Entry Name:  CSU-Zhao-MC2

VAST Challenge 2014
Mini-Challenge 2

 

Team Members:

Ying Zhao, Central South University, zhaoying511@gmail.com    PRIMARY

Yanni Peng, Central South University, 982024176@qq.com

Wei Huang, Central South University, 502074913@qq.com

Yong Li, Central South University, 961856313@qq.com

Fangfang Zhou, Central South University, zhouffang@gmail.com    SUPERVISOR

Zhifang Liao, Central South University, zfliao@csu.edu.cn    SUPERVISOR

Kang Zhang, University of Texas at Dallas; Tianjin University, kzhang@utdallas.edu    SUPERVISOR

 

Student Team:  Yes

 

Analytic Tools Used:

D3

MYSQL

Excel

 

Approximately how many hours were spent working on this submission in total?

About 180 hours ( 60 days, and 3 hours/day )

 

May we post your submission in the Visual Analytics Benchmark Repository after VAST Challenge 2014 is complete?

Yes

 

Video:

index.files\CSU-Zhao-MC2-Demo.wmv

 

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Questions

 

MC2.1 – Describe common daily routines for GAStech employees. What does a day in the life of a typical GAStech employee look like?  Please limit your response to no more than five images and 300 words.

 

The classification of employees:

 

According to the consumption features, all employees in GASTech can be classified into two types: the general staffs and truck drivers.

(1). The general staffs visit all stores in Abila except the places have business with GASTech, such as Abila Airport, Carlyle Chemical Inc. and Nationwide Refinery, in Fig.1-1(a).

(2). The truck drivers always run between the business places and the company, and they rarely go to the shopping malls and restaurants. But, the special cases are that Albina Hafon has been to Ouzeri Elian twice and Valeria Morlun likes to go to Katerina Caf, in Fig.1-1(b).

This classification result is also very obvious in our RadViz tool, shown in Fig.3-2.

 

Fig.1-1 The consumption features of the general staffs and truck drivers.

 

The weekday of general staffs:

(1). In the morning, the general staffs have breakfast near their home, and go to the company before 08:30, shown in Fig.1-2(a).

(2). From 12:00 to 14:30 is noon break time, so they have enough time to enjoy their lunch, shown in Fig.1-2(b).

(3). During working hours in the weekdays, they seldom go out from the company. But, some employees once went to the store named Office Supplies in the afternoon.

(4). After work at 17:30, most of people will go home first, and then go shopping or enjoy their dinner, in Fig.1-3.

 

Fig.1-2 The working hours of general staffs.

 

Fig.1-3 The activities of general staffs after work.

 

The weekend of general staffs:

A typical weekend of general staffs looks like : go out from noon, eat a big meal at noon or evening, indispensable go shopping, visit a museum or play golf for relax, and even join a party, shown in Fig.1-4.

Fig.1-4 The weekend of general staffs.

 

The weekday of truck drivers:

There isn’t any activity on truck drivers on weekday, shown in Fig.1-1(b). During working hours, truck drivers are busy running between the company and industrial sites or airport, shown in Fig.1-5.

Fig.1-5 The activities of trucks on Jan 8

 

 

MC2.2 – Identify up to twelve unusual events or patterns that you see in the data. If you identify more than twelve patterns during your analysis, focus your answer on the patterns you consider to be most important for further investigation to help find the missing staff members. For each pattern or event you identify, describe

a.     What is the pattern or event you observe?

b.     Who is involved?

c.      What locations are involved?

d.     When does the pattern or event take place?

e.     Why is this pattern or event significant?

f.       What is your level of confidence about this pattern or event?  Why?

Please limit your answer to no more than twelve images and 1500 words.

 

 

The overview of twelve abnormal events:

 

At the beginning of MC2.2, Table.2-1 gives an overview of twelve abnormal events.

Table.2-1 The overview of MC2.2.

 

Event 1: Monitored four executive officers’ houses at midnight.

 

(1) Four men of the security department monitored four executives (COO,CIO,CFO,ESA-Environmental Safety Advisor) at four different midnight, participants including: Loreto Bodrogi (car15), Isia Vann (car16), Hennie Osvaldo (car21) and Minke Mies (car24). For example, in Fig2-1(a), I.Vann went from his house to the place near CIO’s home at 23:00 on Jan 6 first, and then Bodrogi arrived at the same position at 03:00 on Jan 7. On the morning of Jan 7, they went to GASTech directly instead of returning home, which’s meant that they had stayed near CIO’s house for the whole night.

