Chapter 7 Link Analysis Tools Pages 201232

1
Chapter 7 Link Analysis ToolsPages 201-232

• George Adams
• Murray McKee
• Amresh Mohanlal

2
Chapter 7 Link Analysis Tools

• Link analysis is the process of building up
  networks of interconnected objects through
  relationships in order to expose patterns and
  trends.
• NETMAP
• Analysts Notebook
• Imagix 4D
• Daisy

3
NETMAP

• One of the most mature visualization systems
  available within the commercial data mining
  market
• Developed early 1980s
• Originally used to support the network mapping of
  social interactions within businesses and other
  organizations.

4
Accessing Data in NETMAP

• Data feeds must be constructed externally and an
  intermediate set of transport files need to be
  created to supply the system with data
• NETMAP reads all information in flat ASCII
  delimited format
• Through configuration files, NETMAP converts
  ASCII data into a format that is understood by
  its internal inference engine

5
Accessing Data in NETMAP

• Flat files are converted into a set of integer
  node and link matrices through a translator
  called CRDB (Create DataBase)
• These matrix structures allow you to manage large
  quantities of discrete data that can be derived
  from multiple sources

6
NetMAPs Support Functions

• NETFRONT
• Shape generator
• Font creator
• Dynamic legend-key builder
• Presentation tool called NPT
• Language constructs for performing mathematical
  and trigonometric computations, string
  comparisons and various other functions.

7
The Unconventional Displays of NETMAP

• Vectorization methods for drawing
  displaysrepresented as a line (a vector)
• Benefitany display layout can instantly be
  manipulated (zoomed, panned, windowed, and
  rotated)

8
Navigating NETMAPS Node and Link Menus

• Two Distinct Roles
• Filter the node and link matrices to include only
  specified elements from the main working set of
  data.
• Support manipulation of the appearance of the
  nodes and links within the display.

9
Navigating NETMAPS Node and Link Menus

• Node menu specifically controls which objects are
  included within the display, how they should be
  structured and their general look and feel.
• Link menu only controls what links are presented
  and how they should be depicted.

10
Figure 7.1 A typical NETMAP display
11
Figure 7.4 A sample set of NETMAP displays
12
Using Step-Link to Show Pathways

• By using Step-Link NETMAP can display the levels
  of connection from target nodes to destination
  nodes contained in the data set
• This feature lets you group nodes based on the
  number of connection steps from a predetermined
  starting group
• Step-Link are based on the identification of a
  single node such as a person, organization, or
  address rather than a group of nodes.

13
Figure 7.5 A NETMAP step-link example using a
columnar format
14
Using Step-Link to Show Pathways

• Step-Link can also be used to generate the
  shortest path between any two groups of nodes
  automatically
• Allow user to specify starting and termination
  point

15
Figure 7.6 Showing the shortest path between two
nodes in NETMAP
16
Analyzing Emergent Groups in NETMAP

• NETMAP supports the emergent group algorithm by
  slightly modifying the display format
• The trick is to define what constitutes a group
• The way the nodes are connected through will
  determine their role in the diagram (figure 7.7)

17
Emergent group display within NETMAP (figure 7.7)
18
Discrete Groups

• NETMAP can also be used to detect discrete groups
• Discrete groups are shown as satellite structures
  outside the main circular data array (figure 7.8)
• Identification of discrete groups is difficult
• The discrete group is useful for getting a quick
  understanding about various target entities,
  extent of influence for certain nodes, and
  interesting sub-networks

19
A discrete network grouping within NETMAP
20
NETMAP Presentation Tool (NPT)

• A stand alone module for displays and report
  generation
• Basic features include
• Line and shape drawing
• Text entry
• Line styles
• Color palettes
• Object groupings
• Grid alignment

21
Using NPT for Data Modeling

• Can be used to create new nodes and links without
  editing NETMAP
• Uses drag and drop for
• Palette choices
• Colors
• Shapes
• Labels

22
Using NPT for Storyboarding

• Diagrams can be arraigned to show a sequence of
  events, time periods or changes

23
Analysts Notebook

• A widely distributed visualization system within
  the investigative, intelligence and law
  enforcement community
• Easy to use and performs various types of
  analysis
• Provides different types of
• Visualization displays
• Analytical components
• Data management facilities
• Presentation graphics

24
Analysts Notebook

• Targeted at non-technical users
• Based on a modernized link analysis version of
  Anacapa Methodologies
• Simple and intuitive approach
• A package of well-defined software modules that
  can generate results quickly
• Operates in the Windows and UNIX environment

25
Incorporating Data Sets

• Can be used either to look at existing data sets
  or create new information on the fly
• Supports many different data pipes
• DDE (Dynamic Data Exchange)
• ODBC
• Sockets
• Sybase
• Oracle

