US20110225158A1 - Method and System for Abstracting Information for Use in Link Analysis - Google Patents

Method and System for Abstracting Information for Use in Link Analysis Download PDF

Info

Publication number
US20110225158A1
US20110225158A1 US12/747,868 US74786808A US2011225158A1 US 20110225158 A1 US20110225158 A1 US 20110225158A1 US 74786808 A US74786808 A US 74786808A US 2011225158 A1 US2011225158 A1 US 2011225158A1
Authority
US
United States
Prior art keywords
link
node
dataset
links
nodes
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US12/747,868
Inventor
Jim Snyder
Joon Hao Chuah
Joe Dente
Travis Hartwell
Morgan Hollinger
John Thele
Jimmy Wan
Robert Williams
Robby Morgan
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
21CT Inc
Original Assignee
21CT Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 21CT Inc filed Critical 21CT Inc
Priority to US12/747,868 priority Critical patent/US20110225158A1/en
Assigned to 21CT, INC. reassignment 21CT, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: WAN, JIMMY, CHUAH, JOON HAO, SYNDER, JIM, MORGAN, ROBBY, DENTE, JOE, HARTWELL, TRAVIS, HOLLINGER, MORGAN, THELE, JOHN D., WILLIAMS, ROBERT
Publication of US20110225158A1 publication Critical patent/US20110225158A1/en
Abandoned legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90Details of database functions independent of the retrieved data types
    • G06F16/901Indexing; Data structures therefor; Storage structures
    • G06F16/9024Graphs; Linked lists
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/28Databases characterised by their database models, e.g. relational or object models
    • G06F16/284Relational databases
    • G06F16/285Clustering or classification
    • G06F16/287Visualization; Browsing
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00Commerce
    • G06Q30/02Marketing; Price estimation or determination; Fundraising

Definitions

  • the invention relates generally to a method and system for abstracting or transforming data stored in a link-oriented data set for use in link analysis.
  • FIG. 1 illustrates generally how information flows during an exemplary intelligence analysis cycle 100 , and includes some major transition points that have direct relevance to tools and technologies supporting analysts. Information is collected from and by various sources and methods, and its collection is highly dependent on the disciplines involved; this information is usually collected independently or indirectly from the analytical cycles that exploit it.
  • the analysis phase is highly subjective with respect to the skills and training of individual analysts and agencies, and it includes manual and computational techniques that can establish relevant relationships in support of a perspective or recommendation.
  • the preparation phase is a graphical information presentation (e.g. network chart) workflow that attempts to visually communicate the “punch line” of an analytical process, that is, a condensed information model is drawn.
  • the presentation phase is typically the assembly and production of some kind of media that can be presented or distributed for human consumption.
  • Link Analysis includes the methods and techniques used to produce the information that feeds the presentation phase of the analysis process. The goal is to incrementally capture, understand, refine, and analyze Human Activity Networks such that latent or non-obvious relationships can be discovered and definitive actions can take place such as arrests, intelligence targeting, or threats being eliminated.
  • a goal of computational link analysis is to create a synergistic behavior between human analysts and computers where information intensive tools and techniques can aid analysts in “zeroing in” on relevant understanding or abstracting the linkages between information. Said differently, computers should do what they do best (which is lots of dumb calculations quickly) and analysts should do what they do best-reason and analyze.
  • Link Analysis can be used to identify and qualify high-level links in Human Activity Networks (HANs). These links are combinations of many kinds of simple and complex linkages and pathways in link-oriented data and very often are manually constructed or simply drawn in pictures. Presented here is a technology solution that allows such high-level links to be realized in computation link analysis technologies.
  • HANs Human Activity Networks
  • Observable data points are collected and organized into a link-oriented data set comprising nodes and links.
  • Information is abstracted for use in link analysis by generated links between the collected data points.
  • a generated link is a derived link which may be derived as a result of one or more dataset operations on the link-oriented data set.
  • Another embodiment is a link that is generated based solely on features inherent in the data set.
  • Another example of a generated link is an induced link, which may be induced in an embodiment by linking together a pair of nodes That satisfy a distance function.
  • Exemplary distance functions that can be used to induce links include geospatial proximity, attribute nearness, and name similarity.
  • two nodes of interest are selected and paths are identified between the nodes of interest through a dataset operation.
  • the analyst can selectively include or exclude from the data set operation typed nodes and/or links, including induced links or derived links.
  • the dataset is augmented with pedigree information or one or more association nodes.
  • Additional embodiments are disclosed for producing link information, including displaying link information or outputting link information in a specified format.
  • Embodiments of produced link information include a trajectory and a connected path that selectively produces or excludes one or more intermediate nodes.
  • the methods and systems disclosed herein transform the link and node organization of collected information into a form and/or format that is more useful to the analyst.
  • FIG. 1 depicts a high level view of an intelligence analysis cycle.
  • FIG. 2 depicts exemplary link variations within a sample population.
  • FIG. 3 depicts exemplary information layers.
  • FIG. 4 depicts an exemplary Human Activity Network.
  • FIG. 5 depicts pathways used to define an exemplary Derived Link within an exemplary Human Activity Network.
  • FIG. 6 depicts an XML specification for possible Derived Links in an embodiment.
  • FIG. 7 depicts an example of a pattern query used to derive a Derived Link in an to embodiment.
  • FIGS. 8 a and 8 b illustrate an exemplary application of type exclusion to enhance Association Discovery.
  • FIGS. 9 a and 9 b illustrate an exemplary application of Link Induction based on geospatial nearness.
  • FIGS. 10 a and 10 b illustrate an exemplary application of Link Induction based on name similarity.
  • FIG. 11 illustrates an exemplary association node in an embodiment.
  • FIG. 12 depicts an exemplary use of pedigree properties in an embodiment.
  • FIGS. 13 a and 13 b illustrate an exemplary use of Path Simplification in an embodiment.
  • FIG. 14 depicts an exemplary geospatial trajectory chart in an embodiment.
  • FIGS. 15 a , 15 b and 15 c illustrate stages of an exemplary process for extracting a trajectory for an entity.
  • FIG. 16 depicts an exemplary trajectory path definition of one mappable point for a Person node type in an embodiment.
  • FIG. 17 depicts the components of an embodiment of a system for abstracting information for use in link analysis.
  • FIG. 2 shows how two different linkages between the same set of people can help illustrate what person is potentially exploitable from a targeting perspective.
  • the potentially exploitable persons can be identified by constructing two networks, one from the perspective of being part of the family by marriage and one from the perspective of being in the blood or tribal network.
  • Association Discovery is the process of finding linkages between two or more entities given a variety of complicated or convoluted pathways between them. For example, it can be inferred that two people know each other because they lived at the same place or they committed crimes together or they belong to the same gang, or even they give common information such as the same phone number. Additionally, associations between people can be inferred when the people show up at physical locations together or know many of the same people in the same area or are in proximity to a large number of similar crime locations.
  • FIGS. 8 a and 8 b illustrate an exemplary application of this technique.
  • FIG. 8 a shows source data model 800 comprising exemplary entity types, including person 810 , PhoneNumber 815 , PhoneCall 820 , PhoneTower 825 , Meeting 830 , EmailAddress 840 , Email 845 , PersonName 860 , Organization 870 , Flight 880 , Airline 887 , and Airport 885 .
  • Some of these types do not directly relate to methods of communication with other persons and can be excluded from display so that the analyst can focus on communication-related data types such as PhoneNumber 815 and EmailAddress 840 , as shown in FIG. 8 b .
  • the ability to selectively include or exclude type for path consideration provides additional tools to the analyst to narrow the results and pinpoint those relative links of interest. Using type exclusion also reduces the search space for Association Discovery which improves the efficiency of the search.
  • An embodiment allows the analyst several ways to selectively include or exclude types for path consideration, including rules-based techniques and manual selection.
  • Cluster Analysis is a complementary technique to Association Discovery in that once a high-quality abstracted network has been built, people (or other nodes) in the network can be clustered based on their associations. (Other names for his technique include Group Detection or Community Extraction). Referring back to the example in FIG. 2 , two kinds of clusters could be built to compare and contrast the family versus blood networks.
  • FIG. 3 shows three layers that represent notional stable points in a data storage and representation embodiment, namely the Observables Layer 310 , the Entities Layer 340 and the Aggregates Layer 370 .
