ISSS608 2017-18 T3 Assign Luo Haoran Q4
VAST Challenge 2018 MC3:
Catch the Unsub – Who hurts Eurasian Pipit?
|
|
|
|
|
|
What do we know from the insider?
The list below is the suspicious procurements behaviour marked by the insider.
- 1. Find the events
- He/she is thinking that those events are worth to investigate. So I selected out all the events initiated or accepted by the people in this list.
- All of the relative events are listed out below. There are more than 1000 events that the 8 people in the suspicious purchases list involve in. Those events are the edges in social networking analysis.
- 2. Find the people
- A name list can be generated using this events data. There are 44 people in this group. They can be the nodes in the following social network analysis.
- 3. Networking Analysis
- By importing nodes and edges data generated above, a diagram showing the connection among 44 people is drawn. Color in the diagram indicates different modularity/groups, and the size of the nodes calculated by PageRank means how important a person is in this net.
- There are four potential groups in the diagram. The people in one group basically only reach out to the member in the same group. However Gail Feindt is like a hub among four different groups. Fairy Boratko is playing a similar role as Gail does, but his rank is much smaller.
- Gephi also helps animate the change of connection within the groups dynamically.
- The animation shows the points below.
- Purple group was formed earlier than any other groups.
- Blue group was the last one to be formed as well as the last one to have connection with the hub, Geil.
- Purple and green group only have one-way connection to Gail, while the connections between Gail and blue group, Gail and brown group are mutual.
What did Q2 & Q3 tell?
By detecting the time pattern of the suspicious groups found in Question 2 and Question 3, I found that Rosalia’s behaviour is on a strange mode. She always contacts other person and as the exact same time she is the destination/target of another event initiated by the one she contacts. And also, she used to contact Kerstin at 3:38 AM. Those abnormal behaviours might reveal the potential pattern.
So based on this potential pattern, I selected out all the events happened at the same time and involved the same person. The result is displayed in the data table below.
There are 70 abnormal events in this group. Alpha, Beth, Laure and Trevor are the most suspicious people as they all have many events happening in the same time.
These four people are the center of respective group, and they are the people who get involved in the suspicious purchase. So the whole group of 44 people are suspicious.
