VAST Challenge 2021
Mini-Challenge 3
Yes
380 hours
Yes
On January 23, 2014, multiple events unfolded in Abila. You’ve been asked to come in to perform a retrospective analysis based on limited information about what took place. Your goal is to identify risks and how they could have been mitigated more effectively.
You have access to a single data stream containing two major sources:
From this data, can you evaluate the changing levels of risk to the public and recommend actions?
You also have access to maps of Abila and background documents as well. (Note: these are the same materials provided in Mini-Challenge 1 and Mini-Challenge 2)
Use visual analytics to analyze the available data and develop responses to the questions to be provided. In addition, prepare a video that shows how you used visual analytics to solve this challenge.
Please limit your answer to 8 images and 500 words.
We develop an visual analysis system that allows analysts to build a classification tree interactively to identify different text types when browsing messages. As shown in Figure 1-1, the system can organize messages by keyword,author, and tag. Message panel is used to display messages that are related to a specific role. We create the "event-related" and "event-unrelated" to the two parent types. Then we notice that most of the top authors only posted certain types of messages, such as KronosQuoth who always posted chicken soup. As a result, we can quickly build the classification tree according to the author's information. The final classification tree consists of 8 types, namely "witness reports", "media", "pok opponents", "pok supporters", "chicken soup", "nonsense junk", "typical chatter" and "advertisement". The specific construction steps are shown in Table 1. Some of the identified features are shown in the "Reason" column.
| Serial number | Operation | Reason |
|---|---|---|
| 1 | Add the "event-related" node and the "event-unrelated" node to the tree node. | The analysis result of 300 microblogs that we randomly selected first shows that the microblogs can be obviously devided into "event-related" and "event-unrelated". |
| 2 | Add the "chicken soup" node to the "event-unrelated" node. Assign the messages posted by KronosQuoth to this node. | Confirm that these messages are "chicken soup" by browsing the messages posted by this author. |
| 3 | Add the "nonsense junk" node to the "event-unrelated" node. Assign the messages posted by Clevvah4Evah to this node. | In the message panel, we can see that the messages posted by this author are nonsense and fragmented. | 4 | Add the "witness reports" node to the "event-related" node. Assign the messages posted by megaMan to this node. | The time distribution and content of the messages show that megaMan was a witness to the "handoff" event and was following the development of the entire event. | 5 | Add the "media" node to the "event-related" node. Assign the messages posted by AbilaPost to this node. | The messages objectively describe the evolution of the event in written language. The author's name, AbilaPost, also provides a clue. | 6 | Assign the messages posted by Homelandlllumination, KronosStar, CentralBulletin, NewsOnlineToday, InternationalNews to the "media" node. | Same as above. | 7 | Assign the messages posted by POK to the "witness reports" node. | The content of the messages shows that POK was the official account of pok and recorded the progress of the "Pok rally". | 8 | Assign the messages posted by truccotrucco to the "witness reports" node. | The time distribution and content of the messages show that the author participated in the "Pok rally" and witnessed the "hit-and-run, hostage and standoff" event. | 9 | Add the "pok opponents" node to the "event-related" node. Assign the messages posted by FriendsOfKronos and choconibbs to this node. | The content shows that the messages posted by FriendsOfKronos and choconibbs mostly criticised pok. | 10 | Add the "typical chatter" node to the "event-unrelated" node. Assign the messages whose first letter is "@" to this node. | Many messages posted by choconibbs were event-unrelated typical chatter. These messages have a fixed pattern, starting with "@" and chat object. | 11 | Add the "pok supporters" node to the "event-related" node. In this node, highlight the microblogs posted by ourcountryourrights. | The content of the messages shows that ourcountryourrights supported pok. | 12 | Add the "advertisement" node to the "event-unrelated" node. Assign the messages that contain "kronos/" to this node. | SaveOurWildlands posted many ads to introduce Sow. The messages tagged " badcredit" promote credit-enhancing services. These ads always have a link that contains "kronos/". | 13 | Assign the messages of roger_roger, protoGuy, maha_Homeland, GreyCatCollectibles, panopticon, prettyRain to node "witness reports". | roger_roger and prettyRain were trapped in the store. Panopticon and protoGuy were witnesses to the "handoff" event. GreyCatCollectibles was living in the dancing dolphin apartment. The Pok rally was recorded by maha_Homeland. | 14 | Assign messages posted by trollingsnark to the "nonsense junk" node. | trollinigsnark seems to be anti-government. |
* When a message is added to a node, the messages that forward it are also added to the same node.
