Entry Name: "PKU-Yuan-MC3"

VAST Challenge 2021
Mini-Challenge 3

Team Members:

Hanning Shao, Peking University, hanning.shao@pku.edu.cn PRIMARY

Chiteng Ma, Peking University, 1800013082@pku.edu.cn

Zhen Li, Peking University, zhenli.vis@gmail.com

Zheng Fang, Peking University, 1900013065@pku.edu.cn

Chuanming Huang, QI-ANXIN, huangchuanming@qianxin.com

Liang Tang, QI-ANXIN, tangliang@qianxin.com

Qinghua Shang, QI-ANXIN, shangqinghua@qianxin.com

Zixi Fu, QI-ANXIN, fuzixi@qianxin.com

Zhuo Zhang, QI-ANXIN, zhangzhuo@qianxin.com

Xiaoru Yuan, Peking University, xiaoru.yuan@pku.edu.cn ADVISER

Student Team: YES

Tools Used:

Microblog Data Analyzer, developed by Hanning Shao, Chiteng Ma, Zhen Li and Zheng Fang, which includes four views visualizing the relations between messages, keywords, time and locations. It is built on HTML5 technology in JavaScript.

Stanford NLP Tools, http://www-nlp.stanford.edu/.

Python script for data processing.

Approximately how many hours were spent working on this submission in total?

200 hours.

May we post your submission in the Visual Analytics Benchmark Repository after VAST Challenge 2021 is complete? YES

Video

We do not have a video yet.

Use visual analytics to analyze the available data and develop responses to the questions to be provided. In addition, prepare a video that shows how you used visual analytics to solve this challenge. 

Questions

1 –– Using visual analytics, characterize the different types of content in the dataset. What distinguishes meaningful event reports from typical chatter from junk or spam? Please limit your answer to 8 images and 500 words.

(1) Meaningful event reports

We first distinguish meaningful event reports from other messages. Accounts of the authorities and social media would give believable reports on these events and common people would retransmit these reports. From Fig 1.1 we can easily find messages that had been retransmitted many times and these messages are considered as meaningful event reports.

Fig 1.1 Each circle represents one message and the size of circles encode the number of retransmissions while the links between show retransmitting relation.

Besides, Fig 1.2 shows the number of messages that were sent each time step. When something happens, the number would increase largely, and this would guide us to meaningful event reports too. We checked the time when considerable messages are sent. By selecting and reading the detailed information of messages with large retransmissions, we can learn about what happened at the time.

Fig 1.2 The number of messages sent during the time.

Totally, three main events are recognized —— the POK rally at the City Park, the fire at Dancing Dolphin building and the standoff between two gunmen and the police. Each event would go through several stages. All messages from accounts of the authority’s departments and social media are considered as meaningful event reports. And some messages from individuals that provides information closely related to these three events are also identified as meaningful event reports.

(2) Junk or spam

Some accounts sent out large number of messages at all times but never included any useful information. Fig 1.3 shows clustered messages from two example accounts, @KronosQuoth and @Clevvah4Evah. @KronosQuoth sent out over 1400 messages but all these contained only aphorisms, so as @Clevvah4Evah. As a result, messages from these kinds of accounts are considered as junk and spam.

Additionally, junk and spam have their own patterns —— most of them have an URL in form of *.*/*, like "badprofiles.kronos/tacky". By searching for this pattern, we can distinguish junk and spam from others. Several accounts that only sent junk and spam are recognized —— @whiteprotein, @supplementsRule, @slamrjamr, @rockinHW, @reggierockin776 and so on. Besides, some messages from organization accounts like POK and SaveOurWildlands also contained an URL. These messages serve as advertisements for their websites and articles, so they are also considered as junk and spam.

Fig 1.3 Three clusters of messages and some examples of detailed information.

(3) Typical chatters

Messages other than event reports and junks are considered as typical chatters. These messages usually came from individual accounts. The contents of these messages are usually fearing expressions, complaints or other trifles. For example, @GreyCatCollectibles said “They've been ripping up our building for weeks now - when will it stop?” and @yomamma sent “Somethings going on across the street - dogs are going crazy”. These messages talk about authors’ seeing and feeling.

