ISSS608 2016-17 T1 Assign3 Linda Teo Kwee Ang Responses
|
|
|
|
|
|
RESPONSE
Question 1: Using distribution of the From and To columns, it was noted that the following IDs were exceptionally high over all 3 days:
- 1278894 – This ID would only communicate whilst at Entry Corridor, and had regular intervals between the communications – it would make outgoing communication from 12pm onwards, at every 15-minute interval, until 1pm. This pattern repeated from 2pm to 3pm, 4pm to 5pm, 6pm to 7pm, and 8pm to 9pm. On 8 Jun 2014, the volume of outgoing communication was at least 3000 every 15 minutes. The communication sequence showed that 1278894 would send out messages, then the visitors respond. As the Cindysaurus Trivia Game was ongoing, hence there is a high likelihood that ID 1278894 is an administrator for this game. 1278894 would need to send out at least 3 messages per second, hence is likely to be an automatic-sending machine.
- 839736 – Location was always at Entry Corridor and would receive incoming communications first, then 839736 would follow-up with an outgoing communication back to the sender. Thus 839736 can well be a channel for assistance or feedback for the visitors. 839739 was noted to be very prompt in replies, with the capability of responding within the next 5 minutes. It is not clear whether 839736 may be human or machine. If 839736 is not machine, then it is possibly involving a call centre with a number of phone operators.
- ’’External’’ – this is the record when visitors text to an external party. The number of communication data for external records ranged from 0 to 10 per visitor per day. However, on 8 Jun (Sun) between 11am and 12pm, the number of external communications surged, and the locations of visitors who made the external communications were mostly at Wet Land. It is hence possible that the visitors were spreading the news about the crime to external parties, because the crime was likely to have taken place at Creighton Pavilion which is in Wet Land. This also shows the crime is likely to be between 11am and 12pm.
Question 2: The following communication patterns were noted:
- (1) – Spike in communications from 11:30am onwards
There was an observable spike in the communications on 8 Jun 2014 (Sun) from 11:30am onwards, for senders located in Wet Land. From previous analysis, it is likely that these communications were from visitors who got to know about the vandalism at Creighton Pavilion, and disseminated the information outwards to other visitors. The communication peaked at around 11:40am, indicating that this was probably the timing where the human traffic at Creighton Pavilion was highest, then fell. The communications picked up again at 12pm. It was noted that Creighton Pavilion was closed from public from 12pm onwards (maybe for investigation purposes), hence this second spate is likely to be a fresh piece of broadcast, on the closure of Creighton Pavilion.
- (2) – Closely-knitted group
Based on the intense communication from s/n 1 above, a special group was identified – this group is described as “closely knitted” because every member of this group would communicate with every other member. As such, they were very high in terms of Betweenness Centrality, with nodes coloured from orange to red. Only three members of this group communicated with external. The following network graph is viewed using a Gephi export to Sigma.js.
Since this group was of interest, its communication for the entire day was specifically sieved out from JMP. This group only visited the park on 8 Jun 2014 (Sun). Throughout the day they were only communicating within their group, other than with 1278894, 839736 and external. From the network graph, it was noted that the group members were mostly at Wetland from 9:40am onwards. In fact, from the movement records, they were outside Creighton Pavilion from 9:44am to 12pm. Their level of communication within the group intensified for the period 11am to 12pm. It is likely that this group was amongst the first to discover the vandalism, since they were already at the crime scene, however it is not known why they needed to communicate with one another then they were actually together. After 12pm, the group then proceeded to other parts of the park.
https://www.youtube.com/watch?v=0HeQCrbeKDY
https://public.tableau.com/profile/lindateo#!/vizhome/ClosedGroup/Dashboard1
- (3) – Suspicious visitor 1502920 and gang
3 visitors, 1502920, 416790 and 461004 had checked-into Creighton Pavilion at 9:01am, and remained inside the Pavilion until 11:30am. This is extremely suspicious as the Pavilion was supposed to be closed from public between 9:30am and 11:30am. As the vandalism was likely to be committed inside the Pavilion during this period, these 3 visitors could potentially be the perpetrators. These 3 had only visited the park on 6 Jun 2014 (Sun), and had only communicated with 4 other visitors namely 1187909, 1350546, 1123214 and 1000279, other than 839736 and external. There was no special spike in communication after 11:30am, only more calls made to 839736 and external.