  • Observables Layer The data collected throughout the course of normal or daily activity is represented in Observables Layer 310 , that is, things that can be observed and/or recorded (e.g., electronically). Examples include email, documents, phone call logs, financial transaction, database records and any other type of data used on, by or with a computer.
  • Entities layer 340 reflects qualitative evaluation, refinements and judgments about the data and what it represents specifically with respect to the entities under scrutiny (people, organizations, locations, etc.) For example, in an exemplary embodiment of a Human Activity Network, the Entities Layer would resolve two different names of a person to the same person represented in the network.
  • Aggregates Layer The output of Cluster Analysis is an example of what would be represented in Aggregates Layer 370 , that is, groups of people can be aggregated into groups. Moreover, people can be aggregated from countless perspectives, and comparison of these variations can show how human networks function. However, the technical requirements of the techniques used to make aggregates cannot just use information represented at the Observables Layer as is.
  • a graph analytics platform provides the technology for generating linkages for use at a high-level of analysis.
  • the graph analytics platform is implemented in software (which may include portions implemented in hardware). It is assumed that observable (or raw) data has been collected, and the graph analytics platform preferably stores or organizes the collected observable data in a form that is link-oriented, that is, data is organized as Nodes and Links (or edges) between nodes.
  • Exemplary link-oriented data sets include graphs and trees, and can be implemented with relational database technology such as a relational database management system and query language using methods well-known to those of ordinary skill in the art.
  • Nodes have types associated with them (e.g. People) and one ore more attributes and Links are named (e.g.
  • Attributes are named scalar value properties that express owned aspects of a given Node type (e.g., a person's name, a vehicle's model, or a phone call's duration).
  • the features of the graph analytics platform are not dependent on the definition of any one data set, but can adapt to function against any data set that is or will be defined.
  • the graph analytics platform includes search and segment matching tools to search the data set efficiently and to match segments or patterns or identify nodes or links that meet specified criteria.
  • Methods and techniques for searching and segment matching including without limitation graph tools including sub-graph matching and relational database methods, are well-known to those of ordinary skill in the art.
  • the link-oriented data set uses a strongly-typed node and link system, where every node is of an identifiable type such as ‘Person’ or ‘Organization’. Links are typed and connected between identifying node types, such as ‘Person memberOf Organization’. In an embodiment, links are typed but do not have attributes, which facilitates scalable, fast pattern matching.
  • the graph analytics platform uses a strongly-typed link-oriented data, segment matching for data set searches, an efficient storage format and language and use of query languages for building queries, all as described in pending U.S. patent application Ser. No. 11/590,070 filed Oct. 30, 2006 entitled Segment Matching Search System and Method, hereby incorporated by reference.
  • a graph analytics platform preferably also provides pattern search (including graph pattern matching), and management and application development (including client and server tools) functionality.
  • An exemplary embodiment of a graph analytics platform is the Lynxeon Intelligence Analytics Enterprise product suite provided by 21st Century Technologies.
  • FIG. 4 depicts an exemplary Human Activity Network 400 .
  • To analyze the exemplary Human Activity Network 400 it would be helpful to be able to identify links such as loyalTo, trained, etc. The problem is that such data is not necessarily intrinsically available in the captured data.
  • the captured data will not be directly organized like the idealized network 400 from FIG. 4 , and there will be more than one way to derive links such as, for example, the link loyalTo. If there are multiple paths or substructures in the data that justify the loyalTo association, it will be valuable to derive all the links that are defined in terms of all these paths, that is, to identify all pairs of nodes where the desired pathways exists between the nodes.
  • a derived link is therefore a mechanism that allows dynamic synthesis of typed links in link-oriented datasets.
  • the derived link loyalTo as someone who calls each other or has met as a safe house as shown in FIG. 5 with highlighted elements. In FIG. 5 , for example, there are loyalTo derived links between persons 520 and 530 , and between persons 540 and 550 , because the observable data shows phone calls between them ( 510 , 560 ).
  • Derived Links can be generalized as the set of typed edges (i.e. typed node pairs) that are the result of a disjunctive set of subgraph matching operations.
  • typed edges i.e. typed node pairs
  • other dataset operations such as, by way of non-limiting example, pattern matching or matrix operations, can be used in addition to, or instead of, subgraph matching operations, and further, that the results may be aggregated in whole or in part, excluded in whole or in part, or otherwise operated upon in any number of ways to generate a set of typed edges.
  • the nodes may have to be the same type or capable of path discovery via linear algebra
  • the general idea allows a solution to be cast in many technology implementations.
  • a characteristic of one embodiment is to defer the generation of such linkages as late as possible while balancing the computational efficiency to produce answers sufficiently quickly.
  • FIGS. 6 and 7 illustrate an embodiment implemented using Lynxeon in which Derived Links can be used to condition link-oriented data to perform cluster analysis.
  • FIG. 6 shows an XML specification 600 of the possible Derived Links for a particular schema.
  • Line 14 ( 610 ) shows that the Derived Link “friendOfAFriend” is defined using a pattern query that is based on graph matching approaches.
  • FIG. 7 is an example of a pattern query that is referenced in the Derived Link Specification of FIG. 6 (see 620 ).
  • the exported output of the pattern ( 710 ) in this embodiment includes a source and destination node that ultimately is consumed as a typed edge. In the example shown in FIGS.
  • friends is a Derived Link that is derived from other data, e.g., observable data.
  • the Derived Link “friendOfAFriend” is derived by identifying each subgraph that includes two persons, each of whom has a friends Derived Link with a middle man.
  • Observable data often arrives in discrete units of tightly interconnected data. This results in the creation of many disconnected subgraphs where each subgraph of observable data is isolated from other subgraphs within the total link oriented data set. This often disconnected nature of data presents a challenge for Link Analysis, as many analytic approaches will operate on each of these data subgraphs in isolation, diminishing the ability to discover new valuable links between entities within the data.
  • Link induction is an approach which creates new typed links between nodes through comparative analysis of two subgraphs.
  • link induction (like the creation of derived links) is the result of an analytical or computational process that preferably considers only features or attributes present (or inherent) in the data set. This is distinct from general link creation which encompasses link creation using knowledge not necessarily present in the data set.
  • the process of link induction is comprised of two phases. The first phase is selection of two subgraphs for comparison, and may be accomplished with many of the well known or previously detailed analytic operations such as type selection or subgraph matching. The second phase is comparison between the selected subgraphs to select candidates to connect with new links.
  • One exemplary subgraph comparison technique used for inducing links is the process of computing ‘nearness’ of selected nodes in each subgraph.
  • This ‘nearness’ operation is used to compare attribute proximity given a distance function, where the distance function may be geospatial ranges, temporal values, phonetic similarity, simple string comparison, or other distance function between literal values assigned to node attributes.
  • the graph analytics platform software will provide a variety of pre-configured distance functions for the analyst and will also provide the analyst with the power to define custom distance functions as needed during analysis.
  • FIGS. 9 a and 9 b illustrate how geospatial nearness can be used to induce links between multiple people who were sighted near each other about the same time.
  • FIG. 9 a depicts disconnected observation data 900 containing two person-nodes representing Fred 910 and Joe 930 .
  • the person nodes 910 and 930 are unconnected—there is no link or edge between them to identify any possible connection between them.
  • the analyst can specify a distance function in that compares geospatial attribute values (such as, for example, geospatial coordinates and time of day of a confirmed sighting) and induces a link between the nodes whose geospatial attribute values are within an analyst-specified distance from each other.
  • 9 a includes geospatial attribute values 920 , 940 relating to Fred and Joe, namely that Fred has been sighted at 202 Maple St. and Joe has been sighted at 210 Maple Street at or about a specified time. In the example, 202 Maple St. and 210 Maple Street are within a mile of each other. If the analyst-specified distance function is satisfied by a pair of persons with geospatial coordinates of sightings that are within one mile of each other and at or about a specified time, link 950 will be induced between Fred 910 and Joe 930 , as illustrated in FIG. 9 b.
  • FIGS. 10 a and 10 b illustrate an exemplary use of attribute “nearness” to induce links between persons who share similar names such as a familial name such as Al-Sabah, which in turn may identify persons that share a family or tribal or loyalty relationship.
