VAST Challenge 2021
Mini-Challenge 2
Yes
120 hours
Yes
Before we present the answers to the questions, we first explain the basic idea of our approach, interactive sequence matching, and the corresponding visual analysis system, called iSeqMatcher.
The ultimate goal of this challenge is to uncover the suspicious activities among employees of GASTech, given only the corresponding relationships between employees and vehicles. We reconstruct the missing relationships using interactive sequence matching. We first uncover the correspondence between credit cards and loyalty cards based on the consumption data (Fig. 0-1 (a)). Then we match each parking event sequence with the credit card consumption sequence to build the correspondence between vehicles and credit cards (Fig. 0-1 (b)). Finally, we cluster employees by evaluating the similarity between the parking event sequences (Fig. 0-1 (c)). These three steps uncover the implicit relationships between employees. iSeqMatcher, as the interface between analysts, supports the matching tasks with rich interactions. It contains the map view (Fig. 0-1 (d)), two matrixes for sequence matching (Fig. 0-2(e) and (g)), and the sequence visualization (Fig. 0-3(f)). Analysts can inject their domain knowledge to identify the uncertainty and conflicts in the data during their analysis and test their hypothesis freely.
As a visual analytics expert assisting law enforcement, your mission is to identify which GASTech employees made which purchases and identify suspicious patterns of behavior.. You must cope with uncertainties that result from missing, conflicting, and imperfect data to make recommendations for further investigation.
Use visual analytics to analyze the available data and develop responses to the questions below. In addition, prepare a video that shows how you used visual analytics to solve this challenge. Submission instructions are available here. Entry forms are available for download below.
Please limit your answer to 8 images and 300 words.
We first show the basic summary information of credit and loyalty card data (Fig. 1-1). We can find that Katerina's Cafe, Hippokampos, Guy's Gyros, Brew've Been Served, and Hallowed Grounds are the five most popular locations. The bar chart at the center of Fig. 1-1 presents when they are popular. For example, the top three stores are popular during 13:00-14:00 and 20:00-21:00, while Brew've Been Served and Hallowed Grounds are popular during 6:00-7:00.
We find that each credit card has a specific time, while the loyalty card contains the only date. By examining the dataset, we find that credit cards are usually used accompanied by loyalty cards simultaneously with the same cost. Considering this, we decide to match each credit card with the corresponding loyalty card. There are 1490 consumption records, and 1081 records are matched. We visualize the matched records in Fig. 1-2 and the matched cards in Fig. 1-3.
By closely examining Fig. 1-1 and Fig. 1-2, we can find that there is a huge cost with 10000 dollars at Frydos Autosupply n' More at 19:20 on thirteenth January in 2014. Usually, the average cost in this store is 300. With limited information on the credit and loyalty cards, we are unsure about the reason for the anomaly. This abnormal cost may be exchanged with the average cost. Besides, there are five expenses in Kronos Mart during 3:00. The consumption time is suspicious as the mart may be closed at the time.
In Fig. 1-3, we find that credit card 1286 matches with two loyalty cards L3288 and L3572. The credit cards 6691 and 6899 have the same loyalty card L6267, while credit cards 1286 and 9241 have the same loyalty card L3288. This may imply some personal relationships between different employees.
Please limit your answer to 8 images and 500 words.
We do not know the specific coordinates of stores as the provided tourist map image does not have GPS mapping. To solve the problem, we first map the image onto the road network manually using QGIS. This process enables us to obtain the coordinates of most stores. However, we find eight stores (Abila Zacharo, Brewed Awakenings, Hippokampos, Kalami Kafenion, Kronos Pipe and Irrigation, Octavio's Office Supplies, Shoppers' Delight, and Stewart and Sons Fabrication) do not have icons labeled on the map.
To solve this problem, we first remove all parking events that close to the known stores. Then we match the credit card data for the unknown eight locations with the other parking events. This process enables us to get a rough estimate of the eight locations.
For the abnormal consumption with 1000 dollars at Frydos Autosupply n' More at 19:20, we first draw a circle on the hotspot at this store and select a time range on the thirteenth January (Fig. 2-1 (a)). This interaction will highlights all the parking events locate inside the circle within the selected time range. Besides, all bubbles that satisfy the same condition will be colored red. The sequence visualization highlights the selected parking events and bubbles. However, the bubbles can not locate inside the highlighted green bands (Fig. 2-1 (b)). This implies there may be a time shift between the vehicle and credit card data. Therefore, we decide to subtract 45 minutes of four credit card consumptions.