To explore, understand and compare the properties of each type in different aspects, we develop Visual Analysis System 2 as shown in Figure 1-2. The map panel on the left places similar messages close to each other. The distribution of types shows that the classification is meaningful. The detail panel on the right shows the statistics for a particular type of attention across multiple dimensions. Figure 1-3 summarizes the details of each type. Some obvious features include:
1. Witness reports mainly covered the hit-and-run, hostage, and standoff , while the media was more concerned with the fire in dancing dolphin. Both posted relatively little messages involved in the Pok rally. The media tended to use more neutral language for objective descriptions compared to the witnesses, and the influence of media (average forward number) is much higher.
2. Pok opponents, such as FriendOfKronos and choconibbs, labeled pok and its supporters as terrorists and had a serious negative view of them. The pok supporters, represented by ourcountryourrights, accused the government of corruption and corporate greed. They pointed out that the government must be held accountable. In contrast, pok proponents were more subjective.
3. KronosQuoth continuously and regularly posted more than 1,000 chicken soup messages, mainly about success and life, with more positive emotions.
4. The theme semantics of nonsense junk were not coherent. Most of them were posted by Clevvah4Evah and trollingsnark, carrying the tags grammar, pok and rally.
5. Many promotional messages revolved around credit cards, weight loss and finding a job. They often had a long word.
6. Typical chatter messages have the obvious slang characteristics. The main chatterers were megaMan and choconibbs, who talked about the event of "hostage and standoff".
* The characteristic words of the word cloud are obtained by the g2-statistical. The emotion is
obtained by xx. The target is obtained by xx.
* First, the tf-idf vector of the message is calculated, and then the vector is reduced to 2
dimensions using pca and t-sne.
* The messages that contain less than 3 words are filtered out.
Figure 1-4 shows the difference between the event-related messages and the event-unrelated messages from the classical statistical perspective (a) and from the classifier perspective (b). Each word in the figure is a characteristic word that can distinguish the two types. The word with a greater meaning/importance has a stronger ability to discriminate. We can see that the characteristic words of the event report have a high correlation with the event, including cop, van, guy, fire, police, newman, standoff, rally, etc. The most significant characteristic words of the non-event messages are the chicken soup message words, including life, it, success, don't, dream, thing, etc. Overall, the characteristic words on the classical statistical perspective and the classifier perspective show little difference.
* We define that the narrow event reports include only witness reports, the generalized event
reports include all types of Figure 1-3(a), and the event-unrelated messages include all types of
Figure 1-3(b). The number of messages is 2223 (narrow) /3306 (generalized). Tags have been removed in the
text
processing of the two types.
* The 2/3 of messages are used for training and the 1/3 of messages are used for testing.
The accuracy of the binary random forest classifier is 93.1% (narrow) / 95.2% (generalized). We use the tf value
in each type as the basis for which type the characteristic word belongs to.
* Warning: Most of the witness reports focus on the hit-and-run, hostage and standoff event.
Please limit your answer to 10 images and 1000 words.
First, we capture message correlated with the three events based on the procedure shown in Figure 2-1.
The Visual Analysis System 3 focuses on analyzing the evolution of public risk level from gross to specific. Figure 2-2 and Figure 2-3 show the four components and the interactive logic of the system.
As shown in Fig. 2-4, we can roughly analyze the evolution of public risk level over part a and part b of Visual Analysis System 3. And we discover：
1. Pok rally mainly took place in the period from 17:00 to 19:20. In rally, people who attended may be injured by possible violence.
2. Fire in dancing dolphin broke out at around 18:40. At that time, the main risk to the public turned into a serious threat to the safety of the dancing dolphin apartment and surrounding residents. This risk still existed at the end of the record.
3. The hit-and-run, hostage and standoff can be divided into two events. The first event, hit-and-run, occured from 19:18 to 19:36. The pedestrians and vehicles along the way might be affected by gunshots and car accidents, which cause the public risk evolved into high level. The second event, hostage and standoff, lasted from 19:40 to 21:27. The lives of the hostages and customers trapped in the store were threatened, causing the risk level evolved into higher level than before. During this time period, Abila was at risk of a fire and a kidnapping at the same time.
The approximate time period for each type of risk can only be estimated according to the distribution of message, which is not accurate and does not allow to identify the specific changes in each type of risk. Therefore, we will next do a more detailed and precise analysis by identifying sub-events.