  • FIG. 10 a shows disconnected observation data 1000 including persons with name attributes Ahmad I Al-Jaber Al-Saha 1010 , Sabah III Al-Salim Al-Sabah 1020 , and Mubarek Al-Sabah 1030 .
  • a distance function can be specified which is satisfied by similarity of names will induce links 1015 , 1025 and 1035 between the persons with the same familial name of Al-Sabah, as illustrated in FIG. 10 b .
  • Geospatial proximity and name similarity are examples of “nearness” based on comparison operations, and alternative comparison operations within the scope of the methods described herein will be familiar to those of ordinary skill in the art.
  • the link abstraction approaches described herein provide an additional layer of interpretation to the observational data or even other abstraction views. It is important to understand that these abstractions can build on the results of previous abstraction processes. For example, Association Discovery could utilize the results generated from Derived Link processing, which can be built upon data sets containing Induced Links. Further, the abstractions can be chained together in any order. The results of any computation analysis process can become input for any other process. This chaining approach to the abstraction layer provides the analyst a method for leveraging multiple insights to create a more complete understanding of the relevant date for further reasoning. The results of these abstraction approaches can be persisted as edges defined by the pair of endpoints for the link abstraction, and type name for the edge. This persistence form permits the storage of link abstraction results into long term storage, such as a relational database in local or remote persistent storage or a data store, and incorporation into computation processes across analyst sessions.
  • Links between nodes may require additional qualifiers to be effective for computational analysis.
  • SNA Social networking analysis
  • Such associations can be modeled as nodes with attributes, rather than as links between people. This modeling method allows robust representation of qualities of the association which may be important for analytical understanding.
  • a Person's membership in an organization frequently has discrete temporal aspects, such as the begin/end dates of the association. Observable events may have varying level of confidence dependant on the observation methodology utilized.
  • “association nodes” can be used to capture these qualified links in an embodiment. These association nodes can be stored in the link set as intermediary nodes in a link between graph entities. As illustrated in FIG.
  • exemplary data set excerpt 1100 includes nodes 1110 for a person and 1120 for an organization.
  • the fact that a person 1110 is a member of organization 1120 can be represented by association node 1130 , and important data about the membership (such as the startDate and endDate) can be stored as attributes of the association node.
  • Association links 1115 and 1125 link the entities 1110 and 1120 to the association node 1130 .
  • such modeling comes at a cost of higher model complexity and potentially confusing visualization, since humans typically think of such associations as simple links rather than nodes themselves.
  • the analyst in an embodiment can elect to display the entities 1110 and 1120 with the association node 1130 and association links 1115 and 1125 , or the analyst can conceal the association node 1130 and association links 1115 and 1125 and display the association between entities 1110 and 1120 as a single link (not shown).
  • Data incorporated into a dataset is done selectively based on the intended analysis goals of the system. Over time these intended goals or needs for the system will evolve, and require original principles used in data selection to be reassessed, and new data brought into consideration from original sources.
  • a ‘Pedigree’ layer is embodied in the system. This pedigree layer tags any data incorporated into the data set with information about the origin or source, and information about the agents or users involved in the data creation, or its modification or deletion. This provides the analyst the ability to return to original sources for insight that may have been lost through the data preparation process.
  • Pedigree records consist of a plurality of value properties that describe the origin for a group of nodes and edges. This plurality of properties is given a unique identifier, which is subsequently recorded as a property on each affected node and edge in the data set.
  • the unbounded nature of the pedigree properties allows adaptation of the pedigree mechanism to address data from varied sources such as structured databases, records management systems, and unstructured reports.
  • FIG. 12 shows an example of how origin information for data prepared from a traffic report is recorded and associated with the data instances. Data from the traffic report is organized as typed nodes and named edges 1200 , and pedigree record 1210 associated with the collection of nodes and edges 1200 includes the source of the information (i.e., Traffic Report No. 211 ), the URI where the traffic report was found, the date of creation, and the person who created it.
  • Charting tools facilitate human comprehension and reasoning over results of the data abstraction layers and are valuable to the analysis process.
  • Charting tools provide methods to contextualize the entities and understand the relationships between represented entities. With visualization of large link-oriented datasets, methods must be provided to abstract details, allowing the analyst to focus on entities and relations that are important to provide situational understanding and hiding those that are not relevant to gain this understanding. Finally, charting tools must provide access to the computational link analysis abilities detailed previously to allow new insights to be added into the link abstraction view. Through such charting capabilities, analysts are provided a means to quickly comprehend, investigate, and evaluate link-oriented data.
  • Link Charting is a method of presenting link-oriented data visually to convey the relational nature of the underlying data. Display of link-oriented data in a link charting visualization is familiar to those skilled in the art, and supported in a range of commercial tools. However, the visualization capabilities in an embodiment provide enhancements through tight integration with computational link analysis methods and visual data abstraction abilities. Preferably, the graph analytics platform software provides for the visual display of link-oriented data and also for production of link-oriented data in other output formats, such as, for example, ESRI shapes or the format used by Google Earth.
  • FIGS. 13 a and 13 b illustrate an exemplary use of Path Simplification.
  • FIG. 13 a illustrates a detailed view of source graph 1300 showing the persons of interest 1310 , 1340 , and 1350 and the pathways between them showing intermediate nodes 1315 , 1320 , 1325 , 1335 representing the connecting path details associated with phone calls between persons 1310 , 1340 and 1350 .
  • FIG. 13 b shows a simplified view in which the intermediate nodes are concealed and replaced with single links 1385 , 1390 and 1395 preserving the communication nature of the underlying details of the phone communication.
  • the subgraph representing multiple participants in a phone call is simplified to present direct connectivity between the individuals.
  • details in the link-oriented data set can be reduced to core concepts of interest for analyst understanding and presentation, including the relationship between the connectivity between persons 1310 , 1340 and 1350 and person 1350 's air travel 1360 , 1370 to destination 1380 .
  • the rules for path simplification are defined by indicating the candidate set of node types that should be simplified. For each of the candidate node types marked for simplification, a list of the entire candidate's relation tuples to preserve must also be recorded. Finally, the candidate simplification nodes are ranked from most to least important concept. With these simplification rules modeled, candidate nodes can then be replaced by edges representing existence of instances of their relation tuples. Types for the edges can then be assigned based on the type ranking and comparison to connecting edge types.
  • Geospatial Charting is a method to present geospatial information of given entities in a geospatial coordinate system.
  • a common embodiment of this method is to display entities at specific locations within a map view of a region. Through locating entities as geospatial coordinates, an understanding of proximity between entities and geospatial features can be conveyed, providing additional insight.
  • Trajectory tracking is the ability to display movement paths of entities using multiple observation data relations over time. This is done in an automated fashion by interpreting the semantics of relations for a given entity to positional observations. In tracking an individual it is common to have positional events recorded from many methods such as cell phone tower positions, personal observations, sales receipts, and other type events. It is also possible to calculate and present group activity—a plurality of points, representing members of a logical group, based on shared behavior within a given timeframe—within a geospatial perspective.
  • a group of phone devices found to be calling one another and acting as a coordinated group may be plotted in a geospatial context with display elements (e.g., visually bounded by a geometric shape) to suggest the known range of movement and use of the devices.
  • Trajectory tracking combines the location data from these multiple, different events and presents them in an ordered display, preferably in temporal order, as illustrated in exemplary geospatial trajectory chart 1400 in FIG. 14 . This tracking provides insight into understanding patterns of behavior and potentially estimating future locations.
  • FIGS. 15 a , 15 b and 15 c illustrate the process by which the trajectory for an individual Person is extracted from the graph model.
  • FIG. 15 a shows a trajectory source graph 1500 .
  • Paths rooted at the tracked entity 1503 are defined within the graph structure for identifying sequence information. These path definitions define the type of entity providing the mappable coordinate, such as a Sighting 1507 , 1509 , Residence, PhoneCall, or Incident. From these mappable entities, additional paths are defined to indicate the attributes providing coordinate values, and temporal bounds, 1512 ; 1513 , 1514 , 1515 , 1516 , 1518 .
  • FIG. 15 b illustrates trajectory path selection by depicting trajectory paths 1533 , 1536 , 1539 defining mappable points which are extracted from the original source graph data. Each of these path contains the coordinate and time bound values for a mappable point for the subject 1503 .
