Presentation is loading. Please wait.

Presentation is loading. Please wait.

1 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Visual Link Analysis Christopher R. Westphal Visual.

Similar presentations


Presentation on theme: "1 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Visual Link Analysis Christopher R. Westphal Visual."— Presentation transcript:

1 1 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Visual Link Analysis Christopher R. Westphal Visual Analytics Inc

2 2 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Christopher R. Westphal CEO of Visual Analytics, Inc (VAI) Over 22 years of experience Experienced with a wide number of domains: Financial Crimes Money Laundering Frauds (corporate/insurance) Law Enforcement (RMS) Intelligence

3 3 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Need to know your data Need to think “outside the box” Need to use your noodle Need to learn new techniques ! It’s not rocket science… …but it does require some intelligence It’s not nuclear science… = a Prerequisites for Analysis

4 4 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved There are no roadmaps to follow... …or existing references to use... …you have to “make-it-up” as you go along.

5 5 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved What does… …. a money launderer look like? …. a criminal look like? …. an insider trader look like? …. a generic disorder in DNA look like? …. a manufacturing defect look like? …. a terrorist look like?

6 6 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Interpretation Methods Leverages human facility to process visual information 312 times more efficient than reading text

7 7 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Want to Expose Patterns & Trends It’s like trying to find a needle in a haystack New Need to use right visual presentation for exposing patterns. Many times the pattern is not obvious – and using alternative presentations can help expose the anomaly. How will business processes change once the patterns are found?

8 8 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Pattern #1 Pattern #2 Pattern #3 The method of data presentation is key to exposing hidden patterns Finding Patterns in the Data

9 9 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Placement Influences Interpretation Detecting Patterns Databases X1Y1Z1 X2 X3 X4 X5 Y2 Y3 Z2 Z3 Z4 X1 Y1 Z1 X2 X3 X4 X5 Y2 Y3 Z2 Z4 Z3 X1Y1 Z1 X2 X3 X4 X5 Y2Y3Z2 Z4 Z3 Field-XField-YField-Z X1Y1Z1 X2Y1Z2 X3Y2Z2 X4Y2Z3 X5Y3Z3 X5Y3Z4 Table

10 10 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example: Unexpected Commonality Certain “entities” should never be shared (e.g., SSNs) Data prone to typos and misspellings Possible misrepresentation and/or falsifying data on forms Appearance of avoidance by varying information Unexpected Commonality

11 11 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example: Too Much Commonality Many patterns are exposed due to repeating behaviors Too many commonalities may indicate organized behaviors Subjects perpetrate the same crime at different financial institutions Only minor changes in their underlying Modus Operandi (MO) Too Much Commonality

12 12 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example: Accumulated Behaviors Each unique filing looks valid – need to see it collectively (all at once) Large numbers of discrete actions forms the bigger pattern Easy to avoid detection if each transaction appears legitimate Individual may be using mules to move money in/out of the accounts Accumulated Behaviors

13 13 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Organizations People Accounts Weapons Vehicles Claims Addresses Comms Passports ID Numbs Vessels Aircrafts Money Phones Meetings Facilities Transfers Events Drugs Narcotics Equipment Cases Travel What are Data? Which of the following are Real-World Objects and which are Conceptual Objects?

14 14 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Would not want to create: Caller/Callee Deposit/Withdrawal From/To Arrival/Destination Shipper/Consignee Seller/Buyer Prime/Sub Payor/Payee Sender/Receiver Owner/Renter Phone People Vehicle Define the type for the entity – not the role Be Consistent with Defining Types Address

15 15 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Technologies vs. Methodologies Link Visualization is a tool just as Microsoft Word is a tool Link Analysis does not replace the knowledge of the user –Improves efficiency –Produces better and higher-quality results Link Analysis does exactly what it is told to do Link Analysis makes data explicit Methodology drives the technology Need to fully understand your data Need to have an expectation of what you want to see

