Difference between revisions of "ISSS608 2017-18 T3 Assign Lu Yanzhang Insights"
(25 intermediate revisions by the same user not shown) | |||
Line 6: | Line 6: | ||
<!--MAIN HEADER --> | <!--MAIN HEADER --> | ||
{|style="background-color:#1B338F;" width="100%" cellspacing="0" cellpadding="0" valign="top" border="0" | | {|style="background-color:#1B338F;" width="100%" cellspacing="0" cellpadding="0" valign="top" border="0" | | ||
− | | style="font-family:Century Gothic; font-size:100%; solid #000000; background:#2B3856; text-align:center;" width=" | + | | style="font-family:Century Gothic; font-size:100%; solid #000000; background:#2B3856; text-align:center;" width="25%" | |
; | ; | ||
[[ISSS608_2017-18_T3_Assign_Lu_Yanzhang| <font color="#FFFFFF">'''INTRODUCTION'''</font>]] | [[ISSS608_2017-18_T3_Assign_Lu_Yanzhang| <font color="#FFFFFF">'''INTRODUCTION'''</font>]] | ||
− | | style="font-family:Century Gothic; font-size:100%; solid #1B338F; background:#2B3856; text-align:center;" width=" | + | | style="font-family:Century Gothic; font-size:100%; solid #1B338F; background:#2B3856; text-align:center;" width="25%" | |
; | ; | ||
− | [[ISSS608_2017-18_T3_Assign_Lu_Yanzhang_Data | + | [[ISSS608_2017-18_T3_Assign_Lu_Yanzhang_Data Preparation_Methodology| <font color="#FFFFFF">'''DATA PREPARATION & METHODOLOGY'''</font>]] |
− | | style="font-family:Century Gothic; font-size:100%; solid #1B338F; background:#2B3856; text-align:center;" width=" | + | | style="font-family:Century Gothic; font-size:100%; solid #1B338F; background:#2B3856; text-align:center;" width="25%"| |
; | ; | ||
− | [[ISSS608_2017- | + | [[ISSS608_2017-18_T3_Assign_Lu_Yanzhang_Insights| <font color="#FFFFFF">'''OBSERVATION AND INSIGHTS'''</font>]] |
− | | style="font-family:Century Gothic; font-size:100%; solid #1B338F; background:#2B3856; text-align:center;" width=" | + | | style="font-family:Century Gothic; font-size:100%; solid #1B338F; background:#2B3856; text-align:center;" width="25%" | |
; | ; | ||
− | [[ | + | [[Assignment_Dropbox_G1| <font color="#FFFFFF">Back to Dropbox</font>]] |
− | |||
− | |||
− | |||
− | |||
| | | | ||
|} | |} | ||
Line 33: | Line 29: | ||
− | + | <b> Growing pattern Interpretation: </b> | |
In terms of Meeting, Purchase, Call, Email record from May 2015 to December 2017, four graphs below indicate the trend of the number of records separately. | In terms of Meeting, Purchase, Call, Email record from May 2015 to December 2017, four graphs below indicate the trend of the number of records separately. | ||
Line 50: | Line 46: | ||
<font size = 3; color="#000000"><span style="font-family:Trebuchet MS; font-weight:bold;"><h2>Question 2 :Combine the four data sources for group that the insider has identified as being suspicious and locate the group in the larger dataset. Determine if anyone else appears to be closely associated with this group. Highlight which employees are making suspicious purchases, according to the insider’s data. </h2></span></font> | <font size = 3; color="#000000"><span style="font-family:Trebuchet MS; font-weight:bold;"><h2>Question 2 :Combine the four data sources for group that the insider has identified as being suspicious and locate the group in the larger dataset. Determine if anyone else appears to be closely associated with this group. Highlight which employees are making suspicious purchases, according to the insider’s data. </h2></span></font> | ||
+ | |||
+ | |||
+ | <b> Suspicious staffs interpretation: </b> | ||
+ | |||
+ | After filtering out the all excels given by the competition, the two figures below indicate what I have found. | ||
+ | For the source figure, it indicates the 26 people are the event organizer involved in the suspicious activities including Call, Email, Meeting, and Purchase. Clearly, the figure RichardFox is the most active staff involving the suspicious events and the sum number of all events is 65. | ||