  • FIG. 15 c illustrates Trajectory Sequence Creation. Using the path definitions, trajectory paths 1533 , 1536 and 1539 are converted into row-oriented records 1573 , 1576 and 1579 in table 1570 containing coordinate and time information. Additional values may also be included in the results records to provide contextual information for each of these mappable points.
  • FIG. 16 shows an exemplary trajectory path definition of one mappable point for a Person node type, which can contain a plurality of these mappable point definitions.
  • FIG. 17 depicts the components of an embodiment of a computer system 1700 that is programmed to perform the methods described above.
  • the methods and functions described above are performed by graph analytic platform software implemented in software that is executed by the computer system 1700 although other implementations are within the scope of the invention such as implementing the methods on a hardware device or a combination of hardware and software.
  • the system is implemented on computer 1710 .
  • computer 1710 preferably includes one or more processing units 1712 operatively connected via system bus 1711 to persistent storage units, including hard drive 1716 and CD/DVD drive 1714 , network interface device 1718 , and memory 1720 that stores the software instructions executed by processing unit 1712 to implement the methods described herein.
  • Computer 1710 preferably includes data store 1762 (which may be local or remote), conventional input/output devices including display 1764 , keyboard 1766 and pointing/trackball device 1768 .
  • data store 1762 which may be local or remote
  • conventional input/output devices including display 1764 , keyboard 1766 and pointing/trackball device 1768 .
  • hard drive 1716 includes least 5 GB of free space.
  • Display 1764 can be local or remote, and includes conventional monitors, printers, any other from of graphic display devices, and virtual display devices such as a specified file.
  • Memory 1720 preferably includes operating system software 1730 which may be conventional, such as Windows or Linux.
  • Memory 1720 also preferably includes link-oriented data set 1748 and the graph analytics platform software 1740 , comprising a plurality of lines of program instructions or code which are executed by processor 1712 to perform the methods described herein, including support and operation of the link-oriented dataset 1748 and link analysis and abstracting information for use in link analysis as is discussed herein.
  • graph analytics platform software 1740 includes computational analysis module 1742 and a Link Charter module 1744 for production of link-oriented data.
  • Link Charter module 1744 is a client of computational analysis module 1742 .
  • link-oriented dataset 1748 can be stored in or distributed among memory 1720 , persistent storage 1714 , 1716 and/or data store 1762 .
  • the computer system 1700 may comprise one computer 1710 or in an embodiment one or more computers 1710 interconnected via network 1785 to increase performance of the system as needed.
  • computer 1710 is a workstation connected via network 1785 to servers 1788 comprising persistent storage, data stores, and other network resources.
  • computer 1710 is a server in a client-server architecture, with one or more exemplary client devices such as desktop computer 1793 , PDA or handheld device 1795 , laptop computer 1791 , or tablet computer 1798 .
  • the system also may be implemented using other computer architectures, including but not limited to a mainframe system with terminals, ASP (application service provider), peer-to-peer, and similar architectures, and network 1785 can include a local area network, a wide area network, the internet, the World Wide Web, a wireless network, a mobile phone network and the like, all of which are within the scope of the invention since the invention is not limited to any particular computer architecture or network.
  • computer system 1700 can be any system that provides sufficient computing power, memory, and persistent storage to execute the methods described herein, including link analysis and abstracting information for use in link analysis as is discussed herein.

Abstract

Observable data points are collected and organized into a link-oriented data set comprising nodes and links. Information is abstracted for use in link analysis by generating links between the collected data points, including deriving links and inducing links. A link can be induced by linking together a pair of nodes that satisfy a distance function. Exemplary distance functions that can be used to induce links include geo spatial proximity, attribute nearness, and name similarity. Paths can be identified between selected nodes of interest through a dataset operation, and nodes and/or links can be selectively included or excluded from the data set operation. The dataset can be augmented with pedigree information or one or more association nodes. Link information, including a trajectory and a connected path that selectively produces or excludes one or more intermediate nodes, can be displayed and/or produced in a specified format.

Description

    RELATED PATENTS/PRIORITY CLAIM
  • This application claims the benefit of U.S. Provisional Application No, 61/013,273, filed on 12 Dec. 2007, which is hereby incorporated by reference.
  • TECHNICAL FIELD
  • The invention relates generally to a method and system for abstracting or transforming data stored in a link-oriented data set for use in link analysis.
  • BACKGROUND
  • Over the past several decades, criminal and terrorist networks have evolved the sophistication by which they finance, organize and communicate. These changes are reflected in events from 9/11 to violent crimes associated with drug trafficking to Improvised Explosive Devices used all over the globe. Both law enforcement and military intelligence agencies are charged with detecting, disrupting, and dismantling these human networks in an attempt to combat what has been called asymmetric threats.
  • An effective technique used to understand and combat these kinds of threats is Link Analysis-the modeling of high-level networks and linkages between people, organizations, and events to gain insight into the weak or unknown portions so that some action can be taken against these networks. FIG. 1 illustrates generally how information flows during an exemplary intelligence analysis cycle 100, and includes some major transition points that have direct relevance to tools and technologies supporting analysts. Information is collected from and by various sources and methods, and its collection is highly dependent on the disciplines involved; this information is usually collected independently or indirectly from the analytical cycles that exploit it. The analysis phase is highly subjective with respect to the skills and training of individual analysts and agencies, and it includes manual and computational techniques that can establish relevant relationships in support of a perspective or recommendation. The preparation phase is a graphical information presentation (e.g. network chart) workflow that attempts to visually communicate the “punch line” of an analytical process, that is, a condensed information model is drawn. Lastly, the presentation phase is typically the assembly and production of some kind of media that can be presented or distributed for human consumption.
  • What is important to note about this process is that it involves lots of people, organizations, and systems whereby information is searched, analyzed, and organized in highly manual and individual ways. Two kinds of computational tool support that are relevant for this problem area are link charting and computational link analysis.
  • Link Charting. Computer support for the preparation phase of the analysis process has been widely supported by a variety of commercial tools such as Analyst Notebook, Centrifuge, and Visual Analytics. These tools focus on aiding the preparation of visually compelling or communicative information so that the analytical results can be consumed by the intended audience. However, the proportion of time spent on the preparation phase is relatively small to because these tools amount to task-specialized drawing tools much like tools such as Visio or PowerPoint are to presentation. The difficult task of wielding large amounts of information or applying computationally intensive methods to information is ignored by this class of tool.
  • As a result, analysts are compelled to assemble a set of disconnected tools that are difficult to use in a uniform or smooth technique, and they must also develop ad hoc (and often manual) processes to manage the information discovery and exploration tasks through their analysis methodology. An additional consequence is that standard intelligence practices are hard to reproduce as they are intermingled with the tool integration approaches themselves; as tools change, the process changes or they way in which an analyst uses a tool can change thereby making processes brittle and reproducibility difficult. There is an unmet need for improved computer support of analysis and not just preparation.
  • Computational Link Analysis. Simply stated, Link Analysis includes the methods and techniques used to produce the information that feeds the presentation phase of the analysis process. The goal is to incrementally capture, understand, refine, and analyze Human Activity Networks such that latent or non-obvious relationships can be discovered and definitive actions can take place such as arrests, intelligence targeting, or threats being eliminated.
  • While many techniques for Link Analysis are known, they have traditionally been manual and impractical to implement computationally or at Technical Needs of Computational Link Analysis Methods scale. For example, matrix operations can be used to find associations between people but cannot be used frequently, in large part, due to the difficulty of capturing relevant information because many things need to come together to make robust computational link analysis feasible. For example, algorithms, software architectures, hardware performance, global-scale networking, and commoditized large data stores need to converge at once to provide computational support.
  • A goal of computational link analysis is to create a synergistic behavior between human analysts and computers where information intensive tools and techniques can aid analysts in “zeroing in” on relevant understanding or abstracting the linkages between information. Said differently, computers should do what they do best (which is lots of dumb calculations quickly) and analysts should do what they do best-reason and analyze.
  • Link Analysis can be used to identify and qualify high-level links in Human Activity Networks (HANs). These links are combinations of many kinds of simple and complex linkages and pathways in link-oriented data and very often are manually constructed or simply drawn in pictures. Presented here is a technology solution that allows such high-level links to be realized in computation link analysis technologies.