16 16 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Connect The Dots…. Simple…Easy…Straightforward…???? What happens if you… Don’t know the dots? Have missing/extra dots? Mess-up the sequence? Don’t recognize the threat? Pattern #1 Enters country on student visa Attends flight-training school Indirect connections to known terrorist Pattern #2 Commercial driver’s license Apply for chemical-hauling permits Purchase storage containers Rent transport trucks a b c d e f g h i j k l m n o p q r u t v w x y z s …Pattern #X…

17 17 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Is this an Important Pattern? Ron Ronnie Ronald Ronny The Gipper Dutch-Boy Mary George Betty John Roger Pam Depends on Context Depends on Content Depends on Sources Depends on Data Quality UNKNOWN NOT DEFINED Depends on Interpretation Depends on Importance

18 18 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Is this an Important Pattern? JOHN SMITH What about this pattern? Common values can short circuit a network and potentially lead to inconsistencies. Therefore, it is important to decide how to represent your entities and try to manage the “lowest common denominator” Also need to factor the degree of transpositions to determine if it reflects an intentional misrepresentation of the facts.

19 19 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Pattern #1 PHONE Is this a Reliable Pattern? ADDRESS Pattern #2 Pattern #1 PHONE EVENT 01/01/02 EVENT 01/05/02 EVENT 01/11/02 SUBJECT EVENT 05/16/05 EVENT 06/03/05 EVENT 06/27/05 EVENT 07/01/05 SUBJECT Pattern #3

20 20 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Do these Patterns Make Sense? ADDRESS PHONE ID NUMBER SSN ORG SSN REPORT SUBJECT Pattern #1Pattern #2 SSN = SS Death Master Hit

21 21 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Is this an Important Pattern? INVALID

22 22 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved REPORT Which Pattern Is More Valuable? REPORT SUBJECT ADDRESS PHONE SUBJECT ADDRESS REPORT PHONE SSN REPORT SUBJECT ID NUMBER REPORT SSN ADDRESS SUBJECT ID NUMBER PHONE Pattern #1 Pattern #2

23 23 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved What Does this Pattern Tell Us?

24 24 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Who is the Most Important Person?

25 25 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Methodologies – What’s Important?!?! SUBJECT has numerous SAR filings utilizing the same ACCOUNT number A single SAR with a large number of SUBJECTS typically indicates some type of fraud-scheme. Data Result Sets

26 26 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved What Are We Looking For? Single Source Multiple Sources TELEPHONETERRORISM CRIMINAL

27 27 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Source Integration Patterns Income < $10k Property > $500k (non-compliant) Income Property No Income Any Property (non-filers) Overlap

28 28 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Entity Resolution John Quincy Adams 123 Main Street Boston, MA Jonathan Q. Adams Boston, MA 05/29/1968 DL: Quincy Adams Bedford, MA /05/1965 Source ASource BSource C Anonymous Resolution md5_128bit = d35ecc61e4cc e5de7fcb5931c Are they the same entity? Standardization Aliasing Normalizing Tokenizing Value-add Permutation

29 29 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Sample Network - Unchanged Multiple references to the same people based on spelling variations in their name. Different color-boxes show the like/similar entities EDISON MARIA DAVID

30 30 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Same Network - Consolidated Reduced network from 14 entities to 3 entities. Much more readable and comprehendible. Proper data-cleaning is important for highly- variable data entry processes. Same exact data and information being displayed from previous diagram Larger frequency between Edison and David Bi-directional flow between Edison and David Transfers only flows from Edison to Maria No transfer between David and Maria

31 31 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Network Structures – Interpretation Highly centric network – shows either source/sink behavior and strong influence/control over the network. Vulnerable and easy to monitor and seize assets. Network may be alien smuggling or various fraudulent activities. More interconnected nodes provides less overall control over the network. Multiple players act in a distributed fashion to add complexity to monitor or disrupt due to multiple targets of interest. Network may be narcotics trafficking or gambling operations. Highly distributed structure shows limited control or oversight across the network. No single control point and network can easily reconstitute using alternative entities. Hard to track and trace. Network may be terrorist financing.