2 – Use visual analytics to represent and evaluate how the level of the risk to the public evolves over the course of the evening. Consider the potential consequences of the situation and the number of people who could be affected. Please limit your answer to 10 images and 1000 words.

We designed an interactive force-directed view to analysis the relations between keywords. On this view, keywords are encoded as circles and the size represents the frequency of certain keywords. Links between keywords represents the relations within two words. The relations would be stronger when the number of messages that contains two words simultaneously is larger. Through interacting with the view, we can group keywords that belong to the same event. Fig 2.1 gives an overview of how we identify an event and find some details of that.

Fig 2.1 The overview pipeline of identify an event.

Take the event of fire at Dancing Dolphin Building for example. First, we noted that there should be an event taken place around 18:40, since the number of messages grew dramatically. As showing in Fig 2.2, selecting the time range around this point, we can see messages sent during this time. By checking the details of messages with large retransmissions, we learn that there was a fire.

Fig 2.2 Selected the time range and noted that there was a fire at that time.

The keyword "fire" could also be found in the relation force graph, as shown in Fig 2.3-A, and there are more related keywords around due to the characteristic of force-directed graph. We can search these keywords in the message view and put them into the context. For example, we check the interesting phrase "dancing dolphin" and messages that mention this phrase are colored red, as shown in Fig 2.3-B. From these messages, we learn that Dancing Dolphin Building was on fire. Combining with the information got before, we can conclude that there was a fire at Dancing Dolphin Building, which stands at Achilleos & Madeg.

As shown in Fig 2.3-C, we can interactively set tag 'fire' for known keywords related to this event on the force-directed view to find more related words. These keywords with the same tag 'fire' would form a group on the view and provide information for the fire event. For example, we can see from the messages with a keyword "unit" that APD sent several police units to the fire scene at around 18:42, 19:16, 20:45, which shows the risk of the fire is increasing during this time.

Fig 2.3 We seek interesting keywords on force-directed graph, and then check the messages mentioned it. In this way, we can give tags for keywords and form a group for events, like the group in C.

In the meanwhile, the call center data confirmed our findings. On Fig 2.4, we can see calls for fire units, police units, medics and so on at certain place. All information from different aspects give us a comprehensive understanding of the fire event.

Fig 2.4 The call center data are marked on the map of Abila. Calls for fire units, fire trucks and medics are located at the red star point.

Similarly, we detected three main events taken place that night using the methods above, i.e. POK rally, fire and hit & run & shot. In the following passages, we will evaluate the risk to the public of each event separately.

(1) POK rally

The POK rally began at 17:00 in the City Park and POK leader started with an opening speech. And then Dr Newman began her speech at around 18:15. The rally continued till around 19:07 and ended with a concert by band Victor-E.

To evaluate the risk and effect of this event, we focus on the number of visitors and the security measures. The number of people on the scene is an important indicator of potential risk. By selecting the messages with numbers, we know that the number of people is increasing during the first half hour of the rally, and finally around 1,200 people are in the rally scene, where lies huge security risks.

Fig 2.5 Reports of the POK rally, which provide information about the progress of the rally.

We also focus on the security measures. By checking the messages with the keyword "police" and "cops", we can see that there was a high degree of vigilance throughout the rally. The rally ended up with peace although there were large number of visitors. According to the information above, we believe the risk to the public during the whole rally is low.

Fig 2.6 Security concerns about the POK rally from the authorities and social media.

(2) The fire at Dancing Dolphin building

The risk suddenly increased at the occurrence of the fire, which was first reported at 18:41, and then APD sent two units to the scene at around 18:44. Later an evacuation of nearby buildings at Achilleos & Madeg and a traffic evacuation were conducted in succession, which expanded the number of affected people and further increased the risk. Luckily, the trapped people were rescued at 19:10. However, the fire was still out of control at that time and thus the risk kept growing. Additional polices were send to the scene at around 19:16, and the scope of evacuation was again expanded at 19:23. A firefighter was injured during the mission and was sent to the hospital, which indicated the risk was still high. At 20:45, units were again added. The units began to make the control measures for the surrounding buildings, and the risk gradually decreased. By around 21:23, the fire was finally under control, and the risk to the public dropped to a low level. However, another explosion occurred at 21:30 and several people were affected, which once again increased the security risk.