  • SUMMARY
  • Disclosed are a method, system and computer program product for abstracting information for use in link analysis. Observable data points are collected and organized into a link-oriented data set comprising nodes and links. Information is abstracted for use in link analysis by generated links between the collected data points. One exemplary embodiment of a generated link is a derived link which may be derived as a result of one or more dataset operations on the link-oriented data set. Another embodiment is a link that is generated based solely on features inherent in the data set. Another example of a generated link is an induced link, which may be induced in an embodiment by linking together a pair of nodes That satisfy a distance function. Exemplary distance functions that can be used to induce links include geospatial proximity, attribute nearness, and name similarity. In another embodiment, two nodes of interest are selected and paths are identified between the nodes of interest through a dataset operation. In embodiments the analyst can selectively include or exclude from the data set operation typed nodes and/or links, including induced links or derived links. In another embodiment the dataset is augmented with pedigree information or one or more association nodes.
  • Additional embodiments are disclosed for producing link information, including displaying link information or outputting link information in a specified format. Embodiments of produced link information include a trajectory and a connected path that selectively produces or excludes one or more intermediate nodes. The methods and systems disclosed herein transform the link and node organization of collected information into a form and/or format that is more useful to the analyst.
  • The above as well as additional objectives, features and advantages of the present invention will become apparent in the following detailed written description.
  • DESCRIPTION OF THE DRAWINGS
  • FIG. 1 depicts a high level view of an intelligence analysis cycle.
  • FIG. 2 depicts exemplary link variations within a sample population.
  • FIG. 3 depicts exemplary information layers.
  • FIG. 4 depicts an exemplary Human Activity Network.
  • FIG. 5 depicts pathways used to define an exemplary Derived Link within an exemplary Human Activity Network.
  • FIG. 6 depicts an XML specification for possible Derived Links in an embodiment.
  • FIG. 7 depicts an example of a pattern query used to derive a Derived Link in an to embodiment.
  • FIGS. 8 a and 8 b illustrate an exemplary application of type exclusion to enhance Association Discovery.
  • FIGS. 9 a and 9 b illustrate an exemplary application of Link Induction based on geospatial nearness.
  • FIGS. 10 a and 10 b illustrate an exemplary application of Link Induction based on name similarity.
  • FIG. 11 illustrates an exemplary association node in an embodiment.
  • FIG. 12 depicts an exemplary use of pedigree properties in an embodiment.
  • FIGS. 13 a and 13 b illustrate an exemplary use of Path Simplification in an embodiment.
  • FIG. 14 depicts an exemplary geospatial trajectory chart in an embodiment.
  • FIGS. 15 a, 15 b and 15 c illustrate stages of an exemplary process for extracting a trajectory for an entity.
  • FIG. 16 depicts an exemplary trajectory path definition of one mappable point for a Person node type in an embodiment.
  • FIG. 17 depicts the components of an embodiment of a system for abstracting information for use in link analysis.
  • DETAILED DESCRIPTION
  • Technical Needs of Computational Link Analysis Methods. Very often in link analysis, analysts need to show how people are “connected” to each other or hypothesize that people are connected, and then analysis results are combined to establish a non-obvious linkage. FIG. 2 shows how two different linkages between the same set of people can help illustrate what person is potentially exploitable from a targeting perspective. The potentially exploitable persons can be identified by constructing two networks, one from the perspective of being part of the family by marriage and one from the perspective of being in the blood or tribal network.
  • What the example shows is the need to abstract or derive many kinds of relationships such as spouse Of or parent Of into the logical grouping of family-MemberOf. However, the vast number of ways that these relationships exist and need to be stated presents a serious technical challenge. Moreover, the definitions of these relationships will change over time as more is learned about the discipline, the network itself, or how data is collected. Therefore, it may be neither possible nor feasible to enumerate all the possible linkages of the data before the data is collected or analyzed. Association Discovery and Cluster Analysis are two computational analysis methods useful in deriving or identifying data linkages of interest.
  • Association Discovery is the process of finding linkages between two or more entities given a variety of complicated or convoluted pathways between them. For example, it can be inferred that two people know each other because they lived at the same place or they committed crimes together or they belong to the same gang, or even they give common information such as the same phone number. Additionally, associations between people can be inferred when the people show up at physical locations together or know many of the same people in the same area or are in proximity to a large number of similar crime locations.
  • As these associations are built up, linkages can be combined together (possibly with other links) to form a network of activity. Often these networks are focused around a particular theme such as crimes. To support a more general approach of building networks around multiple activities, a more general network structure, such as a Human Activity Network, can be used.
  • When considering paths that may connect entities, preferably the analyst has the ability to selectively include or exclude entity types as intermediaries as path candidates. For example, to discover methods used by individuals for communication, it might be beneficial to exclude non-communication pathways for consideration. This may be accomplished by excluding entity types. FIGS. 8 a and 8 b illustrate an exemplary application of this technique. FIG. 8 a shows source data model 800 comprising exemplary entity types, including person 810, PhoneNumber 815, PhoneCall 820, PhoneTower 825, Meeting 830, EmailAddress 840, Email 845, PersonName 860, Organization 870, Flight 880, Airline 887, and Airport 885. Some of these types (e.g., Organization 870, Person Name 860, and Flight-related types (880)) do not directly relate to methods of communication with other persons and can be excluded from display so that the analyst can focus on communication-related data types such as PhoneNumber 815 and EmailAddress 840, as shown in FIG. 8 b. The ability to selectively include or exclude type for path consideration provides additional tools to the analyst to narrow the results and pinpoint those relative links of interest. Using type exclusion also reduces the search space for Association Discovery which improves the efficiency of the search. An embodiment allows the analyst several ways to selectively include or exclude types for path consideration, including rules-based techniques and manual selection.
  • Cluster Analysis is a complementary technique to Association Discovery in that once a high-quality abstracted network has been built, people (or other nodes) in the network can be clustered based on their associations. (Other names for his technique include Group Detection or Community Extraction). Referring back to the example in FIG. 2, two kinds of clusters could be built to compare and contrast the family versus blood networks.
  • More specifically, most of the algorithmic techniques for clustering (i.e., the technique that produces the clusters) make use of computational linear algebra and require highly abstracted or pristine links. However, the data is not in such a state in its intrinsic form. Typically pre-processing on small data sets is done unless the data is intrinsically collected in pristine network form. An example of this type of data is phone call logs.
  • Information Abstraction in Link Analysis. Typically there is a gap between the information needed by analysts to make analysis decisions and the data collected. This can be illustrated by information abstraction layers. FIG. 3 shows three layers that represent notional stable points in a data storage and representation embodiment, namely the Observables Layer 310, the Entities Layer 340 and the Aggregates Layer 370.
  • Observables Layer: The data collected throughout the course of normal or daily activity is represented in Observables Layer 310, that is, things that can be observed and/or recorded (e.g., electronically). Examples include email, documents, phone call logs, financial transaction, database records and any other type of data used on, by or with a computer.
  • Entities Layer: Entities layer 340 reflects qualitative evaluation, refinements and judgments about the data and what it represents specifically with respect to the entities under scrutiny (people, organizations, locations, etc.) For example, in an exemplary embodiment of a Human Activity Network, the Entities Layer would resolve two different names of a person to the same person represented in the network.
  • Aggregates Layer: The output of Cluster Analysis is an example of what would be represented in Aggregates Layer 370, that is, groups of people can be aggregated into groups. Moreover, people can be aggregated from countless perspectives, and comparison of these variations can show how human networks function. However, the technical requirements of the techniques used to make aggregates cannot just use information represented at the Observables Layer as is.
  • An important conclusion to draw from this observation about how information needs to be tiered is that there is a gap in how data is collected, processed and stored as compared to how the behaviors of people and organizations via Human Activity Networks can be analyzed and discovered.
