Identification of Activity Patterns in Communication Data without Content

Dr. Uri Degen (speaker), Dr. Leonid Shvartser,
Shmuel Teppler

Israеl, TSG IT Advanced Systems Ltd
Early detection of criminal activities is a challenged task for police and other law enforcement agencies. When only communication transactions without content are available for a set of suspects, we model the communication behavior routine as GMM on a set of features derived from the data. Once models are built, the deviations from them, when detected, serve as indicative signs for further analysis. Models are periodically updated with new data. A new method of incremental GMM update and confidence intervals estimation was developed.
Moreover, organized crime activities have hidden geo-temporal patterns derived from “doctrine”, logistics, communications, surface constrains, existing infrastructure and more. The challenge is to identify these patterns using communication data (without content), GPS data and the geography of known criminal infrastructure objects. Our method developed for this purpose analyzes training sample of activities: surrounds every activity point with a rectangular window W containing rectangular bands, and calculates the set of spatial-temporal features for every band. The same is done for “no activity” negatives. The resulting set contains thousands of features related to different space bands and time intervals. Training process consists of the feature selection resulting in a reduced set of features and consequent clustering of positives and negatives separately. Both the reduced set of features and the set of clusters extract the hidden patterns soughed-for. The identification process moves the window W over the area of interest, calculates the feature vector corresponding to the reduced set of features, and checks to which set of clusters – positives or negatives – this vector is affiliated. The method is illustrated with simulative data.