1000 words.
We have focused on patterns that are highly suspicious to the crime which we think happened on the morning of Sunday and discovered near noon that same day.
2.1) On Sunday, we found a huge peak of communication activity from the IDs 58897 and 95112 to the ID 839736. The first two sent their messages from “Wet Land”. All the messages sent from the ID 839736 were from the “Entry Corridor”, as previously described. This event occurred between 12h and 12h30.
Figure 2.1: messages sent and received among selected group of IDs, All locations, Sunday, 11 –12h50
The thickest orange and green lines represent high communication activity among the described IDs. Each vertical bin corresponds to a time span of 5 minutes.
2.2) Also on Sunday, we found a huge peak of communication activity between the IDs 1149884 and 839736. The first one sent its messages from “Wet Land”. All the messages sent from the ID 839736 were from the “Entry Corridor”. This event occurred between 12h55 and 13h50.
Figure 2.2: messages sent and received among selected group of IDs, All locations, Sunday, 12h30 –14h35
The thickest orange and green lines represent high communication activity among the described IDs. Each vertical bin corresponds to a time span of 5 minutes.
2.3) Now, a second and smaller peak of communication activity between the IDs 1149884 and 839736. The first one sent its messages from “Wet Land”. All the messages sent from the ID 839736 were from the “Entry Corridor”. This event occurred between 14h45 and 15h10, on Sunday.
Figure 2.3: messages sent and received among selected group of IDs, All locations, Sunday, 13h55 –16h05
The thickest orange and green lines represent high communication activity among the described IDs. Each vertical bin corresponds to a time span of 5 minutes.
2.4) On Sunday, we found a huge peak of communication activity among selected IDs (image below, vertical axis). This event occurred between 11h25 and 12h, and messages were sent from “Wetland”.
Figure 2.4: messages sent and received among selected group of IDs, All locations, Sunday, 10h46 –12h51
The overplotted area of orange lines indicates high communication activity among the selected IDs. Each vertical bin corresponds to a time span of 5 minutes.
2.5) After filtering the IDs, we select a subgroup who sent and received messages only with a few distinct users. Then, we found individuals that communicate only in small groups.
Figure 2.5: Pixel-based visualization and the corresponding graph of individuals that communicates only with each other in small groups
2.6) Using our visualization of who communicated with whom (below), we found one suspected ID that did not communicate with any park visitor and sent messages only on Sunday. This ID only sent external messages and communicated with the ID 839736.
Figure 2.6: Identification of one ID that only sent external messages and communicated with the ID 839736
2.7) During 5 minutes on Sunday, there was a distinguishable peak of communication activity from the IDs 1405427, 1488117 and 1570913 to the ID 839736. The first three sent their messages from “Coaster Alley”. All the messages sent from the ID 839736 were from the “Entry Corridor”. This event occurred between 14h35 and 14h40.
Figure 2.7: messages sent and received among selected group of IDs, All locations, Sunday, 14h –15h25
The thickest blue and green lines represent high communication activity among the described IDs. Each vertical bin corresponds to a time span of 5 minutes.
2.8) On Sunday, we found a small peak of communication activity from the IDs 530079 and 1644823 to the ID 839736. The first two sent their messages from “Wet Land”. All the messages sent from the ID 839736 were from the “Entry Corridor”. This event occurred between 11h58 and 12h08.
Figure 2.8: messages sent and received among selected group of IDs, All locations, Sunday, 11h13 –12h58
The thickest blue and green lines represent high communication activity among the described IDs. Each vertical bin corresponds to a time span of 5 minutes.
2.9) “During the 3 days, we found regular and noticeable peaks of sent messages from “Coaster Alley”. Those peaks occurred twice a day, with a short duration of almost 2 minutes for each one. The first one occurred around 11h, and the second one around 16h. The exception was Sunday, because on this day there was only the first peak, around 11h. The image below shows one of those peaks, occurred on Saturday around 16h.
Figure 2.9: messages sent from All locations, Saturday, 15 –17h
Peak of sent messages around 16h, from Coaster Alley
2.10) On Sunday, there was a huge peak of external messages sent from Wet Land, on Sunday, around 12h. After that, we identified the persistence of external messages sent from a small group visitors, who continued to send external messages for a long period of time after the peak (until around 14h). Examples of IDs in this situation (by their numbers): 430595, 1149884, 1711922.
Figure 2.10: messages sent from Wet Land, Sunday, 12h –14h
Persistence of external messages sent from a few IDs after the peak of external messages on Sunday (left image, column “From”, vertical stripes in light blue)
MC2.3 – From
this data, can you hypothesize when the crime was discovered? Describe
your rationale.
Limit
your response to no more than 3 images and 300 words.
We hypothesize that the crime was discovered on Sunday around 11:30am. At this time a subset of park visitors sent an uncommonly large amount of messages among their own groups. To this a lot of messages to the ‘external’ ID at 11:45am follow and finally an increased communication with the ‘839736’ ID, all of this from the Wet Land, where the pavilion’s entrance is. We believe this has to do with visitors discovering the vandalism at the pavilion, as the news article references, writing to their friends and afterwards trying to obtain information from the park authorities.
Another related peak of messages sent to 839736 started around 14:30, from Coaster Alley containing some of the same people involved in the first increase of messages. This peak could be related to visitors’ curiosity being spiked by the pavilion being closed and a high police density around it since it is in the Coaster Alley area and visitors could have been investigating around there.
Figure 3.1: Same group of people receiving messages continuously (coloured stripes, right image), followed by a peak of external messages (dark blue, left image) and, finally, the peak of messages to the ID 839736 (light blue, left image)
Figure 3.2: Messages sent from Coater Alley
and Wet Land to the ID 839736 (highlighted in blue), Sunday, all day
Peaks around 12 and 15h
Figure 3.3: Messages sent from All locations to the ID 839736, Sunday, 11-17h
Part of the users that were in Wet Land around 12h moved to Coaster Alley,
around 15h (highlighted in red)