ISSS608 2016-17 T1 Assign3 Wesley Chan

To be a Visual Detective: Detecting spatio-temporal patterns

Overview

DinoFun World is a typical modest-sized amusement park, sitting on about 215 hectares and hosting thousands of visitors each day. It has a small town feel, but it is well known for its exciting rides and events.

In June 2014, the park hosted a weekend tribute to Scott Jones, internationally renowned football (“soccer,” in US terminology) star. Scott was scheduled to appear in two stage shows each day from Friday, June 6 to Sunday, June 8, 2014, to talk about his life and career. In addition, a show of memorabilia related to his career was displayed in the park’s Pavilion.

However, the event did not go as planned. Scott’s weekend was marred by crime and mayhem perpetrated by a poor, misguided and disgruntled figure from Scott’s past.

Goals

We were given access to the movement data and in-app communication data over the three days as well as background information and a detailed map of the park. We were tasked to use visual analytics to analyse how people moved and communicated throughout Dino Fun World and attempt to achieve the following:

• Identify IDs that stand out for their large volumes of communication
• Hypothesize when the vandalism was discovered
• Identify communications patterns in the data, characterizing who is communicating with whom, when and where that may assist with the crime investigation

Challenge 1

Identify those IDs that stand out for their large volumes of communication. For each of these IDs

1. Characterize the communication patterns you see.
2. Based on these patterns, what do you hypothesize about these IDs?

(Please limit your response to no more than 4 images and 300 words.)

There are three IDs that stand out from their large volumes of communications: 1278894, 839736 and external.

ID 1278894: Cindysaurus Trivia Game

We identified the following communication patterns for this ID:

• The ID is always located at the “Entry Corridor”
• The ID sends and receives messages to and from a large number of visitors located throughout the park
• The ID sends messages to participants at a regular 5-minutes interval during a one-hour interval (i.e. 12 broadcast messages during that interval), five times a day. The broadcast period starts at the following times: 12:00 – 13:00, 14:00 – 15:00, 16:00 – 17:00, 18:00 – 19:00 and 20:00 – 21:00
• The ID receives messages / responses from participants usually with the next 5 minutes, following the broadcast

Based on the Dino Fun World web site provided, we hypothesized that this ID is related to the Cindysaurus Trivia Game, which tests park goers’ knowledge about the history, attractions and entertainment at Dino Fun World.

ID 839736: Dino Fun Park Information Centre

We identified the following communication patterns for this ID:

• The ID is always located at the “Entry Corridor”
• The ID sends and receives messages to and from a number of visitors located throughout the park
• The ID sends and receives messages throughout the day at no fixed interval
• There was a huge spike in communications to and from this ID on Sunday at 12:00 PM

Based on the observed patterns, we hypothesized that this ID may be related to the Dino Fun Park information centre.

ID External: External / Outside of Dino Fun Park

We identified the following communication patterns for this ID:

• The ID receives messages only
• The ID receives messages to and from a number of visitors located throughout the park
• The ID receives messages throughout the day at no fixed interval
• There was a burst in communication activity to this ID on Sunday at 11:45 PM

Based on the observed pattern, we hypothesized that this ID may be related to Dino Fun Park’s external message system for park visitors to communicate with people outside the Dino Fun Park.

Challenge 2

From this data, can you hypothesize when the vandalism was discovered? Describe your rationale. (Please limit your response to no more than 3 images and 300 words.)

We hypothesized that the vandalism was discovered on Sunday, 8 June at 11:30 based on the following communication and movement patterns:

Spike in communication activities on Sunday at and around 11:30

• There was a huge spike in communication activities at and around 11:30 on Sunday at the Wet Land area. This was the entry to Creighton Pavilion, where memorabilia related to Scott Jones’ career were on display
• Entry to Creighton Pavilion which was re-opened to visitors on Sunday at 11:30 (Creighton Pavilion is usually closed from 09:30 to 11:30 on Friday to Sunday) was subsequently closed at 12:00 for the remainder of the day, due to the vandalism
• The vandalism was likely discovered by the visitor ID 1742503, who started to message to almost every member of his or her group on Sunday, 8 June at 11:30:03. The group which comprised 37 members in total, entered the park on Sunday through the North Entrance at 09:32. The group headed directly to Creighton Pavilion and queued at the pavilion entrance since 09:44. Members of the group communicated within themselves before alerting the information centre.

Challenge 3

Describe up to 10 communications patterns in the data. Characterize who is communicating, with whom, when and where. If you have more than 10 patterns to report, please prioritize those patterns that are most likely to relate to the crime. (Please limit your response to no more than 10 images and 1000 words.)

Creighton Pavilion

• There were two distinct periods viz. 09:30 – 11:30 and 14:30 – 16:30 during which there were no check-in as well as communication activities at the Creighton Pavilion on Friday through Sunday (with the exception of the early closure of the pavilion on Sunday afternoon, due to the vandalism)
• We hypothesized that Creighton Pavilion is officially closed during that time window
• The bulk of the communication activities were within the Wet Land area
• There was a huge spike in communication activities at and around 11:30 on Sunday at the Wet Land area.
• The above all points to the vandalism taking place on Sunday 8 June between 09:30 and 11:30

Creighton Pavilion on Sunday, 8 June at 11:30

• Visitor ID 1742503 started to message to almost every member of his or her group on Sunday, 8 June at 11:30:03 to inform of the vandalism
• The group which comprised 37 members communicated within themselves. Please refer to the graph network in Challenge 2 for the list of IDs with whom ID 1742503 was communicating with
• Members of group subsequently shared the news of the vandalism with external parties, likely their friends who were not inside the park
• The group members subsequently informed the Dino Fun Park Information Centre (ID: 8397360) of the incident
• The group of 37 visited most of the attractions together during the remainder of the day

Suspicious suspect ID 1502920

• Based on the check-in and movement data, visitor ID 1502920 checked into the Creighton Pavilion on Sunday at 09:30 and stayed there until 11:30 i.e. the re-opening of the pavilion (the park’s beacon system did not pick up any movement from this ID until 11:30:19)
• The ID communicated with the Dino Fun Park Information Centre (ID: 8397360) and the Cindysaurus Trivia Game (ID: 1278894)
• The ID had little communication with other visitors and exchanged messages with only 6 other individuals (e.g. 1187909)

Active visitor at Creighton Pavilion

• Based on the check-in and movement data, we also identified a group of 5 individuals (ID: 346310, 1254510,617164, 924388, 1182572) who visited the Creighton Pavilion 8 times over the 3-day period
• The group communicated mostly within themselves and some small chats with many visitors over the 3-day period

Scott Jones’ bodyguard or entourage

• We identified a group of eight individuals (ID: 511750, 644885, 1080969, 1600469, 1629516, 1781070, 1787551 and 1935406) who were likely Scott Jones’ bodyguard or entourage
• They followed the same foot path every day from the Hotel Entrance to the Grinosaurus Stage
• The group of eight individuals surprisingly did not communicate between themselves as well as with the park information and/or security centre
• The news of the vandalism would have reached Scott Jones through other communication means

Grinosaurus Stage

• Scott Jones show occurs at the Grinosaurus Stage twice a day (with the exception of Sunday afternoon; the show was cancelled due to the vandalism at Creighton Pavilion)
• There is a buzz of messages when Scott Jones appeared on the stage at around 09:35 and 14:35 every day