As shown in Figure 2-5, we divide the events related to the Pok rally into three types: POK rally progress (blue), Number of POK rally participants and police (orange), and The rally's Atmosphere (green). We are concerned about the risk of violence. The number of people involved is defined as the number of audiences attending the rally. Violent events may threaten the lives of audiences. The evolution of the risk level is as follows：
| Time | Risk level evolution | Event-based interpretation | The number of people involved |
|---|---|---|---|
| 17:00 – 17:20 | Risk was rising rapidly. | Crowds poured into the park, with lots of police presence and a tense atmosphere. | At 17:19, over 900 people gathered. |
| 17:16 -17:26 | Risk was further increasing. | Lucio Jakab gave a speech and was cheered by the audience. During this time, the crowd continued to grow. | At 17:26, roughly 1,200 people. |
| 17:27 – 17:48 | Risk reached a small peak. | Viktor-E played River Soilders and Big Yellow River and received enthusiastic reactions from the audience. | Some audience said the number of people involved reached 2,000, which remained to be confirmed. |
| 17:49 – 18:45 | The risk continued to grow slowly. | Lorenzo Di Stefano and Audrey Newman gave speeches. The audiences were encouraged. | The number of people involved was estimated between 1,000 and 1,500 people with a small change. |
| 18:45 | Risk rised slightly to peak. | Viktor-E played "Stand up speak up" and the atmosphere peaked. | The number of people involved was estimated between 1,000 and 1,500 people with a small change. |
| 18:57 | Risk started to go down. | Sylvia, the leader of pok, made a speech of thanks. After the rally, Viktor continued to perform for an hour. | Began to drop. |
| 19:00-20:13 | Risk gradually decreased to zero. | The report showed the violence never happened and police evacuated at 19:46. | Continued to drop. |
As shown in Figure 2-6, we have identified three main types of fire-related events: fire behavior (blue), rescue force dispatch (orange), and evacuation and casualties (green). We focus on the risks of personal injury and property damage. The risk level evolution is as follows:
| Time | Risk level evolution | Event-based interpretation | The number of people involved |
|---|---|---|---|
| 18:25 | Risk appeared. | Smoke on the roof heralded a fire. | Less than 10 people. |
| 18:42 -18:55 | Risk was rising rapidly. | Fire trucks, ambulances and police were dispatched and arrived on scene in turn, began rescuing and evacuating residents and crowds. | Only the residents of the dancing dolphin apartment, estimated to be less than 80 people. |
| 19:00 | Risk droped. | Some reports showed that there were no serious injuries and one trapped resident was rescued, most residents have been evacuated. | Only the residents of the dancing dolphin apartment, estimated to be less than 80 people. |
| 19:22 – 20:07 | Risk Continued to increase. | The evacuation area expanded, the fire continued and spread. | Extended to surrounding residents, rapidly rising to an estimated over 200 people. |
| 20:25 | Risk droped rapidly. | The media said the fire might be under control. | No more rose. |
| 20:30-20:50 | Risk was rising Suddenly. | The top floor collapsed and the fire suddenly escalated. Another fire truck was dispatched and arrived. Firefighters began to protect the surrounding buildings. | Began to rise, estimated over 300 people. |
| 21:15 | Risk droped sharply. | AFD and many media reported that the fire was almost under control. | No further increased. |
| 21:30 | Risk rose sharply. | The apartment exploded. | Rose rapidly. |
We have noticed that the fire in dancing dolphin has caused public anxiety and panic, in particular some residents were at risk of homelessness. The spread of the fire could result that residents of the entire street will not be able to live normally for a long time and shops will not be able to open.
