ISSS608 2017-18 T3 Assign Vigneshwar Ramachandran Vadivel Q3

Intro

Approach

Findings

Conclusion

Question 1

Question 2

Question 3

Question 4

Using the combined group of suspected bad actors you created in question 2, show the interactions within the group over time. a. Characterize the group’s organizational structure and show a full picture of communications within the group. b. Does the group composition change during the course of their activities? c. How do the group’s interactions change over time? With the help of insider’s data about suspicious transactions, we can create a combined group of suspected bad actors to characterize the group.

The below network shows the communication links among the suspected bas actors. As we can see the nodes represent the employee involved in the communication and the links shows the communication type.

To make the network more distinct, modularity algorithm can be implemented in Gephi which looks for the nodes that are more densely connected together than to the rest of the network. Now we can see three distinct clusters of employee within the suspicious network.

For finding very connected individuals or individuals who are likely to hold most information it’s useful to look at in-degree (number of inbound links) and out-degree (number of outbound links) as distinct measures.

Another measure which we are interested to look into is, Eigen Centrality to identify nodes with influence over the whole network, not just those directly connected to it.

Below interactive visualization allows us to explore the person of interest in the suspicious network and their internal link of communication.

Using the filter in Gephi, we can narrow down to each communication type to understand whether the composition of the group changes with their activities,
Email network

Call Network

Purchase Network

Meeting Network

It is also important to identify whether the group’s interaction changes over time. To achieve this, we have to create timeline in gephi as decribed below,

Toggle the option "Merge Column" and select "Timestamp" and the option "Create Time Interval"

For the options start time and end time, select "Timestamp", since the communication data varied in seconds.

Select Parse Date. Under the option, select the format similar to the Timestamp column, in this case, it was dd/mm/yyyy hh:mm.

In the following 2 columns, select the day 2015-05-11.

After the previous step, the "Interval" column of the edges file would be filled with interval data.

Create Timeline

Edit the bounds of the timeline, to ensure that it captures the start and the end time of the interval data correctly.

After the following steps were taken, a dynamic timeline would have been created. This allow us to understand the changes in patterns of communication data better.

Summary:

• Jenice and Lizabeth are only connected to the entire network through a single point of contact. This makes them vulnerable in the communication network since they are solely depending on other nodes for flow of information.
  Hence even though the purchase is made by Jennice, her involvement in the illicit purchase is negligible.
• Richard Fox, Tobi , Rosalia , Lindsy and Meryl influence the entire network and they are the main actors who are involved in the illicit purchase based on the graph metrics.