32 32 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Data Quality Impacts Analyses MANHA HAN MANHANHATTAN MANHANTAN MANHANTHAN MANHANTTAN MANHATAN MANHATTAN MANHATTAN K MANHATTAN N Y MANHATTEN MANHATTON MEW YORK N Y NEW Y ORK NEW YOEK NEW YOIK NEW YOK NEW YOKR NEW YOORK NEW YOR NEW YOR K NEW YOR, NEW YORJ NEW YORK NEW YORK NEW YORK NEW YORK 725 NEW YORK 806 NEW YORK 987 NEW YORK BK NEW YORK CITY NEW YORK N NEW YORK NEW YORK NY NEW YORK NY NEW YORK NY NEW YORK NY NEW YORK NY NEW YORK NY NEW YORK NY NEW YORK NY NEW YORK NY NEW YORK NY NEW YORK NY NEW YORK NY NEW YORK NY NEW YORK QUEENS NEW YORK ROOSEVELT ISLAND NEW YORK STATE NEW YORK Y NEW YORK, NEW YORK, NEW YORK NEW YORK, NY NEW YORK, NY NEW YORKCITY NEW YORKD NEW YORKE NEW YORKJ NEW YORKK NEW YORKQ NEW YORKS NEW YORKY NEW YORK| NEW YORL NEW YORY NEW YOTK NEW YOUR NEW YOURK NEW YOYK NEW YRK NEW YROK NEWYORK NY NY PLAZA NYC Y Lower Manhattan10004, 10005, 10006, 10007, 10038, 10280

33 33 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Question? What country is represented by the code SA ? What country is represented by the code ZA ?

34 34 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example – Structuring Dentist

35 35 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example – Structuring Same Address

36 36 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example – Structuring Dental Practice

37 37 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example – Structuring More Structuring Date (2004)

38 38 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example – Structuring Original Filing (over $10k)

39 39 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Elderly Abuse Pattern… SAR-MSB where SUBJECT DOB < 1930 Notice anything in common among these SAR-MSBs?

40 40 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Analysis of the Warranty Data Extracted SetRepair Type 1 hour - $45 1 hour - $60 1 hour - $50 1 hour - $65 1 hour - $45 Review Details Show all vehicles with fewer than 100 miles brand new cars many will still be on the dealership lot not realistic mileage for general service repairs Show labor only entire cost is based on mechanic time no parts replaced (not traceable) no work was outsourced (not external) Cigarette Lighters

41 41 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example – Geospatial Filings All SAR forms filed by banks in Howard County, Maryland Filing Years 2004 – 2005 Approximately 300 filings Group by CITY/STATE of the subject

42 42 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example – Geospatial Filings Geo-encoded the Centroid of the Zipcode Centroid = approx middle of region Populated GIS viewer with results of encoded addresses

43 43 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example – Geospatial Filings Filtered out any addresses associated with SAR transactions below $100k Heavy concentration along I-95 corridor

44 44 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Example – Geospatial Filings Zoom-in to the map Highlight the boundaries for Howard County Notice: all but a few of the addresses fall outside the county

45 45 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Family Name 2. First (Given) Name 3. Birth Date (Day/Month/Year) 4. Country of Citizenship 5. Sex (Male or Female) 6. Passport Number 7. Airline and Flight Number 8. Country Where You Live 9. City Where You Boarded 10. City Where Visa Was Issued 11. Date Visa Issued (Day/Month/Year) 12. Address While in the United States 13. City and State 14. Family Name 15. First (Given) Name 16. Birth Date (Day/Month/Year) 17. Country of Citizenship I-94 - Arrival-Departure Record SUBJECT ADDRESS PASSPORT FLIGHT EVENT

46 46 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved I-94 – Multiple Passport Numbers Identified a courier with over 50 different passport numbers for over 200 travel events Generated a timeline to show the number was changed in July (Mexican Passport)

47 47 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved I-94 – Multiple Passport Numbers 1) Reverse look-up on address 2) Identified a courier business 3) Expanded to show other I-94 targets

