This answer sheet should be used for your VAST Challenge 2021
Mini-Challenge 2 submission. Please maintain the .htm format and make sure that
all hyperlinks are relative to the answer form.
Rename this form "index.htm" for your submission. Remove these instructions and any other
example text below that is highlighted in yellow. Please see the
"Submission Instructions" at https://vast-challenge.github.io/2021/
for more detailed instructions.
Entry Name:
"UKN-Kerl-MC2"
VAST
Challenge 2021
Mini-Challenge 2
Team Members:
Tilman Kerl, University of
Konstanz, tilman.kerl@uni-konstanz.de
PRIMARY
Robin Gerling, University of
Konstanz, robin.gerling@uni-konstanz.de
Adam Norris, University of
Konstanz, adam.norris@uni-konstanz.de
Pia Tschepella, University of
Konstanz, pia.tschepella@uni-konstanz.de
Eren Cakmak, University of
Konstanz, cakmak@dbvis.inf.uni-konstanz.de
Juri Buchmller, University of
Konstanz, buchmueller@dbvis.inf.uni-konstanz.de
Daniel A. Keim, University of
Konstanz, keim@uni-konstanz.de
Student
Team: YES
Tools Used:
Python
KNIME, developed by the University of
Konstanz (https://www.knime.org/)
QGis, a cross-platform free and open source desktop geographic information system
application (http://www.qgis.org/de/site/)
Abila-Investigation-Support,
our own interactive visualization and exploratory tool, privately developed by T.Kerl, R.Gerling,
A.Norris, P.Tschepella in
Konstanz, Germany
Approximately how many
hours were spent working on this submission in total?
Approximately
250 hours
May we post your submission
in the Visual Analytics Benchmark Repository after VAST Challenge 2021 is
complete? YES
Video
https://www.youtube.com/watch?v=5TsLMTIjlTU
As a visual analytics expert assisting law
enforcement, your mission is to identify which GASTech
employees made which purchases and identify suspicious patterns of behavior.. You must cope with uncertainties that result from
missing, conflicting, and imperfect data to make recommendations for further
investigation.
Use visual analytics to analyze the available data and develop responses
to the questions below. In addition, prepare a video that shows how you used
visual analytics to solve this challenge. Submission instructions are available
here. Entry forms are available for download below.
Questions
1 Using just the credit and loyalty card data,
identify the most popular locations, and when they are popular. What anomalies
do you see? What corrections would you recommend to correct
these anomalies? Please limit your answer to 8 images and 300 words.
|
Procedure |
|
First, we merged the credit and loyalty card
files based on location, time and price to get a
full overview of all transactions. Afterward, we calculated how many
transactions occurred an daily, hourly and within a 10
minute time window at a specific location to determine its
popularity. |
Most popular
locations
|
Explanation |
Evidence |
|
The heatmap shows that restaurants
Katerinas Caf, Hippokampus, Brewve Been Served, Guys Gyros and Hollowed
Grounds are most popular. |
Figure 1: Number of
transactions per location and day |
Popular
times
|
Explanation |
Evidence |
|
Katerinas Caf From Figure 2a we can infer that its popular nearly
every day with a slight decrease on Wednesday, Fridays
and Sundays. Figure 2b shows that many visits occur around 1 PM and 8 PM. |
|
|
Hippokampus Figure 3a shows that Hippokampus
is popular every day except for the second weekend where transactions drop
from about 16 to 10 resp. 9 transactions. Figure 3b shows that it is
frequented around 1 PM and 8 PM. |
|
|
Brewve Been Served We can see that Brewve
Been Served is popular each weekday but no transactions occur on
weekends. During the daytime, its popular around 7
AM. |
|
|
Guys Gyros Guys Gyros is especially popular on weekdays and
its frequently visited around 1 PM and 8 PM. On the weekend, its mainly
visited in the afternoon. |
|
|
Hollowed Grounds It is only popular on weekdays and frequently
visited around 8 AM. |
|
Anomalies
& Recommended Corrections
|
Anomalies |
Evidence |
Recommended Corrections |
|
There seem to be more transactions on the second Sunday
especially around 8 PM at Guys Gyros. |
Figure 7: a) shows the number of transactions at
all locations and during the entire two weeks whereas b) only shows the number
of transactions at Guys Gyros during the entire two weeks |
No correction because it probably reflects reality. |
|
At locations Brewed Awakenings, Bean There
Done That, Jacks Magical Beans and Coffee Shack, all transactions occur
at exactly 12 AM. |
Figure 8: Time of transactions at the respective
locations. In a) we can see the time of transactions for Brewed Awakenings
during the two weeks, in b) there are the transactions of Bean There Done
That, in c) are the transactions for Jacks Magical Beans and in d) those for
Coffee Shack |
We assume that there are problems with the card
reader and therefore we would recommend adding the gps
data (cf. Task 2) to more precisely determine when the transaction occurred. |
2 Add the vehicle data to
your analysis of the credit and loyalty card data. How does your assessment of
the anomalies in question 1 change based on this new data? What discrepancies
between vehicle, credit, and loyalty card data do you find? Please limit your
answer to 8 images and 500 words.