Using a Sankey Diagram with time filters, we are able to see the direction of the communication, and counts between the visitors. The right-side up labels showed communication from the left node to right, while upside-down labels showed communication from the right node to left. In the period between 11:35am to 12:00pm, it was noted that 1502920, 416790 and 461004 mainly sent many messages to external, ranging from 11 to 16 counts. They were receiving incoming communications from 1350546, 1123214 and 1000279, and 461004 had one outgoing communication to 1123214.
https://public.tableau.com/profile/lindateo#!/vizhome/DinoFunWorld_1502920/1502920Dashboard
- (4) – Restroom group
The group of 6 visitors (227221, 392618, 1336607, 1483705, 1722376 and 2063022) who spent more than 5 hours per person in the Tyrannosaurus Rest on 8 Jun 2014 (Sun), had ceased communications from 2:57pm onwards. They then stayed for more than 5 hours at Tyrannosaurus Rest, before exiting the park. From their communications data for the entire day, it was noted that they were in contact with various different visitors – from the network graph below, they were identified from their red-coloured node due to high Closeness Centrality. There were separate clusters branching out from each of them. There were 4 of them who tended to be more connected. Only one of them, 1483705, was playing the Cindysaurus Trivia Game. There were also common contacts within this group, like 414680, 560023, 1095309, etc.
From analysis of their network graph, it was also noted another visitor, 1095309 was also in their company. This visitor had also ceased communications after 2:55pm, but this visitor did not exit the park like what the rest did. One possible hypothesis for these observations, could be that this group of 7 visitors (6+1) somehow felt unwell while at Grinosaurus Stage. They had spent about 19 to 20 seconds at Grinosaurus Stage, then adjourned to Tyrannosaurus Rest. Because they were undergoing treatment, they were not able to use their handphone, thus there were no communication data for the whole period. Subsequently 6 of them got better and left the park. The last one, 1095309 somehow did not have any exit records, maybe because his condition was more serious and was conveyed to hospital.
https://public.tableau.com/profile/lindateo#!/vizhome/DinoFunWorld_restroom/RestroomDashboard2
- (5) – Beer group
On 6 Jun 2014 (Fri), 5 visitors (103006, 1412235, 1937834, 313073 and 657863) spent almost 5 hours at point 21,33 which is Alvarez Beer Garden. One of them even stayed overnight at the park. This group had entered the park together via Main Entrance at 4:11pm, and went straight to Chensational Sweets. After spending about 35 minutes there, they proceeded to Alvarez Beer Garden, reaching at about 5:04pm. They remained at Beer Garden until 9:50pm, then moved towards Scholtz Express and stayed for about 27 minutes there. After that 4 of them left via Main Entrance. The 5th visitor, 657863, appeared to remain at Scholtz Express overnight, probably drunk and only woke up at about 8am on 7 Jun (Sat), and swiftly left the park via Main Entrance.
They was found to be communicating with external, and 2 more IDs namely 839736 and 1278894. These 2 IDs, based on earlier hypotheses, were likely to be assistance desk and Trivial Game administrator respectively. The following were noted: • IDs 1937834 and 1412235 were the central persons in the group. Both were also actively playing the Cindysaurus Trivia Game. • Amongst the group of 5, some were still communicating to one another when they were together in the Beer Garden. • Their communications ended when they moved out of Beer Garden to go to Scholtz Express.
https://public.tableau.com/profile/lindateo#!/vizhome/DinoFunWorld-Beer/BeerDashboard
Question 3: It is likely that the vandalism was discovered between 11am and 12pm. Given that Creighton Pavilion is the likely location of the vandalism, and that it was closed between 9:30am to 11:30am.
From the above chart, it is noted that that both check-ins and movement spiked at Creighton Pavilion from 11:30am onwards. It is likely that the Pavilion was closed at 12pm for investigations, as there were no more check-ins after 12pm. This can be verified by comparing the opening hours of the Pavilion on the previous day, 7 Jun 2014 (Sat) – from the graph below it can be seen that the Creighton Pavilion was supposed to be opened from 11:30am to 2:30pm, then closed while Scott Jone’s show is held at Grinosaurus Stage, and opened again at 4:30pm.
Furthermore, it was noted that there was a sudden spike in the level of communications at Wet Land between 11am and 12pm, it is likely that the vandalism case attracted a flurry of discussion, and visitors quickly spread the message to other visitors in the park and to external parties, either to spread the news or to caution other visitors not to come to the pavilion.
Also, given that visitor ID 1983765 is believed to be the perpetrator for this crime, he should be fleeing the scene as soon as possible – he left at 11:47am, hence the discovery should be within this time period. It was hypothesized that he had hidden himself inside the pavilion to commit the vandalism, possibly causing a glitch in the park’s movement tracking system to spoof the identity of another visitor. He was likely to have 2 other accomplices, similarly using spoofed IDs of 2 other visitors. The visitors whose IDs were spoofed, were likely to be 1502920, 416790 and 461004.
It may be proposed that the police may want to look into more visitors for any suspicious activities.