  • In an embodiment, a graph analytics platform provides the technology for generating linkages for use at a high-level of analysis. Preferably the graph analytics platform is implemented in software (which may include portions implemented in hardware). It is assumed that observable (or raw) data has been collected, and the graph analytics platform preferably stores or organizes the collected observable data in a form that is link-oriented, that is, data is organized as Nodes and Links (or edges) between nodes. Exemplary link-oriented data sets include graphs and trees, and can be implemented with relational database technology such as a relational database management system and query language using methods well-known to those of ordinary skill in the art. Nodes have types associated with them (e.g. People) and one ore more attributes and Links are named (e.g. parentOf) and their end points are also typed (e.g. links of People). Attributes are named scalar value properties that express owned aspects of a given Node type (e.g., a person's name, a vehicle's model, or a phone call's duration). The features of the graph analytics platform are not dependent on the definition of any one data set, but can adapt to function against any data set that is or will be defined.
  • The graph analytics platform includes search and segment matching tools to search the data set efficiently and to match segments or patterns or identify nodes or links that meet specified criteria. Methods and techniques for searching and segment matching, including without limitation graph tools including sub-graph matching and relational database methods, are well-known to those of ordinary skill in the art. In an embodiment the link-oriented data set uses a strongly-typed node and link system, where every node is of an identifiable type such as ‘Person’ or ‘Organization’. Links are typed and connected between identifying node types, such as ‘Person memberOf Organization’. In an embodiment, links are typed but do not have attributes, which facilitates scalable, fast pattern matching. Preferably the graph analytics platform uses a strongly-typed link-oriented data, segment matching for data set searches, an efficient storage format and language and use of query languages for building queries, all as described in pending U.S. patent application Ser. No. 11/590,070 filed Oct. 30, 2006 entitled Segment Matching Search System and Method, hereby incorporated by reference. A graph analytics platform preferably also provides pattern search (including graph pattern matching), and management and application development (including client and server tools) functionality. An exemplary embodiment of a graph analytics platform is the Lynxeon Intelligence Analytics Enterprise product suite provided by 21st Century Technologies.
  • FIG. 4 depicts an exemplary Human Activity Network 400. To analyze the exemplary Human Activity Network 400, it would be helpful to be able to identify links such as loyalTo, trained, etc. The problem is that such data is not necessarily intrinsically available in the captured data.
  • It is also assumed that the captured data will not be directly organized like the idealized network 400 from FIG. 4, and there will be more than one way to derive links such as, for example, the link loyalTo. If there are multiple paths or substructures in the data that justify the loyalTo association, it will be valuable to derive all the links that are defined in terms of all these paths, that is, to identify all pairs of nodes where the desired pathways exists between the nodes. A derived link is therefore a mechanism that allows dynamic synthesis of typed links in link-oriented datasets. For a simple exemplary illustration, the derived link loyalTo as someone who calls each other or has met as a safe house as shown in FIG. 5 with highlighted elements. In FIG. 5, for example, there are loyalTo derived links between persons 520 and 530, and between persons 540 and 550, because the observable data shows phone calls between them (510, 560).
  • In an embodiment, Derived Links can be generalized as the set of typed edges (i.e. typed node pairs) that are the result of a disjunctive set of subgraph matching operations. Those of ordinary skill in the art will appreciate that other dataset operations such as, by way of non-limiting example, pattern matching or matrix operations, can be used in addition to, or instead of, subgraph matching operations, and further, that the results may be aggregated in whole or in part, excluded in whole or in part, or otherwise operated upon in any number of ways to generate a set of typed edges. While there may be special cases in some embodiments (for example the nodes may have to be the same type or capable of path discovery via linear algebra), the general idea allows a solution to be cast in many technology implementations. A characteristic of one embodiment is to defer the generation of such linkages as late as possible while balancing the computational efficiency to produce answers sufficiently quickly.
  • FIGS. 6 and 7 illustrate an embodiment implemented using Lynxeon in which Derived Links can be used to condition link-oriented data to perform cluster analysis. FIG. 6 shows an XML specification 600 of the possible Derived Links for a particular schema. Line 14 (610) shows that the Derived Link “friendOfAFriend” is defined using a pattern query that is based on graph matching approaches. FIG. 7 is an example of a pattern query that is referenced in the Derived Link Specification of FIG. 6 (see 620). The exported output of the pattern (710) in this embodiment includes a source and destination node that ultimately is consumed as a typed edge. In the example shown in FIGS. 6 and 7, friends is a Derived Link that is derived from other data, e.g., observable data. The Derived Link “friendOfAFriend” is derived by identifying each subgraph that includes two persons, each of whom has a friends Derived Link with a middle man.
  • Observable data often arrives in discrete units of tightly interconnected data. This results in the creation of many disconnected subgraphs where each subgraph of observable data is isolated from other subgraphs within the total link oriented data set. This often disconnected nature of data presents a challenge for Link Analysis, as many analytic approaches will operate on each of these data subgraphs in isolation, diminishing the ability to discover new valuable links between entities within the data.
  • Link induction is an approach which creates new typed links between nodes through comparative analysis of two subgraphs. Specifically, link induction (like the creation of derived links) is the result of an analytical or computational process that preferably considers only features or attributes present (or inherent) in the data set. This is distinct from general link creation which encompasses link creation using knowledge not necessarily present in the data set. The process of link induction is comprised of two phases. The first phase is selection of two subgraphs for comparison, and may be accomplished with many of the well known or previously detailed analytic operations such as type selection or subgraph matching. The second phase is comparison between the selected subgraphs to select candidates to connect with new links.
  • One exemplary subgraph comparison technique used for inducing links is the process of computing ‘nearness’ of selected nodes in each subgraph. This ‘nearness’ operation is used to compare attribute proximity given a distance function, where the distance function may be geospatial ranges, temporal values, phonetic similarity, simple string comparison, or other distance function between literal values assigned to node attributes. Preferably the graph analytics platform software will provide a variety of pre-configured distance functions for the analyst and will also provide the analyst with the power to define custom distance functions as needed during analysis.
  • FIGS. 9 a and 9 b illustrate how geospatial nearness can be used to induce links between multiple people who were sighted near each other about the same time. FIG. 9 a depicts disconnected observation data 900 containing two person-nodes representing Fred 910 and Joe 930. The person nodes 910 and 930 are unconnected—there is no link or edge between them to identify any possible connection between them. However, the analyst can specify a distance function in that compares geospatial attribute values (such as, for example, geospatial coordinates and time of day of a confirmed sighting) and induces a link between the nodes whose geospatial attribute values are within an analyst-specified distance from each other. The data set illustrated in FIG. 9 a includes geospatial attribute values 920, 940 relating to Fred and Joe, namely that Fred has been sighted at 202 Maple St. and Joe has been sighted at 210 Maple Street at or about a specified time. In the example, 202 Maple St. and 210 Maple Street are within a mile of each other. If the analyst-specified distance function is satisfied by a pair of persons with geospatial coordinates of sightings that are within one mile of each other and at or about a specified time, link 950 will be induced between Fred 910 and Joe 930, as illustrated in FIG. 9 b.
  • FIGS. 10 a and 10 b illustrate an exemplary use of attribute “nearness” to induce links between persons who share similar names such as a familial name such as Al-Sabah, which in turn may identify persons that share a family or tribal or loyalty relationship. FIG. 10 a shows disconnected observation data 1000 including persons with name attributes Ahmad I Al-Jaber Al-Saha 1010, Sabah III Al-Salim Al-Sabah 1020, and Mubarek Al-Sabah 1030. A distance function can be specified which is satisfied by similarity of names will induce links 1015, 1025 and 1035 between the persons with the same familial name of Al-Sabah, as illustrated in FIG. 10 b. Geospatial proximity and name similarity are examples of “nearness” based on comparison operations, and alternative comparison operations within the scope of the methods described herein will be familiar to those of ordinary skill in the art.
  • Although people, and relationships between people, are the primary entities under scrutiny in the foregoing examples, those of ordinary skill in the art will appreciate that the methods described herein are equally applicable to analyzing other types of entities, such as organizations or events, and relationships between the entities.
  • The link abstraction approaches described herein provide an additional layer of interpretation to the observational data or even other abstraction views. It is important to understand that these abstractions can build on the results of previous abstraction processes. For example, Association Discovery could utilize the results generated from Derived Link processing, which can be built upon data sets containing Induced Links. Further, the abstractions can be chained together in any order. The results of any computation analysis process can become input for any other process. This chaining approach to the abstraction layer provides the analyst a method for leveraging multiple insights to create a more complete understanding of the relevant date for further reasoning. The results of these abstraction approaches can be persisted as edges defined by the pair of endpoints for the link abstraction, and type name for the edge. This persistence form permits the storage of link abstraction results into long term storage, such as a relational database in local or remote persistent storage or a data store, and incorporation into computation processes across analyst sessions.