Change in
assessment of anomalies detected in question 1
|
Evidence |
|
|
Anomaly Changed assessment |
Figure 9: In a) we
can see transactions by location zoomed in on Monday, 13thth based
on loyalty card and credit card data and in b) we can see the same snippet
but this time gps data was added |
Discrepancies
between vehicle, credit and loyalty card data
|
Discrepancies |
Evidence |
|
When examining only
the credit card and loyalty card data, we might conclude that the outlier 10k
transaction was executed by Car 1 (Nils Calixto), because his loyalty card
in another transaction could be matched using the last several digits of the
credit card. However, when we take the gps data
into account, we can clearly see the discrepancy and are able to associate Car 24
(Minke Mies) with this suspicious transaction. |
Figure 10: The same
Credit Card (last 4 numbers identical) was used in a time-interval of 10
minutes on different sides of the city.
Figure 11: Using the maps filter on the left hand side, all cars and the time
interval from 6 PM to 8 PM were selected and the trajectories are mapped in the
middle accordingly. On the right, we can see that in the pixel visualization
the highest transaction occurs on Monday 13 and we
can also see more information regarding the transactions in this time interval. |
|
When we look at Figure 12
we can see that there were transaction during the night but according to gps data, no one drove to the Kronos Mart. Ovan was in the car at that time but he didnt pass Kronos
Mart. Therefore we have a discrepancy between card data and gps data which we cannot resolve, because we would need
to track also where
they walk by foot to match every transaction. |
Figure
12: In part a) we filtered all cars in the time interval of Saturday
11th 10 PM to Sunday 12th 8 AM and in the middle the
respective trajectories are shown. Kronos Mart and the transaction are
highlighted. On the right side we can see in the Pixel Visualization that
there were transaction in the middle of the night at Kronos Mart. Part b)
shows exactly the same except that the time interval is Saturday 18th
10 PM to Sunday 19th 8 AM |
3 Can you infer the
owners of each credit card and loyalty card? What is your evidence? Where are there uncertainties in your method? Where are there uncertainties in the data? Please limit your answer
to 8 images and 500 words.
Inference
of owners
|
Evidence |
|
|
We successfully inferred the owners of 32 cars via matching transaction
data with GPS data. In doing so, we created a start-stop table and whenever
a car stopped for more than 30 seconds we considered
this a potential POI. As for accuracy, we used a range of 50m, so that for
example a parking lot would still count towards a respective POI. We then associated a loyalty-card with all possible
transactions and the cars which did not drive at the time of the
transaction. Then we observed how often this matches all cards
and if one possible car would drive at a later transaction with this loyalty
card. If a car was supposedly often at a place but the coordinates
variated more than 50m, the car was discarded. When we look at Figure 13 we can see some examples where gps
route of a person and its transactions coincide. In this case Calzas and Frentes
loyalty card was used at Bean There Done That and according to gps data they also stayed there when the transaction took
place. We can also see this in our gantt chart in
Figure 14 because the presence of a person in a specific location and its
loyalty card transaction time overlap (Transaction periods were extended for the purpose of visualization with the end being the exact time of the transaction). |
Figure 13: The trajectories
of all persons in the time interval from Tuesday 7th 7:30 AM to Tuesday
7th 8 AM were mapped and we look at the transactions at Bean There
Done That
Figure 14: The time the
employees spent at a restaurant and the time of their loyalty card
transaction is shown below the respective person |
Uncertainties
in our method
|
Evidence |
|
|
Some cars only match
with a few transaction locations, thus a wrong assignment might be possible.