To get more details of the anomalies in Kronos Mart during 3 AM, we draw a circle on the map near the Kronos Mart and select three time ranges (January 12th, January 13th, January 19th). All three conditions do not highlight any purple parking events. We can not infer the correct time of the credit card consumptions. Therefore, we decide to delete these records.
Please limit your answer to 8 images and 500 words.
As we already match each credit card with a loyalty card, and we know the owners of each vehicle, we only need to match the credit cards to the vehicles to infer the owners of the two kinds of cards. Therefore, we propose a visual analysis approach to evaluate the correlations between each car and credit card (Fig. 3-1).
Given one parking event and one consumption event, we calculate whether they can be matched. If the consumption event happens in the time range of the parking event, and the distance between the two events is close enough (less than a given threshold), we consider the two events are matched (Fig. 3-1 (a)). Then we calculate the number of matches and the average distance of the matches for each parking event sequence and consumption event sequence and visualize the result using a matrix (Fig. 3-1 (b)). The two metrics (average distance and number of event matches) provide the uncertainty of the sequence matching. By default, the method matches a credit card with a car with the largest number of matches and the closest average distance. Analysts can adjust the distance threshold and finetune the matching results based on their domain knowledge interactively.
In order to visualize the parking sequences for better understanding, we first segment the map into several blocks based on the tourist map. The result is shown in Fig. 3-2. The colors of parking events are determined by the blocks they locate. We can easily find most cars regularly work at GAStech on workdays (orange segments in the sequence visualization). However, sequence visualization of car 1 has different colors (yellow) during work time (Fig. 3-2(b)). This implies that GPS data of car one may have uncertainty. We closely look at the trajectory of car one and find it shit a distance on the whole (Fig. 3-2(a)). We fix this error by adding a shift on this trajectory (Fig. 3-2(c)). After this process, this parking sequence is consistent with other sequences (Fig. 3-2(d)).
By varying the thresholds, our system can get exact matches between the credit cards and vehicles. We provide the final result of the vehicle-card matching matrix in Fig. 3-3.
Please limit your response to 8 images and 500 words.
We propose a visual analysis pipeline to cluster the employees of GASTech based on the parking event sequence. As we only consider informal or unofficial relationships, we first remove all the parking events near the GAStech. Then propose an event sequence matching algorithm to calculate the similarity among each pair of parking event sequences. For a pair of parking events from two vehicles, if their distance is less than a distance threshold, and the time intersection is less than a time threshold, we call the two parking events are matched (Fig. 4-1 (a)). The similarity between the two parking sequences is the number of matches. We calculate similarities between each pair of parking sequences and get the similarity matrix (Fig. 4-2 (b)). We then use a spectral clustering algorithm to cluster the sequences and rank the similarity matrix. Analysts can interactively finetune the parameters to adjust the clustering results.
Please limit your response to 10 images and 500 words.
We propose an interactive method to discover the locations where suspicious activity is occurring. Analysts first examine the heatmap of the parking locations. If hot spots have nothing to do with known locations, these locations are suspicious. Analysts can draw a circle over the suspicious hotspot, and the corresponding parking events will be highlighted in the sequence visualization. By comparing the similarity between highlighted sequences, we can uncover the suspicious activities. We summarize the locations and activities below.
Activity 1: Brand Tempestad and Elasa Orila have four times date at the Chostus hotel during the work days (Fig. 5-1).
Activity 2: Inga Ferro, Loreto Bodrogi, Isia Vann, and Hennie Osvaldo always meet together at the Frydo's AutoSupply N' More after work (Fig. 5-2).
Activity 3: Willem Vasco-Pais, Ingrid Barranco, and Ada Campo-Corrente meet at the Desafio Golf Course during weekends (Fig. 5-3).
Activity 4: We select the home of Lars Azada on the map and find there are fifteen persons have a party during the night on January 10th. (Fig. 5-4).
Activity 5: Truck drivers 101, 106, and 107 regularly went to Abila at midnight.
We did not solve the mini-challenge in 2014.