|
|
10 Communication Patterns
In this section, we aim to ask questions and interpret communication patterns seen in the data records, with an eye kept on looking out for clues related to the crime as well.
General Approach in using Gephi to create network graphs
Gephi (https://gephi.org/) is used to create the network graphs seen on this page. The following is the general steps used in creating the network graph (in some cases there might be variations in how the graphs are created):
- Prepare the data: Filter data as necessary, and save an "Edge" and "Node" file. For the "Node File", to save a distinct list of Nodes present in the "Source" and "Target" columns of the "Edge" file
- Import the 2 files into Gephi and experiment with layouts. Yifan Hu and ForceAtlas 2 are some of the great layouts that can be used to quickly separate the nodes first. Most of the time, Force Atlas is used as the final layout with some minor manual adjustments for presentation
- For Nodes - Use an appropriate attribute to apply sizes on the nodes, for example out-degree. Also, run the Modularity statistic and colour the nodes with the Modularity classes generated. Turn on the label text (the ID) to display on the node.
- For Edges - Colour the edges with location if needed for analysis.
Q: Are there other unusual communications activity going on in the park across the three days?
Observation 1: In the chart below, you can notice that there is a spike of communications to external parties on Sunday close to 12pm. This seems to be almost the same pattern observed with communications sent to ID 839736 at around 12pm as well. This could indicate something of interest to the park visitors that they can't help but share with their family and friends.
Q: What does the network graph tells us when a spike of messages was sent on Sunday 8 June at Lunchtime?
From the previous observations, the time period of 11.57am till 12.03pm on Sunday reveals a spike of messages sent to external and ID 839736. Furthermore, the spike appeared in the Wet Land area of the park. A data extract was performed for the above mentioned time period and location to review the communications patterns during these few crucial minutes. In the network graph below, Force Atlas layout was used as it provides clearer visuals among other layouts such as Yifan Hu and Fruchterman Reingold. Modularity statistic was run to allow detect of communities in the data, and afterwards colours applied to the graph. Out-degree attribute was used to adjust the size of the nodes. There are a few observations we can see here:
- Observation 2: The largest community on the lower left (shaded blue) are park visitors who have sent messages to ID 839736, which in an earlier section we suggest that it is a park information service.
- Observation 3: Park visitors tend to travel in groups.Furthermore, there appears to be also not just group leaders but sub group leaders, especially for large groups like the ones below. This is because the sub group leaders appear to also take on the communications responsibilities to other group members, but on a lesser basis than the overall group leader.
Q: What does the network graph tells us when a spike of messages was sent on Sunday 8 June from 2.40pm?
In the observations for ID 839736, we noticed a burst of messages sent to ID 839736 from 2.40pm onwards. A network graph was generated. To allow discovery, communications to and from ID 1278894 was excluded. We took a time period of 2.40-2.45pm to generate the graph, with node size determined by the out-degrees. In addition, the edges was coloured to show which location the messages was sent at.
- Observation 4: Through the overview of the network graph, we can notice that most of the park visitors were connected to what's happening at that period of time. Only some park visitors at the circumference of the network diagram appears to be in their own group oblivious to whatever is happening.
- Observation 5: We can also notice that there are some group leaders that has sent message to their members, whom in turn, sent messages to ID 839736. Perhaps the group members wanted to validate the information that the group leader has sent them with the park information service line. The group leaders predominantly appear to be sending the messages from Wet Land and Coaster Alley, which happened to be close to the Pavilion and Stage. Messages from ID 839736 are then sent via the Entry Corridor. Examples of such groups are in the image below.
Q: Are there patterns in the network graph for park visitors who were in the park for all 3 days?
By intersecting the source of communications across 3 days, a list of IDs was retrieved (excluding "External", 1278894 and 839736) was extracted. Each day was then filtered against this list by the source, and a network graph was plotted for each day. ForceAtlas 2 layout provided easy to understand communities. Degree attribute was used as a simple measure to assess the number of connections the visitors have with each other. The below image shows the progression of the networks across the three days:
 - Observation 6: Majority of the park visitors are connected to each other in one way or another. Large groups could be seen on Friday. These could be tour groups or family and friends that have came together to the park and taking advantage of the 3-day passes that provides great savings. There is a also a large group of visitors in the middle of the network graph, which appears like smaller groups or individuals, who also were able to interact with the larger groups from time to time. Interestingly, larger groups tend to communicate less with other similar sized groups, as seen in the number of edges compared to the edges with the smaller groups and individuals.
- Observation 7: On Saturday and Sunday, most of the larger groups still remained intact, however the communications patterns are starting to change. From 7 distinct large groups on Friday, it became 6 on the last 2 days. This could indicate significant communications is happening within 1 group and the smaller groups/individuals, forming into possibly new groups in the process.
Q: Were there any unusual communications patterns in the morning and evening?
On Friday and Sunday mornings, there are communications sent from places within the park even before the ID have went through the entry corridor. On Friday it was ID 439105, and Sunday it was 1401601. This could mean these visitors entered the park through some illegal or suspicious means. An extraction of data for Friday and Sunday was done for the respective ID, as long they are the sender or receiver of the communications. A network graph was then plotted to observe this phenomenon. Out-degree was used for adjusting node sizes, while Force Atlas provided a clear view of the network.
- Observation 8: For ID 439105 on Friday, a check with the movement data reveals that the first check-in for this ID was directly at Kiddie Land. Its main communications was with IDs 1464748, 1696241, 580064, and 1053224. Coincidentally, these communications was performed all at Wet Land. It will be worth watching out for these IDs, although 439105 also chatted with many other visitors. Perhaps this might not be the suspect, who will probably try to minimise or eliminate communications to prevent suspicions.
- Observation 9: For ID 1401601 on Sunday, a check with the movement data reveals that the first check-in for this ID was directly at Kiddie Land as well. the person has few communications, of which the most significant was 1434060 (ignoring the ID 839736 and 1278894 which was are speculated to be park services and app features). This could signify this person came into the park with just one partner. It's worth to watch out as well for this ID in case it's one of the suspects for the crime.
On Saturday evening, there was 2 communications that strangely happened at Kiddie Land at just after 11.30pm, where most other visitors have already left the park at the end of the day. ID 972171 sent a message to "External" at 11:31:24 PM while ID 744841 sent a message to ID 839736 at 11:32:54PM, which we hypothesize to be the park information and service line. A filter was done to check who has these IDs communicated with or received messages from.
- Observation 10:: ID 744841 appears to be a group leader, communicating with many group members, including 972171. There is no specific area where the communications happened. We speculate that ID 972171 could be lost, and have sent a message to some external party, while ID 744841 asked the park service for help a minute later to locate ID 972171.
Next: When was the vandalism discovered?
|
Episode VA3: "A Crime-Filled Weekend at DinoFun World"
