ISSS608 2016-17 T1 Assign3 PRASONGTHANAKIT Kanokkorn

IDs with large communications: Park Official Accounts

To investigate communication pattern, it’s a good idea to create a ‘directed link table’. Since the data is large, it’s a good idea to start with JMP. We noticed 2 ID with large communication which are 1278894 and 839736.

These two IDs are possibly park’s official accounts:

• Both ID did not communicate with external party at all
• Both are the only two IDs could not found in movement data
• Both only communicates from ‘Entry Corridor’
• Both communicates ‘to’ and ‘from’ exactly same number of people
• Both did not communicated to each other

ID839736 made 60,812 communications with most of people visited the park (total 8,720 people communicated with this ID compared to total 11,374 visitors for 3 days or 9,427 visitors with communication). Looking closer at some of the sample ID data, we can see that this ID ‘answered’ to the communication it received from visitors. For example, ID100025 called ID839736 at 10:24 on Saturday. The park official account answered next minutes at 10:25. We could hypothesize that the ID is the park’s information or Q&A.

ID1278894 made 190,360 communications or average at 1 communications per second (assuming 16-hour park operations in 3 days) which is not possible if it’s not automated system. Although the IDs made many communications, the group that the ID communicates with is smaller group but frequent, indicated by darker shades of link in network map. Moreover, we could see large ‘blast’ of message from the ID1278894 at the specific time – every 5 minutes during 12.00-12.55, 14.00-14.55, 16.00-16.55, 18.00-18.55, and 20.00-20.55. Therefore, it could be hypothesized as ‘Cindysaurus Trivia Game’ where the questions were blastedand the result were announced.

Communication Patterns that are related to the crime

After we’ve discovered that ID839736 is the park’s official ID, we’d further investigate to discover the pattern related to the time.

1 Peak Time of the ID839736

There was a peak in communication patterns to and from the park’s official ID on Sunday around noon and another mini-peak around 14:40. This might suggest that there might be something wrong within the park and need park official’s attentions.

2 Location and when with high communication

When drilling down by plotting the communication ‘to’ official accounts between 10:40 to 12:00 (we only plot ‘to’ since we know the account with answered to the same address), we could see that these higher amounts of communication comes from those in Wet Land. This could be hypothesized as the visitors communicated to park officials when the crime happened.

3 IDs with high communication volume to ID839736

There were also some ID with unexpected high communication volume to ID839736. Also, when looking at ID839736 communication pattern, we can see that the most communication to and from information counter to each IDs was no more than 10 times in the day. However, when it comes to Sunday, we can see as much as 448 communications to and from park information counter and lots of ID which made more than 20 communications to the park information center.

ID1149884

Starting with ID1149884, the ID made only 20 external communication but 448 messages sent to park official. All of this happened only on Sunday. The first communication from this ID to external party was 11:38 on Sunday but there were lots of communication from this ID between 12:56-13:49 and 14:48-15:08 which is only from Wet Land.

ID1601276

This ID pattern is quite similar with previous ID by making 38 external communications and 387 communications to park official. Most communication made to park official from Wet Land are also from 12:00-12:53 and 14:52-15:21 from Wet Land.

ID1217381

This ID also made lots of communication to the park’s official from Wet Land but also communicated with external and ID1278894. Most communications from this ID is between 13:36 to 14:22 as well as shorter period of communication around noon.

Assumption regarding these IDs

These ID could be police or investigators coming to investigate the incident and report back to the park official.

4 Communication from those with weird movement patterns

From the movement data, we could calculate the time spent at each location for the entries and the movement from one point to another point. Technically, people should not move so far from one location to another because each movement should be recorded by the tracking device. Moreover, the people in the park could not be at two location at one time. Therefore, the time at each location shouldn’t be zero. There are some IDs which violates the tracking pattern above and the communication data of these ID were exported to be investigated. The interactive result was at https://public.tableau.com/views/movement_0/WierdMovement?:embed=y&:display_count=yes

ID1983765: No Communication Detected

• The movement of this ID was very strange. The ID could be in 2 places in a time. For example, he was at (76,36) and (31,34) simultaneously.
• Moreover, there was no communication detected from the ID which visited the park on

ID212756, ID237750, ID786972, ID1421406, ID1440397 and ID1484697: Saturday Teleporter

• These IDs could go teleport! They moved together as one group and disappear from inside the park (14,44) at 12:01:16 and appeared at the check-in (99,77) in the next time record 12:01:24.
• When looking at their communication pattern, these group closely communicates among themselves and official ID as well as external ID.

ID227221, ID392618, ID1336607, ID1483705, ID1722376, ID2063022: Sunday Teleporter

• Like the previous group, this group could also teleport!
• Instead of teleporting to check-in point, all IDs disappeared from (73,20) into the void at 14:55 on Sunday and reappeared again almost 6 hours later at (67,91) around 20:43
• The communication pattern of the group is closely linked with official ID and external communication as well.
• Although both Saturday teleporters and Sunday teleporters had different movements, they both closely linked with some people who communicated with both groups.

The park should further investigate both groups and ID1983765 to find out what happened with their tracking devices.

ID1975667: Malfunction Tracking

• The movement of the ID seemed to be normal except that some of the location were not tracked resulting in the ID moved from one place to another far coordinate with larger amount of time but still in the reasonable path
• The ID communication pattern seemed normal with communication to other IDs as well as official account and external party but seems to not closely linked with other weird movement IDs.

When the vandalism was discovered

The spike in communication pattern to the information desk around noon on Sunday suggest that the crime might happened just before noon on Sunday due to peaked communication to the information desk – asking what happened. This matched with the closure of attraction #32 Creighton Pavilion where the trophies of Scott were located around noon on Sunday and never reopened (the attraction typically closed during the show period and opened again shortly afterwards)

There is another high period around 14:40 which is where the show is expected. The timing of daily shows of Scotts were around 9:40 and 14:40 at the Grinosaurus Stage. There was pattern of many people gathering twice a day at the location except 14:40 on Sunday.

The interactive result of visitor pattern could be found at https://public.tableau.com/views/tableau-timeplot_0/comm?:embed=y&:display_count=yes Therefore, the crime was discovered just around 12:00 on Sunday.