(3) Hit & run & shot

At around 19:21, someone ran into a bicyclist and ran away, and then the police began to chase him. This should have been a normal crime and effected few people, but when the driver was forced to a parking lot, a gunfight happened. A police officer was injured in Gelato Galore and sent to hospital, which led to a sharp rise of risk. At 19:41:48, some witnesses said that the gunman had hostages, therefore the risk level was further improved. The police evacuated the surrounding people at 19:44, increased the police force at 19:46 and even deployed tactical units at 19:58. And at around 20:10, a negotiation started between police and the shooters, and the atmosphere eased slightly, and the risk also decreased. The hostages were finally released at 21:15, and then the suspects were arrested. The risk finally ended. The following call center data verify the occurrence of the fire and the gunshot and show their detailed location.

Fig 2.7 The location of events on the map, which could be found from messages of call center data.

3 – If you were able to send a team of first responders to any single place, where would it be? Provide your rationale. How might your response be different if you had to respond to the events in real time rather than retrospectively? Please limit your answer to 8 images and 500 words.

We have detected three main events took place that night, and the level of risk for each event is evaluated in Q2. According to our analysis on events, we would arrange the responder team as follows.

Fig 3.1 Frequency of keywords and important time points.

From a retrospectively respect, we would first arrange the team to maintain the safety of the POK rally in the City Park from 17:00 to 18:40. After 18:40, we would arrange the team to participate in fire rescue, until the fire was under control.

The POK rally begins at 17:00, and at the same time no other events occur. We first arrange the team to maintain the order in the rally. Along with the rally, the number of people gradually increased and reached the peak. During this period of time, security risk increased. And at around 18:40, the rally went on normally and came to an end. And we have already carried out several inspections and the security measures are very strict. At that time, the rally was basically safe. But fire occurred, and it had a higher risk. So, we should arrange the team to the fire scene. At 19:21:01, the hit occurred, and the driver ran. But the fire was still out of control. It might do more harm to the people. Moreover, compared with the driver, the fire obviously had greater harm in time and covered a wider range. Once the fire was out of control, the consequences will be unimaginable. That is why we arrange the team to stay at the fire scene until the fire was effectively controlled. At about 21:23, the fire was basically under control, and at the same time, the gunmen were already arrested.

However, the arrangement of the first responder team would be different if we have to respond in real time. Every time when two or more events took place at the same time, we have to evaluate whether the new event need the team more. That might lead to different arrangement towards the first responder team. As a result, we would keep the team at the City Park until 19:00 when the rally ends. Then, the team would be sent to the fire scene. The hit & run was not risky enough till it changed to a shooting and standoff. So, the team would stay at the fire scene. When the shooting began, one police officer was injured, and the gunmen had hostages, we would send the team there, in case the situation went worse.

4 –– If you solved this mini-challenge in 2014, how did you approach it differently this year?

Compared with works in 2014, this year we employ more NLP methods. Besides the traditional tokenization methods, we also use the named entity recognition algorithm to help with important keywords recommendation. Thus, the NLP methods perform better in this year's work and largely reduce the number of keywords that we have to check.

What is more, this year we introduce a force-directed graph to visualize the relations between different words. Using this view, we can group several keywords together to form a group that all words in the group are talking about the same event. In this way, we can clearly understand information of what, where, when and how. For example, the phrase "Dancing Dolphin" and the phrase "Achilleos & Madeg" would appear in different messages, but they both have connection with the word "fire". As a result, these two phrases would get very close on the force-directed graph, though there aren’t any direct relations between them. Using this characteristic, we can find interesting keywords more easily and understand events faster.

In conclusion, this year, we combine automatic algorithms and interactive visualizations to find out the relations of keywords, and then, get a throughout understanding of events to answer questions.