VAST Challenge 2021
Mini-Challenge 2
No
120 hours
Yes
Please limit your answer to 8 images and 300 words.
Investigations of the transaction data show purchases range from $2 to items worth more than $10k. The majority of transactions were valued between $8.6 and $211 with the average purchase being $208.
Common dining locations such as Katerina’s Café, Guy’s Gyros Frydos and Brew’ve Been Served account for most of the transactions whereas business partners such as Carlyle Chemical Inc., Nationwide Refinery and Abila Airport account for high cost transactions.
Of the 34 locations for credit card purchases 33 also have loyalty card transactions:
Spending frequency is nearly doubled during business days compared to weekends. Most money (~$70k each day) is spent between Tuesday and Thursday (~50% of all purchases) and there were 7 days with more than $30k spending.
The Chostus Hotel, Albert’s Fine Clothing, and Frydo’s Autosupply n’ More all have a single point of sale significantly higher than all their other sales.
The locations can be clustered into three natural groupings based on the purchase frequency, price, and busiest times:
There were a few noteworthy abnormalities in the data:
Our recommendation is to validate all transactions for the given locations where loyalty card transactions exceed credit card purchases and check for potential missing credit card transactions. Investigators may need to contact business and request purchase records for all transactions for the given timeframe.
Incorrect timestamps for the 4 coffee shops may indicate a technical issue. Both the credit card company as well as coffee shops should be notified to validate related transactions.
Please limit your answer to 8 images and 500 words.
The addition of vehicle data allows classification of the employees by their behavior which provided additional context for patterns within the credit and loyalty card data.
From the general movement patterns GAStech employees can be classified into two broad types:
There are 25 credit card transaction locations which we geo-referenced from the Abila tourist map in order to plot them on the provided shape files. The other 9 locations were not geo-referenced as there was no associated place on the provided map. Additional non-credit card locations were included in the analysis such as parks, shops and other popular point of interests.
Further analysis of vehicle movements provided the location of each employee’s home. A location was considered to be "home" if a person stayed at a given location multiple times overnight.
Analysis showed that some employees don’t have a home location and match a known business location. For example, the CEO (Sten Sanjorge Jr./31) who stayed at the Chostus Hotel.
Some employees share the same or very similar location indicating a shared household or housing complex. Employees affected include Felix Resumir & Adra Nubarron, Birgitta Frente & Lidelse Dedos as well as Sven Flecha & Brand Tempestad.
Analyzing GPS data shows some anomalies around geographical coordinates. When calculating the distance and speed a car must have travelled – some results show values well beyond 100 mph – indicating some data quality issues.
Especially noticeable are wrong (or manipulated?) GPS readings during night hours. Further investigation showed that those abnormal readings were received from GPS device installed in drill technician Isande’s Borrasca (28) car.
GPS data was used to determine a vehicle’s speed (mph) and time spent between way points. Knowing when a vehicle was parked is essential to determine potential store visits.
Visual investigators are also able to track a vehicles motion by animating such travel pattern on a geographical map:
A closest known location (point of interest) was assumed if it’s less than 0.25 miles away and the vehicle was parked (speed less than 5 mph). Taking the time of travel into account shows that some employees (Security) are active all-day including night hours. Others show recurring events such as executives playing golf on weekends, e.g. January 12th & 19th at 2pm (CFO, CIO & EnvAdviser).
Some employees are especially active and further analysis may be required to determine whether this represents a faulty GPS device. For example, drill technician Gustav Cazar (#9) travelled more than 40 miles within this 2-weeks window, followed by Isande Borrasca (#28) with 28 miles – also a drill technician. As comparison most employees travelled less than 8 miles. Looking in detail at GPS data shows a rather randomly spread waypoints for Isande instead of vehicle typically route lines. Following visualization shows the route line comparison between both individuals along with calculated stops on January 17. Isande was also identified earlier as one extreme outlier when analyzing vehicle speeds, again likely caused by the potential faulty GPS readings:
Other employees only show GPS movements on certain days. For example, CEO Sten Sanjorge Jr. (31) arrived in Abila on January 17th and departed two days later January 19th early afternoon. Investigators use a travel pattern dashboard to track an employee’s movements. Example here shows the GPS activity for Sten Sanjorge:
Please limit your answer to 8 images and 500 words.
In order to infer the owners of each credit card, we utilized the previously calculated stop locations of each car. If a given car was near a location at the time of a card transaction, the employee assigned to the car represents a potential match. The uncertainty in this method arises if there are multiple candidates for a given transaction.
In order to rank candidates, we used two different approaches:
Method #1 uses a decision tree classifier to score vehicles given the employee location at the time of the credit card transaction. The decision tree visualization's leaf nodes show how vehicles are distributed given the different days and locations of purchases.
Vehicle #1 is identified in many of the natural groupings and is the only potential candidate for one grouping of purchases, indicating it is the best match the for credit card ending in 2681.
Our alternative method #2 involves calculating a score using the distance of a vehicles GPS location from a purchase location. The closer a vehicle is to a given purchase location the higher its score. SAS routines were used to calculate the number of times a given car is a likely candidate given its position at the time of purchase as well as the number of times it was not a likely candidate. The resulting scores and candidate counts for each credit card were then visualized.