  • Links between nodes may require additional qualifiers to be effective for computational analysis. Social networking analysis (SNA) requires representation and visualization of links between people, which may represent the relationships between them, such as friendships, marriages, coworkers, associates, etc. Such associations can be modeled as nodes with attributes, rather than as links between people. This modeling method allows robust representation of qualities of the association which may be important for analytical understanding. A Person's membership in an organization frequently has discrete temporal aspects, such as the begin/end dates of the association. Observable events may have varying level of confidence dependant on the observation methodology utilized. “association nodes” can be used to capture these qualified links in an embodiment. These association nodes can be stored in the link set as intermediary nodes in a link between graph entities. As illustrated in FIG. 11, exemplary data set excerpt 1100 includes nodes 1110 for a person and 1120 for an organization. The fact that a person 1110 is a member of organization 1120 can be represented by association node 1130, and important data about the membership (such as the startDate and endDate) can be stored as attributes of the association node. Association links 1115 and 1125 link the entities 1110 and 1120 to the association node 1130. However, such modeling comes at a cost of higher model complexity and potentially confusing visualization, since humans typically think of such associations as simple links rather than nodes themselves. Thus the analyst in an embodiment can elect to display the entities 1110 and 1120 with the association node 1130 and association links 1115 and 1125, or the analyst can conceal the association node 1130 and association links 1115 and 1125 and display the association between entities 1110 and 1120 as a single link (not shown).
  • Data incorporated into a dataset is done selectively based on the intended analysis goals of the system. Over time these intended goals or needs for the system will evolve, and require original principles used in data selection to be reassessed, and new data brought into consideration from original sources. To facilitate origin tracking of data incorporated into the data set, a ‘Pedigree’ layer is embodied in the system. This pedigree layer tags any data incorporated into the data set with information about the origin or source, and information about the agents or users involved in the data creation, or its modification or deletion. This provides the analyst the ability to return to original sources for insight that may have been lost through the data preparation process.
  • Pedigree records consist of a plurality of value properties that describe the origin for a group of nodes and edges. This plurality of properties is given a unique identifier, which is subsequently recorded as a property on each affected node and edge in the data set. The unbounded nature of the pedigree properties allows adaptation of the pedigree mechanism to address data from varied sources such as structured databases, records management systems, and unstructured reports. FIG. 12 shows an example of how origin information for data prepared from a traffic report is recorded and associated with the data instances. Data from the traffic report is organized as typed nodes and named edges 1200, and pedigree record 1210 associated with the collection of nodes and edges 1200 includes the source of the information (i.e., Traffic Report No. 211), the URI where the traffic report was found, the date of creation, and the person who created it.
  • Charting tools facilitate human comprehension and reasoning over results of the data abstraction layers and are valuable to the analysis process. Charting tools provide methods to contextualize the entities and understand the relationships between represented entities. With visualization of large link-oriented datasets, methods must be provided to abstract details, allowing the analyst to focus on entities and relations that are important to provide situational understanding and hiding those that are not relevant to gain this understanding. Finally, charting tools must provide access to the computational link analysis abilities detailed previously to allow new insights to be added into the link abstraction view. Through such charting capabilities, analysts are provided a means to quickly comprehend, investigate, and evaluate link-oriented data.
  • Link Charting is a method of presenting link-oriented data visually to convey the relational nature of the underlying data. Display of link-oriented data in a link charting visualization is familiar to those skilled in the art, and supported in a range of commercial tools. However, the visualization capabilities in an embodiment provide enhancements through tight integration with computational link analysis methods and visual data abstraction abilities. Preferably, the graph analytics platform software provides for the visual display of link-oriented data and also for production of link-oriented data in other output formats, such as, for example, ESRI shapes or the format used by Google Earth.
  • Path Simplification provides a method for abstracting complex paths between nodes into single edge visual representation, while preserving the most significant type representing this path. FIGS. 13 a and 13 b illustrate an exemplary use of Path Simplification. FIG. 13 a illustrates a detailed view of source graph 1300 showing the persons of interest 1310, 1340, and 1350 and the pathways between them showing intermediate nodes 1315, 1320, 1325, 1335 representing the connecting path details associated with phone calls between persons 1310, 1340 and 1350. FIG. 13 b shows a simplified view in which the intermediate nodes are concealed and replaced with single links 1385, 1390 and 1395 preserving the communication nature of the underlying details of the phone communication. In this way the subgraph representing multiple participants in a phone call is simplified to present direct connectivity between the individuals. Thus details in the link-oriented data set can be reduced to core concepts of interest for analyst understanding and presentation, including the relationship between the connectivity between persons 1310, 1340 and 1350 and person 1350's air travel 1360, 1370 to destination 1380.
  • The rules for path simplification are defined by indicating the candidate set of node types that should be simplified. For each of the candidate node types marked for simplification, a list of the entire candidate's relation tuples to preserve must also be recorded. Finally, the candidate simplification nodes are ranked from most to least important concept. With these simplification rules modeled, candidate nodes can then be replaced by edges representing existence of instances of their relation tuples. Types for the edges can then be assigned based on the type ranking and comparison to connecting edge types.
  • Geospatial Charting is a method to present geospatial information of given entities in a geospatial coordinate system. A common embodiment of this method is to display entities at specific locations within a map view of a region. Through locating entities as geospatial coordinates, an understanding of proximity between entities and geospatial features can be conveyed, providing additional insight.
  • Trajectory tracking is the ability to display movement paths of entities using multiple observation data relations over time. This is done in an automated fashion by interpreting the semantics of relations for a given entity to positional observations. In tracking an individual it is common to have positional events recorded from many methods such as cell phone tower positions, personal observations, sales receipts, and other type events. It is also possible to calculate and present group activity—a plurality of points, representing members of a logical group, based on shared behavior within a given timeframe—within a geospatial perspective. For example: a group of phone devices found to be calling one another and acting as a coordinated group may be plotted in a geospatial context with display elements (e.g., visually bounded by a geometric shape) to suggest the known range of movement and use of the devices. Trajectory tracking combines the location data from these multiple, different events and presents them in an ordered display, preferably in temporal order, as illustrated in exemplary geospatial trajectory chart 1400 in FIG. 14. This tracking provides insight into understanding patterns of behavior and potentially estimating future locations.
  • The graph data representing the knowledge of an entity must be converted into a sequence of distinct points in time for trajectory tracking. FIGS. 15 a, 15 b and 15 c illustrate the process by which the trajectory for an individual Person is extracted from the graph model. FIG. 15 a shows a trajectory source graph 1500. Paths rooted at the tracked entity 1503 are defined within the graph structure for identifying sequence information. These path definitions define the type of entity providing the mappable coordinate, such as a Sighting 1507, 1509, Residence, PhoneCall, or Incident. From these mappable entities, additional paths are defined to indicate the attributes providing coordinate values, and temporal bounds, 1512; 1513, 1514, 1515, 1516, 1518. Additional paths may be defined to incorporate other useful attribute information into the mappable points to assist in comprehension of the charted trajectory as desired. FIG. 15 b illustrates trajectory path selection by depicting trajectory paths 1533, 1536, 1539 defining mappable points which are extracted from the original source graph data. Each of these path contains the coordinate and time bound values for a mappable point for the subject 1503. FIG. 15 c illustrates Trajectory Sequence Creation. Using the path definitions, trajectory paths 1533, 1536 and 1539 are converted into row-oriented records 1573, 1576 and 1579 in table 1570 containing coordinate and time information. Additional values may also be included in the results records to provide contextual information for each of these mappable points. The records can be ordered by their start time values to create a time-based sequence of locations for the subject. FIG. 16 shows an exemplary trajectory path definition of one mappable point for a Person node type, which can contain a plurality of these mappable point definitions.