48 48 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved What Type of Data are in a Date? 7th MoY July 4th DoM 3rd QTR-c Summer 4th QTR-f 2nd WoM 186 DoY Sunday Holiday-US Leap Year nd DoW Banks Closed 28 WoY JULY 4, 1976 DOW -Day of Week DOM -Day of Month DOY - Day of Year DOQ - Day of Quarter WOQ - Week of Quarter WOY - Week of Year WOM - Week of Month MOY - Month of Year QTR-f - Quarter Fiscal QTR-c- Quarter Calendar Season/Holiday/Leap Year What do these dates have in common? ? ? 2000 March February February March February February February February February February February 16

49 49 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Temporal – SAR Filings Day of Week Week of Year Very regular filing (1 per month – except Dec) Represents a very consistent filing behavior Dates for first ½ year occurred more often on Mondays Unusual change for remainder of year – jumps around a bit Reflect filing behavior of financial institution

50 50 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Holiday break timeframe is quite active and includes 12/25 Holiday – 4 th July Long weekend Long weekend (Labor Day) Period of inactivity Temporal – SARC Filings SAR-CASINO filing that clearly show the individual tends to prefer weekend and holiday gambling time frames. Tells us he is “employed” since he is working during the week. Inactive times correspond to known work periods

51 51 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Convenience Store Deposits Mondays / Fridays Period of inactivity (2 week vacation) Pattern abruptly stops Cash Transaction Reports (CTR) filings for a convenience store owner. Business offers “check cashing” for clients. All transactions represent over $10,000. Very consistent Monday & Friday filings All transactions represented are cash DEPOSITS – which is inconsistent for a check-cashing business (the events should be WITHDRAWLS)

52 52 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Temporal Grid – HOD / WOY After hours 12:00 Mostly afternoon Border Crossing

53 53 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Temporal Grid – HOD / WOY Border Crossing

54 54 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Little Old Man… Use of SAR-MSB DOB between Same use of ID Number 55 unique filings Narratives state: –“CUSTOMER PURCHASES MONEY ORDERS TOTALING LARGE AMOUNTS VERY FREQUENTLY.” –“CUSTOMER NEEDS THEM FOR PAYROLL FOR EMPLOYEES” –“OPERATES AN INSURANCE BUSINESS” Over $400k of MSB Primarily in filed 2006 Heavy filings on Mondays and Wednesdays Averages 2-3 transactions per week

55 55 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Reference Sources Death Master Match Public / Common Phone Match Address Validation SSN Validity Check Watch list / PIP Check Case Records Public Records Criteria Countries Critical Infrastructure Important Dates Sex Offenders ITIN Check

56 56 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved SUBJECT PHONE ADDRESS SUBJECT ADDRESS EVENT SUBJECT EVENT PHONE EVENT SUBJECT SSN ADDRESS A Basic Network Diagram

57 57 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved SUBJECT PHONE SUBJECT EVENT SUBJECT EVENT ADDRESS SSDM Pay Phone Watch List Prior Case Bad Address A Value-Added Network Diagram Sex Offender Embassy

58 58 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Some Simple Questions… What do these companies have in common? CARIBBEAN HAPPY LINES MODERN ELECTRONIC COMPANY SACKS FACTORY Where can this telephone number be found? What is located at this address? 801 Mount Vernon Place, NW Washington, DC What is the vehicle make/model of this VIN? ZA9BC10U13LA12551 Who owns this Social Security Number? ) OFAC list 2) Greyhound Bus Station 3) DC Convention Center 4) Lamborghini 5) The Woolworth Card

59 59 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved Some Simple Questions… What happened on 03/11/2004 ? Where is ° ° ? Who owns this IP address: ? Where is ZIP code found ? 1) Usama Bin Laden 2) Madrid Bombings 3) White House 4) CIA 5) USS Ronald Regan

60 60 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved A Simple Question… Who is the FBI’s most wanted fugitive ?

61 61 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved What Do Terrorists Looks Like? White / Black / Asian / Arabic? Man / Woman? Domestic / Foreign? Poor / Rich? Illiterate / Educated? Adult / Teenager? It’s based on their actions, behaviors, and relationships …


Download ppt "1 Visual Analytics Inc. Copyright © 2006 – All Rights Reserved 301-407-2200 www.visualanalytics.com Visual Link Analysis Christopher R. Westphal Visual."

Similar presentations


Ads by Google