Exploring Anomalies in GAStech VAST 2014 Mini Challenge 1 and 2 Jaegul Choo * , Yi Han * , Mengdie Hu * , Hannah Kim * , James Nugent * , Francesco Poggi † Haesun Park * John Stasko * * Georgia Institute of Technology, † University of Bologna ABSTRACT We present our process and analysis for VAST 2014 Mini Chal- lenge 1 and 2, which integrate an off-the-shelf tool, Jigsaw, rapid web-based visualization prototyping using D3, and analytics-based visualizations using Matlab. Index Terms: H.5.2 [INFORMATION INTERFACES AND PRE- SENTATION]: User Interfaces—Theory and methods 1 MINI CHALLENGE 1 The goals of MC1 1 were to understand the structure of the Protec- tors of Kronos (POK) organization, the connections of POK to the GAStech company, the series of events that occurred around the time of the challenge’s focus incident, and its potential causes. The provided data included semi-structured text documents (news arti- cles, resumes, etc.), structured tabular text documents (email and employee records), an organization chart, and a map. To examine the news articles and email messages, we used Jig- saw, a visual analytics system for exploring large text document collections [1]. We used Jigsaw’s List View to identify a list of news articles around the day of the incident to answer question 2. Subsequently, we deliberately inspected the identified documents in the Document View to find relevant information. We believed that the email messages between employees would be best visualized with a graph to show the connections. This infor- mation was important for answering question 1d about connections between POK and GAStech. We used the Graph View in Jigsaw to identify the different employees involved in a specific email thread. However, the Graph view could not show an overview of the dis- tribution of direct email exchanges between employees. Thus, we used two other visualization tools to explore the overall email con- nections between any given pair of employees. The first one was a circular graph visualization built using D3 toolkit. As shown in Fig. 1(a), the employees are grouped by their departments around the circumference of the graph. The amount of email between each pair of employees is encoded by the width of the connected line. Mousing over any employee, such as Isia Vann in Fig. 1(a), high- lights all emails to and from this person in the circular graph and shows additional information on the side. We used this visualiza- tion to find potentially interesting connections between employees sharing last names with known POK members and other GAStech employees. The second tool was built with Matlab and employed an adjacency matrix visualization including interactive features to inspect the communication between any two employees. For exam- ple, in Fig. 1(b), Isia Vann, who we suspected to be connected with POK, seemed to be in a relationship with Rachel Pantanal, implying she may also be connected to POK. * e-mail: jaegul.choo@cc.gatech.edu, yihan@gatech.edu, mengdie.hu@gatech.edu, hannahkim@gatech.edu, jnugent6@gatech.edu, fpoggi@cs.unibo.it, hpark@cc.gatech.edu, stasko@cc.gatech.edu 1 Video: http://www.cc.gatech.edu/gvu/ii/challenge/ GT-14-MC1.mp4 (a) D3 circular graph for emails (b) Matlab matrix view for emails Figure 1: Email analysis Figure 2: Tablet view for organizing events around the incident None of these visualizations on its own was sufficient to answer any question in Challenge 1. Instead, we used information from combinations of the tools to gain a better understanding of the data. We did this by using Jigsaw’s Tablet window and MS Powerpoint to visually organize our findings from the various visualizations together. The Tablet, shown in Fig. 2, provides a workspace for manually creating visual representations with lines, text boxes, and connections to documents. We created a timeline view in the Tablet for question 2 with notes and links to related documents. The view provides a flexible platform for visually organizing and presenting findings. For information learned outside of Jigsaw, we used MS Powerpoint to gather our findings. 2 MINI CHALLENGE 2 The task of Mini Challenge 2 2 was to find unusual patterns in em- ployees’ daily lives from their credit/debit/loyalty card records and 2 Video: http://www.cc.gatech.edu/gvu/ii/challenge/ GT-14-MC2.mp4 347 IEEE Symposium on Visual Analytics Science and Technology 2014 November 9-14, Paris, France 978-1-4799-6227-3/14/$31.00 ©2014 IEEE