As shown in Figure 2-7, we divide events related to hit-and-run, hostage and standoff into three types: "hit-and-run", "people injured, trapped and rescued" and "standoff progress". We focus on the risk of injury and death to people, and the risk level evolution is as follows:
| Time | Risk level evolution | Event-based interpretation | The number of people involved |
|---|---|---|---|
| 19:18-19:36 | The risk of serious traffic accidents and fatalities has been increasing. | A black van hit a car (19:18) and a bicyclist (19:21) one after another, and ran through a red light during the escape (19:36). | The people at risk were pedestrians and vehicles on the way. |
| 19:40 | Risk rose sharply. | The accident vehicle was forced to park in the parking lot. There was an exchange of gunfire between the police and the gunmen and a police officer was shot. | The police and the people nearby. |
| 19:41-19:58 | Risk further rose. | Some customers were trapped in Gelatogalore. The gunmen were mentally unstable and were holding hostages. | The number of customers and hostages in the store was estimated to be less than 50. |
| 20:00-20:10 | Risk reduced. | Police set up a perimeter, some customers fled the store, and police and gunmen began negotiations. | The number of people is estimated at less than 20. |
| 20:14 | Risk was slowly increasing. | Found that some customers were still trapped in Gelatogalore. | Unchanged. |
| 20:14-20:30 | Risk was slowly increasing. | The emotion of the gunmen was unstable and the number of onlookers was about 200. | The onlookers were slightly threatened |
| 20:30-20:32 | There is a brief fluctuation in risk. | It was noted that two children were running around, which obviously increased the risk suddenly. At 20:32, the two children were apprehended and the risk was reduced to before. | The number of customers and hostages in the store was estimated to be no more than 20. |
| 20:32-21:00 | Risk slowly receded. | The police and the gunmen negotiated. | Unchanged. |
| 21:01 | A sudden drop in risk. | Two gunmen were having an argument. | Rapid increased. |
| 21:13 | Risk was reduced to zero. | Gunmen surrendered. | Hostages and trapped customers were rescued and the number became zero. |
As shown in Figure 2-8, based on the message (gray squares) with geographic information, we can easily determine the locations of the three events. Then, based on the location and the name of the call center data, we identified the call associated with the three types of events. Then we connected the calls in chronological order on the map and obtained the route of the vehicle that caused the accident. We noticed that the "hit a car" event occurred near the fired dancing dolphin apartment, which means a possible correlation between fire and "hit a car". The accident vehicle arrived at 19:36 near the park, while the concert at the rally was in full swing. Although some of the crowd left the park, the number of people in the park was still estimated to be more than 1,000. At that time, the unstable gunmen could have caused a serious traffic accidents. Even more frightening, the gunmen could enter the park to take more hostages or even shot directly at the crowd. This will cause mass casualties, and mass panic would further increase the number of casualties. The red spike in Figure 2-7 reflects this possibility and corrects the risk.
For retrospective analysis, we would send the first responders to the dancing dolphin apartment that was on fire. The reasons are as follows.
1. We consider that the gunmen were hiding in or near the dancing dolphin apartment and had to flee with the hostages on account of the fire. This is because, as can be seen in Figure 2-8, the gunmen were first seen near the apartment when the car crash occurred at 19:18. The fire in dancing dolphin was growing and the police were evacuating the residents at that time. A possible speculation is that the fire was the trigger for the hit-and-run and standoff.
2. The fire drew a large police presence to evacuate the crowd and maintain order, which may have led to a lack of police presence during the initial stages of the standoff. If first responders could have been dispatched to extinguish the fire in the initial stages, the risk of casualties in the standoff would have been reduced by the availability of a more adequate police presence, even if the gunmen had escaped.
3. Compared to the other two events, the fire actually caused the most casualties and property damage, affected the greatest number of people, and had the longest lasting effects. Residents and firefighters were injured during the fire; it is not known if all apartment residents were evacuated; the fire was never fully contained and even spread to the surrounding building; and finally, an explosion occurred after which serious hazards may continue to occur. In the short term, residents of the apartments will be homeless and the surrounding area will be in shock; in the long term, the surrounding buildings and businesses may require extended maintenance and closure. In contrast, the effects of the standoff were short-lived and minor, and the Pok rally eventually ended in peace.
For real-time analysis, we would send the first responders to the Pok rally for the following reasons.
1. The possibility of mass violence was high. The Pok rally had a large number of participants and the arguments for and against POK had long been known. Moreover, with the inspiration for the speeches and the atmosphere at the venue, the potential for large-scale conflict was very high.
2. If a large-scale conflict were to break out, the cost would be enormous. In the short term, the safety of the thousands of people attending the rally was at risk; in the long term, due to the close relationship between GAStech, which vehemently opposes POK, and the government, the conflict between the three could intensify, causing long-term political and economic unrest in the city.
3. The rally took place before the other two events and was a crucial event, meaning that its risk was predictable.
Our lab participated in this challenge in 2014 when the participating students graduated, and by analysing their responses we found two differences between our current approach and theirs.
1. We have taken a systematic approach to analysis. By starting from potential analysts and giving more freedom to the analysts (not just us who answer the questions now, but rather the actual users in the actual scenario) to explore and understand the data, we can help them record the information they find and form their own answers. For example, when identifying different content types (Visual Analysis System 1), analysts have the freedom to construct classification trees based on their understanding of the content of messages; when analysing risk evolution (Visual Analysis System 3), they can fit curves based on the clues identified by the analysts. This approach is more valuable for the analyses that are more subjective than models and calculations, and for the analyses that require lengthy exploration rather than "at a glance."
2. Because it is a retrospective analysis, it is possible to take a holistic to local, coarse to fine-grained approach, which is what we do in analysing the evolution of risk.