(2) These four men live very close, and they also visited each other sometimes. For example, in Fig2-1(b), H.Osvaldo visited the home of I.Vann or Bodrogi after supper at 21:20 before he went to the place near CFO’s house at 23:00 on Jan 13, and then he returned home from CFO’s house at 03:30 on Jan 14 after M.Mies arrived at CFO’s house about 03:00 on Jan 14.

(3) Another clue is that I.Vann and Bodrogi are good at surveillance equipment and alarm device which is depicted in their resumes.

To sum up, we highly suspect that these four men were involved in some mysterious monitoring events on executives of GASTech.

 

Fig.2-1. (a) I.Vann and Bodrogi monitored CIO’s house from 1/6 23:00 to 1/7 6:00. (b) H.Osvaldo monitored CFO’s house from 1/13 23:00 to 1/14 3:00.

 

Event 2: Five suspicious places visited by four suspects working in the security department.

 

The three suspicious men in Event1 (Bodrogi, H.Osvaldo, M.Mies) and a new suspect (Inga Ferro, Female, Security, car13) repeatedly accessed five suspicious places about 11:00.AM. Because that these five places were never accessed by other employees and one of them is near Abila Port which is a drug transport site, we bravely speculate these places are related with masterminds of kidnap, headquarters of PoK, drug gangs or illegal arms.

By the way, one suspicious place in Fig.2-2(b) is near the home of Linnea Bergen (IT Group Manager) and Adra Nubarron (Engineering), so we also suggest an investigation on them.

Fig.2-2. (a) Two suspicious places in western Abila. (b) Three suspicious places in southeast Abila.

 

Event 3: The suspicious activities at two gas stations.

 

According to only a few charge records of gas stations, in Fig.2-3(a), we guess that GASTech provides free fuels for employee’s cars. So, these records are dangerous because gasoline is the perfect material to fire a building.

(1). U-Pump generated consumption records on Varja Lagos (car23, security) at 17:28 Jan6 and Lucas Alcazar (car1, IT) at 13:18 Jan 13, shown in Fig.2-3(b);

(2). Frank’s Fuel generated consumption records on Loreto Bodrogi who is a suspect in Event2 at 12:29 Jan 8 and Felix Balas (car3, engineering) at 18:39 Jan 18, shown in Fig.2-3(c);

(3). Most noticeably of all, there is not corresponding L.Alcazar’s car-tracking data near U-Pump at 13:18 Jan 13, and F.Balas seemed to pass by the suspicious places in Event2 when he went to Frank’s Fuel. So, we doubt that F.Balas has found some suspicious clues of suspects in Event2 or he is in a bang of them.

(4).The other abnormal things are found in trajectories. Firstly, Minke Mies who is a suspect in Event2 stayed near U-Pump from 12:35 to 13:20 on Jan 13 without related transactions. Secondly, Bertrand Ovan (facilities manager, car29) seemed to make a circuit of the city at midnight on Jan 11, and stopped near U-Pump from 23:30 to 23:50 without related transactions, in Fig.2-3(d).

 

Fig.2-3. The suspicious activities at two gas stations.

 

Event 4: Lucas Alcazar's abnormal transactions and overtime work.

 

Lucas Alcazar (car1, IT Helpdesk) often went to the company at night, in Fig.2-4(a), and there are some strange transactions without related car-tracking data happened to him on Jan 13, in Fig.2-4(b):

(1). The consumptions raised on ‘Daily Dealz’ at 06:04 and ‘U-Pump’ at 13:18, and ‘Daily Dealz’ appeared only once in all transactions.

(2). A consumption of 10,000 dollar occurred on ‘Frydos Autosupply’ at 19:20, but the average transaction price of ‘Frydos Autosupply’ is about 300 dollar. As we known, 10,000 dollar can support many dangerous things about the crime tools, such as turning a normal truck into a fire truck or turning a car into a police car.

To sum up, we wonder if his credit card was abused or the related car-tracking data was deleted, and we also wonder if his overtime work is related with system maintenance or some hacker things.

In addition, we suggest investigating the Frydos Autosupply and its nearby stores, such as Guy's Gyros and Katerina Caf, because they are the nearest restaurants to the houses of suspects in Event1 and Event2.

 

Fig.2-4. (a) The overtime work; (b) The abnormal transactions without related car-tracking data.

 

Event 5: The abnormal truck activities.

 

Through our analysis on trucks and truck drivers in these two weeks, we find out: 

(1) Truck No.104 was for Henk Mies’s exclusive use between the airport and company;

(2) Truck No.106 was for Dylan Scozzese’s exclusive use, and the car-tracking data to Abila Scrapyard only occurred on him;

(3) Truck No.105 was only droved by Valeria Morlun;

(4) Truck No.101 was shared by Albina Hafon, Benito Hawelon and Claudio Hawelon;

(5) Truck No.107 was shared by Celilia Morluniau and Irene Nant.