Furthermore there are a few
locations that have transactions on the same day and the same amount very
close to each other timewise. This occurs for example in the following transactions
which can also be seen in Figure 15
"01/11/2014","19:29","Hippokampos","63.21","L2070"
"01/11/2014","19:45","Hippokampos","63.21","L2070" This might be a result of the merge of credit card
and loyalty card data. Interesting is that both transactions have different
credit card numbers. |
Figure 15: Transactions
on Saturday 11th between 19:33 and 19:45 at Hippokampus
|
Uncertainties
in the data
|
Evidence |
|
|
As we have seen in Figure 10, the last four credit
card numbers in the data are not unique and one employee can have multiple
credit cards, therefore no definite assignments are possible. Therefore we assigned some transaction like the 10k
transaction manually. |
|
|
Trucks can be assigned to loyalty card at a specific
time, but not to person in general |
|
|
We would recommend checking whether this is due to a
technical issue or because they are trying to disguise what shes doing. |
Figure 16: In part
a) we can see the trajectory of Borassca for the
entire two weeks and in part b) there is the trajectory of Calvaz
on Thursday 9th |
4 Given the data sources
provided, identify potential informal or unofficial relationships among GASTech personnel. Provide evidence for these
relationships. Please limit your response to 8 images and 500 words.
|
Informal/Unofficial relationships |
Evidence |
|
Who - Brand Tempestad Relationship In Figure 17 we can see that they meet four times at
12 PM at the Chostus Hotel. This may indicate an
affair or another unofficial relationship. |
Figure 17: Time that
Brand Tempestad and Elsa Orilla
spent at the Chostus Hotel |
|
Who Relationship |
Figure 18: Time that
the executive spent on the Desafio Golf Court |
|
Who Relationship |
Figure
19: Homes of the of the persons living together |
|
Who Relationship Therefore we would recommend to interview Dedos and Frente in case they know something. |
Figure 20: Time which Brigitta
Frente, Lidelse Dedos and Hennie Osvaldo spent at the respective homes |
|
Who Relationship |
Figure 21 a) Overview
over the number of meetings of all persons. The matrix is ordered based on
the amount of meatings and the opacity maps the number of meetings whereas
the color codes the occupation. Figure 21 b): Time the
persons spent at several restaurants |
|
Who Relationships |
Figure 22: People
meeting at Lars Azadas home on Friday 11th |
5 Do you see evidence of
suspicious activity? Identify 1- 10 locations where you believe the suspicious
activity is occurring, and why Please
limit your response to 10 images and 500 words.
|
Locations of suspicious activity |
Evidence |
|
Location Executives homes (except Jorge Sanjorge
Jr. who seems to live in the Chostus Hotel the
second weekend and was absent before) Who - Hennie Osvaldo Suspicious activity |
Figure 23: Overlapping
time periods where Osvaldo, Mies, Bodgrogi and Vann were at or near the
respective executives homes |
|
Location 5 unknown locations Who - Minke Mies Suspicious activity |
Figure 24: On the right
side we can see the trajectories from the respective persons being used and
the unknown location indicated by a circle. On the right side we can see who
was when at which location. |
|
Location Kronos Mart Who Minke Mies (cf. Task 2) Suspicious activity As we can see in the pixel visualization in Figure 25,
there were transaction both Sundays during nighttime at around 3 AM. We would recommend to go to Kronos Mart to ask who did those transactions. |
Figure 25: On the
left we selected the trajectories of all cars on Sunday 12 between 1 AM and 5
PM which would be shown on the map in the middle if there were any at that
time. The map also shows the transaction on Sunday 12 at 3:39 AM. On the
right side there is the pixel visualization showing all transactions over the
two weeks (first column from top to bottom Monday 01 to Sunday 12 and second
column from Monday 12 to Sunday 19). |
|
Location Who Suspicious activity |
Figure 26: On the left side all cars and the time
interval from 6 PM to 8 PM was chosen and the trajectories are mapped in the
middle accordingly. On the right we can see that in the pixel visualization
the highest transaction occurs on Monday 13 and we
are offered more information about the transactions in this tim interval.
Figure 27: We can see who was at Frydos
Autosupply n More within the two weeks. Additionally the weekends are marked with red rectangles
as well as Vann and Osvaldo since they belong to the group of suspicious
suspects. |
|
Location Who Suspicious activity |
Figure 28: Time being
spent at GASTech at Friday 17th. |
|
Location Who Suspicious activity |
Figure 29: Time being
spent at GASTech |
|
Location Who Suspicious activity |
Figure 30: Time spent
at unknown location |
6 If you solved this
mini-challenge in 2014, how did you approach it differently this year?
We did not solve this mini-challenge
in 2014.