+ | Similarly, the other figure, the employee making suspicious events, indicates the suspicious staffs. It turns out GaiFeindt and KerstinBelveal are the two staff who deserves the highest effort to observe. | ||
+ | |||
+ | [[File:Q2_source.png|600px|center]] | ||
+ | [[File:Q2 target.png|600px|center]] | ||
+ | |||
+ | <font size = 3; color="#000000"><span style="font-family:Trebuchet MS; font-weight:bold;"><h2>Question 3 :Using the combined group of suspected bad actors you created in question 2, show the interactions within the group over time. Limit your responses to 10 images and 1000 words </h2></span></font> | ||
+ | |||
+ | <b> 3.1 Characterize the group’s organizational structure and show a full picture of communications within the group. </b> | ||
+ | <b> Social network Interpretation: </b> | ||
+ | |||
+ | After applying relevant social network analytics methodologies (eigenvalue centrality and Modularity) to the suspicious source and target staffs, the social network figure below indicates some key insights: | ||
+ | 1.The directed graph compromise of 43 vertexes and 76 edge, which denotes 43 relevant staffs and 76 suspicious event logs. | ||
+ | 2. The same color represents the same working function in the corporate. In other words, it is highly likely that they | ||
+ | work for an individual function in the company. Thus, there might have 4 functions involved in this auspicious event. | ||
+ | 3. The size of the nodes denotes the importance of the staff and the bigger the size is, the more critical the staff is. | ||
+ | Take an instance, the size of the orange group is clearly bigger than other groups, which means the whole orange function works in a more important role. | ||
+ | |||
+ | [[File:Q3_gephi.png|600px|center]] | ||
+ | |||
+ | <b> 3.1 & 3.2 Does the group composition change during the course of their activities? How do the group’s interactions change over time?</b> | ||
+ | <b> Dynamic social network Interpretation: </b> | ||
+ | Below is the dynamic social network graph and the length of the time interval is two month. | ||
+ | The whole network is formatted gradually by three main steps: | ||
+ | |||
+ | Step1: The network of the pink group, which compromised the highest number of staffs, was built early and the whole pink network was mutual in Nov 2015. | ||
+ | [[File:Q3_2&3_01.png|600px|center]] | ||
+ | |||
+ | Step2: The remaining three groups were formatted by Feb 2016 and at that time, the interconnection was quite mere while the intra connection took a lead. | ||
+ | [[File:Q3_2&3_02.png|600px|center]] | ||
+ | Step3: The four groups started communicating with each other and there were more and more interconnections. | ||
+ | [[File:Q3_2&3_03.png|600px|center]] | ||
+ | |||
+ | <font size = 3; color="#000000"><span style="font-family:Trebuchet MS; font-weight:bold;"><h2>Question 4 :The insider has provided a list of purchases that might indicate illicit activity elsewhere in the company. Using the structure of the first group noted by the insider as a model can you find any other instances of suspicious activities in the company? Are there other groups that have structure and activity similar to this one? Who are they? Each of the suspicious purchases could be a starting point for your search. Provide examples of up to two other groups you find that appear suspicious and compare their structure with the structure of the first group. The structures should be presented as temporal not just structural (i.e., the sequence of events—A is followed by B one or two days later—will be important).</h2></span></font> |
Latest revision as of 13:18, 10 July 2018
|
|
|
|
Contents
- 1 Question 1 :Using the four large Kasios International data sets, combine the different sources to create a single picture of the company. Characterize changes in the company over time. According to the company’s communications and purchase habits, is the company growing?