In the following, we list some clues about trucks for the law enforcement:

(1) Why did car-tracking data of truck No.104, No.105 and No.106 last for longer time from 17:19 to 20:00 on Jan 16, in Fig2-5(a);

(2) Why did truck No.104 (Henk Mies) go to the airport about 21:00 Jan 16, in Fig2-5(b), and was it related with the return of CEO in event 9;

(3) Why did transactions of Claudio Hawelon only occur on Jan 10;

(4) Why did truck No.107 keep busy on the afternoon of Jan 17, in Fig2-5(b). By the way, we guess that Cecilia Morluniau who often went to the Fabrication Factory near Abila port may have relations to Claudio Morluniau who was mentioned in the news as a director of Abila port.

 

Fig.2-5. (a) Trajectories lasted for longer time on Jan 16; (b) Two abnormal truck trajectories.

 

Event 6: A Friday party on the evening of Jan 10.

 

A party on the evening of Jan 10 involved at least 16 people: 12 people from the engineering department (except Kare Orilla) and 4 people from the IT department (Lucas Alcazar, Isak Baza, Linnea Bergen, Nils Calixto).

They went to the party about 19:00 and came home one after another before 24 o’clock, and the party place looked like near Lars Azada’s house.

We speculate this is a Friday party, like casino night or karaoke night, but it’s still an important subject to investigate.

 

Fig.2-6. A Friday party on the evening of Jan 10.

 

Event 7: The abnormal transactions of Kronos Mart at midnight.

 

The parallel coordinates in Fig.2-7 shows all the credit card transactions at midnight are in the Kronos Mart. But, the thing making us more curious is that the related trajectories are found before the day of generating the consumption records. For example, Orhan Strum (car32, COO) had a record of Kronos Mart at 03:39 on Jan 12, and the related trajectory to Mart was at 13:37 on Jan 11 after his lunch at Katerina Caf, in Fig2-7(b).

The area near Kronos Mart is a big shopping mall in Abila, and it’s easy to hide some illegal activities. So, we suggest investigating other stores when the police go to Mart, such as Roberts and Sons, Abila Zacharo and Kalami Kafenion.

 

Fig.2-7. The anomalies of Kronos Mart.

 

Event 8: The visit to Kronos Capitol and the chaotic trajectories of Elsa Orilla.

 

The visit to Kronos Capitol :

(1) On Jan 11, Willem Vasco-Pais (ESA, car35) went to Capitol in the afternoon whose resume pointed out that he has close relations with government, in Fig.2-8(a).

(2) On Jan 18, L.Bodrogi who is a suspect in Event1 and Edvard Vann (security, car34) went to Capitol at different time in the afternoon, in Fig.2-8(b)(c).

(3) On Jan 18, Kanon Herrero (security, car22, male, born in 1984) and Elsa Orilla (engineer, car28, female, born in 1982) went to Capitol in the morning, and to Museum at noon, to Hippokampos in the afternoon, and to K.Herrero’s home at night together, in Fig.2-8(d).

According to the frequent activities at Capitol on Jan 18 and the coming celebration, we speculate that they visited some mysterious VIPs at Capitol.

In addition, we have some doubts about E.Orilla:

(1) Did the GPS device in her car have some faults which caused the chaotic trajectories and a little offset to the upper left corner?

(2) She visited the same place at night on Jan 12 and Jan 18, and came back home very late. According to the similar trajectories with K.Herrero, we guess that the place is house of K.Herrero, in Fig.2-8(e).

 

Fig.2-8. The visit to Kronos Capitol and the chaotic trajectories of Elsa Orilla.

 

Event 9: The weekend golf party and the return of the CEO.

 

In recent two weekends, the executives all went to play golf. But there are some doubts:

(1) Why did the COO (Orhan Strum, car32) miss the golf party on Jan 12? By the way, the COO is the only person born in Asteria where produces drugs prosperously.

(2) The CEO (Sten Sanjorge Jr., car31) also missed the golf party on Jan 12, because that he was not in Kronos until Jan 17. But, why did the CEO look as if he had lived in the hotel since he returned Kronos. Does not he have a house in Abila? Was he aware of any danger?

 

Fig.2-9. The weekend golf party and the return of the CEO

 

Event 10: The synchronous hotel consumption records.

 

Brand Tempestad (Male, Engineering, Car33, Born in 1979) and Isande Borrasca (Female, Engineering, Car7, Born in 1979) should be responsible for synchronous hotel consumption records at noon on four different days, in Fig.2-10(a).