26
Using the Link Notebook

• Supports functions used in link analysis
• Nodes and links can be added manually or
  generated from structured data sources
• Supports drill down of complete information not
  displayed on screen
• Supporting information
• Name
• Source type
• Intelligence grade
• Notes

27
Using Inter-Item Linkages in Link Notebook

• Multiple link types
• Single
• Directed (may contain up to four subtypes)
• Connected

28
Navigating the Link Notebook

• Right side
• Icon panel for different entity types that are
  defined for the application being built

• Left side
• Select entities
• Zoom
• Graphic annotations
• Boxes
• Labels

Uses drag and drop to construct the chart. A
snap- to grid for displaying the elements in rows
and boxes. Special drawing options are used for
data presentation allowing the user to manually
label each box and annotate the diagram with
lines, boxes and circles
29
(No Transcript)
30
Working with Multiple Charts

• Able to maintain multiple active charts within a
  single session
• Uses windows management approach with cascading
  and tile arrangement
• Setting the Visibility of a Node
• Hide / Show command to determine what info is
  presented
• Combinable with more advanced analytical
  capabilities

31
Defining Link Levels

• Allows the user to set the number of levels of
  linkages between entities
• Search-Depth can be set to any value, the
  directions defined and which nodes or link to
  include/exclude
• The results from this feature automatically
  select the other entities matching the defined
  criteria

32
Defining Link Levels
33
Generating Clusters

• Used to show groups of entities that are more
  interconnected to each other tan to other
  entities outside the group
• Cluster contain a minimum of 3 entities
• Clusters defined as
• Loose
• Medium
• Tight connectivity
• User selects cluster members, hide non-cluster
  elements automatic rearrange the display and add
  attributes to components

34
Generating Clusters
35
Case Notebook

• Useful when working with temporally coded
  information (eg Time-based)
• Two forms of temporal patterns
• - Proportional time periods
• - Nonproportional time periods
• Main focus is to help lay out progressive states
  of knowledge maintained during different stages
  of an investigation

36
Generating Case Charts in Case Notebook

• Components used to generate case charts within
  the case notebook include
• -Themes, include people, organizations,
  locations etc.
• -Events, represent a particular activity in
  which a theme element was involved. Such as
  Telephone Calls, Meetings etc.
• -Links, Events can be associated with one
  another through the use of links

37
Case Chart with Several Events That Have Occurred
for Selected Themes
38

• Case Notebook enables the display of detailed
  information due to this the case charts can
  become quite large and complex.
• To interpret this complex information, a summary
  mode is used that will reduce the events to a
  simple circle with only a title presented.
• This data reduction is particularly helpful when
  looking at a large number of nonproportionally
  related events such as phone calls (Fig. 7.16)

39
Case Chart Using Summary Mode
40
A Theme Difference and Similarity
41
Temporally Clustered Events
42
Imagix 4D

• It is a link analysis tool that was developed for
  use in the domain of software analysis
• It shows the composition of a piece of software
  in terms of subcomponents and their
  interconnections
• Data used in imagix 4D were derived from the
  structure and contents of software programs where
  variable declarations, function calls, source
  files, and other components could be graphically
  represented

43
Imagix 4D

• The explicit representation of program structures
  within Imagix 4D provides support for software
  enhancement, maintenance, documentation, and
  reuse
• It was used to support Y2K problems

44
Importing Data in Imagix 4D

• Imagix 4D has been built using a combination of C
  and TLC code and runs in both windows environment
  and under UNIX
• The data processing that requires the source data
  to be visualized are derived from software
  programs themselves. As a result there will be no
  ODBC compliance within Imagix 4D

45
Importing Data in Imagix 4D

• Objects within Imagix 4D can be composed of
  functions, procedures, declarations, variables,
  typedefs, header files, classes, macros, and so
  on.
• Imagix 4D can be used to extract class, function,
  variable, and type information directly from the
  source code
• The data structures of Imagix 4D closely
  approximate a hierarchical link display paradigm

46
Makefiles

• Contain a set of descriptions that are used by
  the operating system utility called make to
  execute a sequence of commands
• Commonly used to help manage the creation of
  large software programs but can realistically be
  used for a wide variety of purposes where there
  are dependencies among files

47
Makefiles

• Have been used to coordinate the installation of
  software as well as to manage the formatting of
  documents
• One of the advantages are, if a single file is
  changed somewhere in the dependency hierarchy, it
  is not necessary that the entire set of files
  comprising that application needs to be updated

48
Georges Question?

• NETMAP has two support functions name and briefly
  describe each.

49
Murrays Question

• What are the different ways to acquire data for
  Analysts Notebook?

50
Amreshs Question

• What are the 3 components that are used to
  generate case charts within the case notebook?