- 2 Question 2 :Combine the four data sources for group that the insider has identified as being suspicious and locate the group in the larger dataset. Determine if anyone else appears to be closely associated with this group. Highlight which employees are making suspicious purchases, according to the insider’s data.
- 3 Question 3 :Using the combined group of suspected bad actors you created in question 2, show the interactions within the group over time. Limit your responses to 10 images and 1000 words
- 4 Question 4 :The insider has provided a list of purchases that might indicate illicit activity elsewhere in the company. Using the structure of the first group noted by the insider as a model can you find any other instances of suspicious activities in the company? Are there other groups that have structure and activity similar to this one? Who are they? Each of the suspicious purchases could be a starting point for your search. Provide examples of up to two other groups you find that appear suspicious and compare their structure with the structure of the first group. The structures should be presented as temporal not just structural (i.e., the sequence of events—A is followed by B one or two days later—will be important).
Question 1 :Using the four large Kasios International data sets, combine the different sources to create a single picture of the company. Characterize changes in the company over time. According to the company’s communications and purchase habits, is the company growing?
Growing pattern Interpretation:
In terms of Meeting, Purchase, Call, Email record from May 2015 to December 2017, four graphs below indicate the trend of the number of records separately.
From Purchase, Call and Email record perspectives, starting in May 2015, the number of records increased rapidly in the next two months (July 2017). After this, the number of records of the three aspects almost keep dynamically stable trends.
From the meeting records, the number has kept a growth trend since October 2015. Before this, the number of meeting almost is 0.
Conclusion:
In a sum, the company grows rapidly from May 2015 to July 2015. After this, in general, the company keeps a dynamically stable trend in the communications and purchase records.
Question 2 :Combine the four data sources for group that the insider has identified as being suspicious and locate the group in the larger dataset. Determine if anyone else appears to be closely associated with this group. Highlight which employees are making suspicious purchases, according to the insider’s data.
Suspicious staffs interpretation:
After filtering out the all excels given by the competition, the two figures below indicate what I have found. For the source figure, it indicates the 26 people are the event organizer involved in the suspicious activities including Call, Email, Meeting, and Purchase. Clearly, the figure RichardFox is the most active staff involving the suspicious events and the sum number of all events is 65. Similarly, the other figure, the employee making suspicious events, indicates the suspicious staffs. It turns out GaiFeindt and KerstinBelveal are the two staff who deserves the highest effort to observe.
Question 3 :Using the combined group of suspected bad actors you created in question 2, show the interactions within the group over time. Limit your responses to 10 images and 1000 words
3.1 Characterize the group’s organizational structure and show a full picture of communications within the group. Social network Interpretation:
After applying relevant social network analytics methodologies (eigenvalue centrality and Modularity) to the suspicious source and target staffs, the social network figure below indicates some key insights:
1.The directed graph compromise of 43 vertexes and 76 edge, which denotes 43 relevant staffs and 76 suspicious event logs. 2. The same color represents the same working function in the corporate. In other words, it is highly likely that they work for an individual function in the company. Thus, there might have 4 functions involved in this auspicious event. 3. The size of the nodes denotes the importance of the staff and the bigger the size is, the more critical the staff is. Take an instance, the size of the orange group is clearly bigger than other groups, which means the whole orange function works in a more important role.
3.1 & 3.2 Does the group composition change during the course of their activities? How do the group’s interactions change over time? Dynamic social network Interpretation: Below is the dynamic social network graph and the length of the time interval is two month. The whole network is formatted gradually by three main steps:
Step1: The network of the pink group, which compromised the highest number of staffs, was built early and the whole pink network was mutual in Nov 2015.
Step2: The remaining three groups were formatted by Feb 2016 and at that time, the interconnection was quite mere while the intra connection took a lead.
Step3: The four groups started communicating with each other and there were more and more interconnections.