For example, they drove their cars to the hotel from GASTech about 11:00 on Jan 8, and returned GASTech about 13:00 on Jan 8, in Fig.2-10(b).

So, we speculate that they are lovers, but it’s still worth to inquire.

 

Fig.2-10. The synchronous hotel consumption records.

 

Event 11: Some doubts about Ruscella Mies Haber.

 

Although no significant anomalies in transaction data, we still have some doubts about Ruscella Mies Haber (Female, born in 1964, Assistant to Engineering Group Manager):

(1) She is an older employee and the oldest of the assistants in GASTech, but she did not have any benefit in the IPO of GASTech.

(2) Does she have relations with Valentine Mies who is one of the first-generation leaders of PoK ?

(3) We guess that her home is near the houses of Isia Vann and Loreto Bodrogi who are suspects in Event 1, because the places she often went to included Katerina Caf and Brew've Been Served.

To sum up, we speculate that she is a dangerous woman, but it’s very uncertain.

 

Fig.2-11. Some doubts about Ruscella Mies Haber.

 

Event 12: The mismatch between credit card and loyalty card transactions.

 

Employees often use loyalty cards to gain discounts or extra benefits, so credit card and loyalty card transactions with the same price, employee and location are always in pairs. But there are still 91 un-matched credit card records and 182 un-matched loyalty card records.

We think that the investigation about these un-matched records would lead to some new clues.

 

 

MC2.3 – Like most datasets, the data you were provided is imperfect, with possible issues such as missing data, conflicting data, data of varying resolutions, outliers, or other kinds of confusing data. Considering MC2 data is primarily spatiotemporal, describe how you identified and addressed the uncertainties and conflicts inherent in this data to reach your conclusions in questions MC2.1 and MC2.2.  Please limit your response to no more than five images and 300 words.

 

Data preprocessing 1: Cluster location types and employees by using RadViz.

 

There are 34 consumer places in transaction data, but some of those places are very difficult to identify their location types by names or icons on the tourist map. For example, which types does “Hippokampos” belong to?  Industry, restaurant or shopping mall?  In our approach, the visual clustering of RadViz is used to address the uncertainties of location types in Fig.3-1.

 

Fig.3-1. (a) Identify the location type of “Hippokampos”. (b) Distinguish the business places and restaurants. (c) The classification of location types.

Meanwhile, The RadViz also help us find employees with common consumption habits and create a better order in matrix view, in Fig.3-2.

 

Fig.3-2. (a) Cluster employees by business locations and dinning places (b) Cluster employees by fast food places. (c) Resort matrix view by the result of clustering in (b).

 

Data preprocessing 2: Segment car-tracking data.

 

In Fig.3-3(a), it's easy to know where this car passed by, but it's still uncertain where this car stopped because of the lack of car-start/stop information in raw GPS data.

So, we segment tracking data of each car by the continuity analysis of time on raw GPS data. Then the start and end of each section of trajectories can be marked by triangle and bigger circle, and the temporal features of each trajectory can be coded by different color, in Fig.3-3(b).

 

Fig.3-3. (a): The raw car-tracking data of car23 are drawn directly on the map.  (b): The segmented tracking data with start or end points of car23 on Jan 6 are drawn with temporal color coding.

 

Data preprocessing 3: Locate the precise geographical positions of consumer places and employee's home.

 

There are not the precise geographic positions of consumer places and employee's home in the official tourist map. So, we utilize the consumption records and corresponding segmented car-tracking data to locate their relatively precise positions.

 

Fig.3-4. (a): Locate the position of “Hippokampos” by utilizing credit card transactions and corresponding segmented car-tracking data.

(b): the relatively precise positions of all consumer places and employees’ home in the map.

 

Data preprocessing 4: Create a composite map.

 

The information is very brief in official tourist map. Meanwhile, there is only the road-network on the ArcGIS shape file.

So, we create a composite map by calibrating and incorporating multiple map layers, including: tourist-map, road-network, location and legend layer.

 

Fig.3-5   A composite map by calibrating and incorporating multiple map layers.

 

Data preprocessing 5: Some other problems about imperfect raw data.

 

There are still some other uncertainties in raw data which have little impact on visual analysis. So, in order to maintain the original state of the data, we don’t deal with these problems, including:

(1) The chaotic trajectories of Elsa Orilla (car28) which has been explained in Event 8.

(2) The noncontinuous trajectories of Axel Calzas (car9, Engineering) which are not mentioned in our selected events, but this anomaly should be inquired.

(3) The loyalty card transactions without the specific time of consumption, such as hour, minute and second.