The credit card ending in 2681 is again shown to have the highest scores and candidate counts for vehicle #1. Visualizing other car locations near a purchase location further allows the identification and resolution of potential double matches.
Some individuals seem to have used more than one card (highlighted orange in the tables). However, there are some uncertainties in this method, mainly because simply stopping at an intersection or for any purpose near a purchase location would have incorrectly given such vehicle a higher score. Further investigation is required to narrow down card matches or validate these as true multi-card cases.
With the knowledge about which employee made which purchase, we created purchase profiles.
Knowing an individual's credit card transaction history allowed us to validate outlier purchases identified in question 2. For example, the $10,000 purchase at Frydos Autosupply n’ More can now be identified as purchase made by IT Helpdesk employee Nils Calixto. Given the unusually large purchase was made late on a Monday night (7:20pm) it may indicate suspicious behavior and require further investigation.
Nils also draws attention later in the investigation when analyzing meeting places as he is the only employee staying late until midnight at HQ on several occasions.
Please limit your response to 8 images and 500 words.
Analyzing vehicle movement data allowed the identification of travel routes and related stops.
For every stop we determined the closest point of interest (POI) from the known locations. If a POI is less than 0.1 miles away of a given stop location – it was considered a visited location.
Knowing each start and stop location of a given trip allowed us to create network showing popular travel routes.
Comparing visit times (start/stop) as well as the duration of the stay across employees reveals commonly visited locations like the GAStech headquarters but also subsets of employees that visit the same location at the same time.
If an employee visits a POI at the same time as someone else we consider this as meeting event. These meeting events include living in the same household or working together. If we consider all possible meetings across all employees we can create a schedule matrix and identify potential relationships if employees meet regularly.
This same data can be treated as a social network to uncover more complex patterns in the relationships.
We can now see strong relationships between the executives as well as some individuals in the Engineering department, such as Vira Frente and Axel Calzas or Gustav Cazar and Lars Azada.
Drilling into individual meeting events and comparing meeting duration and
location not only reveals when individuals arrived at a given location,
but also the route they took and other POIs visited while traveling. We
found that all 3 executives played golf for 3 hours on January 12
Additional observations include a potential shared household for Linnea Bergen (6), Kanon Herrero (25) and Bertrand Ovan (29) given similar overnight meeting pattern at same location.
Please limit your response to 10 images and 500 words.
Two Engineering employees: Elsa Orilla (7) and Brand Tempestad (33) meet at 11.20am for four days (Jan 8,10,14 & 17) at the Chostus Hotel. Three hours after the last meeting, the CEO arrived and stayed at the hotel for another three days.
Brand Tempestad also visits executive Willem Vasco-Pais (Environmental Safety Advisor) after the first two meetings, on January 11th 12:37pm at his home and meets for more than three hours.
Interestingly, security employee Edvard Vann (34) is also there to monitor this meeting. Willem is visited by Adra Nubarron (22) from IT on the last day before the kidnapping, again monitored by security personal Sven Flecha (17). The rather unusual meeting pattern and the fact security is monitoring Willem may indicate some suspicious behavior and require further investigation.
Ada Campo-Corrente (CIO), Orphan Strum (COO), Ingrid Barranco (CFO) and Willem Vasco-Pais (Environmental Safety Advisor) meet most evenings 6:30 to 9pm at or near Albert’s Fine Clothing for about an hour. While not inherently suspicious, it indicates a relationship beyond work duties.
Security employees visited executives’ homes during nighttime hours. Perhaps they are monitoring the movements of Ada Campo-Corrente, Orphan Strum, Willem Vasco-Pais, and Ingrid Barranco?
Some employees stay at GASTech well beyond normal working hours. IT Helpdesk employee Nils Calixto (1) stays at headquarters after midnight four times. Also, Ada Campo-Corrente (CIO) spends about 2hrs in Kronos Mart on Jan 18th at 1:48pm to meet with Nils Calixto (1), possibly to discuss the extraneous work Nils is performing for the CIO? Interestingly, security employee Varja Lagos (23) is also at Kronos Mart at that time, presumably to monitor this meeting.
Many company trucks have irregular parking locations. While most return to headquarters every night, some trucks occasionally aren’t returned at all. Truck 107 has been parked at Carlyle Chemical Inc. on for three nights from January 8th through 10th and parked at Maximum Iron and Steel overnight on January 15th.
Some employees also stayed overnight at non-home locations. Drill technician Isande Borrasca (28) stayed at the home of executive Orhan Strum (SVP/COO) three times, indicating a relationship beyond work. However, there is uncertainty in Isanda’s home location due to GPS location data quality issues.
Many employees from the Engineering and IT department met at the same place around the same time on the night of Friday, January 10th, indicating a company social event.
GPS trajectories indicate the event being held at or near by Lars Azada’s home. Events like these could cover up group meetings and investigators should background check event participants to determine any involvements in the upcoming kidnapping event day.
Looking at the last two hours of provided data, a large group of employees arrive at Brew’ve Been Served between 6-7pm on January 19th. Interestingly 9x security personal monitor a meeting between the CEO Sten Sanjorge Jr. (31), drill technician Brand Tempestad (33) and IT technician Sven Flecha (17). The large group of security at the time of the meeting is suspicious and may indicate some involvement in the events folding up.
We did not solve this mini-challenge in 2014