  • FIG. 17 depicts the components of an embodiment of a computer system 1700 that is programmed to perform the methods described above. In this embodiment, the methods and functions described above are performed by graph analytic platform software implemented in software that is executed by the computer system 1700 although other implementations are within the scope of the invention such as implementing the methods on a hardware device or a combination of hardware and software. In the example shown in FIG. 1700, the system is implemented on computer 1710. In an exemplary embodiment, computer 1710 preferably includes one or more processing units 1712 operatively connected via system bus 1711 to persistent storage units, including hard drive 1716 and CD/DVD drive 1714, network interface device 1718, and memory 1720 that stores the software instructions executed by processing unit 1712 to implement the methods described herein. Computer 1710 preferably includes data store 1762 (which may be local or remote), conventional input/output devices including display 1764, keyboard 1766 and pointing/trackball device 1768. Preferably hard drive 1716 includes least 5 GB of free space. Display 1764 can be local or remote, and includes conventional monitors, printers, any other from of graphic display devices, and virtual display devices such as a specified file.
  • The size requirements of memory 1720, persistent storage units 1716 and 1714 and data store 1762 will increase depending on size of observational data included into the system. Memory 1720 preferably includes operating system software 1730 which may be conventional, such as Windows or Linux. Memory 1720 also preferably includes link-oriented data set 1748 and the graph analytics platform software 1740, comprising a plurality of lines of program instructions or code which are executed by processor 1712 to perform the methods described herein, including support and operation of the link-oriented dataset 1748 and link analysis and abstracting information for use in link analysis as is discussed herein. In an embodiment, graph analytics platform software 1740 includes computational analysis module 1742 and a Link Charter module 1744 for production of link-oriented data. In an embodiment, Link Charter module 1744 is a client of computational analysis module 1742. In an embodiment, link-oriented dataset 1748 can be stored in or distributed among memory 1720, persistent storage 1714, 1716 and/or data store 1762.
  • The computer system 1700 may comprise one computer 1710 or in an embodiment one or more computers 1710 interconnected via network 1785 to increase performance of the system as needed. In a preferred embodiment, computer 1710 is a workstation connected via network 1785 to servers 1788 comprising persistent storage, data stores, and other network resources. In another embodiment, computer 1710 is a server in a client-server architecture, with one or more exemplary client devices such as desktop computer 1793, PDA or handheld device 1795, laptop computer 1791, or tablet computer 1798. The system also may be implemented using other computer architectures, including but not limited to a mainframe system with terminals, ASP (application service provider), peer-to-peer, and similar architectures, and network 1785 can include a local area network, a wide area network, the internet, the World Wide Web, a wireless network, a mobile phone network and the like, all of which are within the scope of the invention since the invention is not limited to any particular computer architecture or network. Generally, computer system 1700 can be any system that provides sufficient computing power, memory, and persistent storage to execute the methods described herein, including link analysis and abstracting information for use in link analysis as is discussed herein.
  • Those of skill will recognize that the techniques of the embodiments described herein may be implemented to advantage in a variety of sequential orders and that the present invention may be generally implemented in magnetic media such as RAM drives, USB drives, disks, tapes, DVDs and CD-ROMs or other storage media for introduction into a system for s abstracting information for use in link analysis. In such cases, program instructions for executing the steps described herein in abstracting information for use in link analysis will be embedded in the media.
  • The terms and descriptions used herein are set forth by way of illustration only and are not meant as limitations. Those skilled in the art will recognize that many variations are to possible within the spirit and scope of the invention as defined in the following claims, and their equivalents, in which all terms are to be understood in their broadest possible sense unless otherwise indicated. The described embodiments illustrate the scope of the claims but do not restrict the scope of the claims.

Claims (70)

1. A method for abstracting information for use in link analysis comprising:
representing a plurality of collected observable data points in a link-oriented dataset; and
abstracting information for use in link analysis from the plurality of collected observable data points by generating links between two or more of the plurality of observable data points.
2. The method of claim 1 wherein the step of generating links between two or more of the plurality of observable data points comprises deriving at least one link between two or more of the plurality of observable data points.
3. The method of claim 2 wherein the step of representing the plurality of collected observable data points in a link-oriented dataset further comprises organizing the plurality of collected observable data points into one or more typed nodes and one or more named links between the nodes, the named links comprising typed end points.
4. The method of claim 3 further comprising displaying one or more typed nodes and one or more derived links.
5. The method of claim 4 further comprising selectively concealing one or more links.
6. The method of claim 2 wherein the step of abstracting information for use in link analysis by deriving links between one or more of the plurality of observable data points further comprises the step of performing one or more dataset operations on the link-oriented dataset.
7. The method of claim 4 wherein the one or more dataset operations comprise a first dataset operation comprising one or more of the following: subgraph matching, path matching, or matrix algebra.
8. The method of claim 7 wherein the one or more dataset operations further comprise a second dataset operation on a result of the first dataset operation.
9. The method of claim 8 wherein the second dataset operation comprises aggregating all pairs of typed nodes that result from the first dataset operation.
10. The method of claim 1 wherein the step of generating links between two or more of the plurality of observable. data points comprises generating a link based solely on features inherent in the link-oriented data set.
11. The method of claim 1 wherein the step of generating links between two or more of the plurality of observable data points comprises inducing at least one link between two or more of the plurality of observable data points.
12. The method of claim 11 wherein the link-oriented dataset comprises a plurality of nodes and wherein the step of inducing a least one link between two or more of the plurality of observable data points further comprises inducing a link between at least one pair of nodes that satisfies a distance function.
13. The method of claim 12 wherein the distance function comprises geospatial proximity.
14. The method of claim 12 wherein the distance function comprises nearness of an attribute.
15. The method of claim 14 wherein the nearness of an attribute comprises name similarity.
16. The method of claim 1 further comprising:
selecting a first node and a second node; and
identifying at least one path between the first node and the second node, wherein identifying at least one path between the first node and second node comprises performing a dataset operation.
17. The method of claim 16 wherein one or more links in the link-oriented data set are selectively included or excluded from the dataset operation.
18. The method of claim 17 wherein at least one of the one or more links in the link-oriented data set that are selectively included or excluded from the dataset operation is an induced link or a derived link.
19. The method of claim 16 wherein one or more nodes in the link-oriented data set are included or excluded from the dataset operation.
20. The method of claim 19 wherein one or more nodes are selectively included or excluded from the dataset operation based on type.
21. The method of claim 16 wherein the dataset operation comprises a shortest path algorithm.
22. The method of claim 16 wherein at least one path between the first node and second node comprises an induced link or a derived link.
23. The method of claim 1 in which the link-oriented data set comprises data pedigree information.
24. The method of claim 1 in which the link-oriented data set comprises at least one association node.
25. The method of claim 1 further comprising the step of producing link information.
26. The method of claim 25 wherein the step of producing link information comprises displaying the link information.
27. The method of claim 25 wherein the step of producing link information comprises outputting the link information in a specified format.
28. The method of claim 25 further comprising producing a trajectory.
29. The method of claim 28 wherein the trajectory comprises two or more data points having geospatial attributes.
30. The method of claim 28 wherein the trajectory comprises group activity.
31. The method of claim 25 further comprising producing an association node.
32. The method of claim 25 wherein the link-oriented dataset includes a first node, a second node, and a connected path between the first node and second node that includes one or more intermediate nodes; and selectively producing or excluding from production at least one of the one or more intermediate nodes.
33. A system for abstracting information for use in link analysis comprising:
a processor;
a memory operatively connected to the processor, the memory comprising a link-oriented dataset comprising a plurality of collected observable data points; and
graph analytics platform software comprising instruction code which when executed by the processor provides the function of:
abstracting information for use in link analysis from the plurality of collected observable data points by generating links between two or more of the plurality of observable data points.
34. The system of claim 33 wherein the graph analytics platform software further comprises instruction code which when executed by the processor derives at least one link between two or more of the plurality of observable data points.
35. The system of claim 33 wherein the plurality of collected observable data points are organized into one or more typed nodes and one or more named links between the nodes, the named links comprising typed end points.
36. The system of claim 35 wherein the graph analytics platform software further comprises instruction code which when executed by the processor displays one or more typed nodes and one or more derived links.
37. The system of claim 36 wherein the graph analytics platform software further comprises instruction code which when executed by the processor selectively conceals one or more links.
38. The system of claim 34 wherein the graph analytics platform software further comprises instruction code which when executed by the processor performs one or more dataset operations on the link-oriented dataset.
39. The system of claim 38 wherein the one or more dataset operations comprise a first dataset operation comprising one or more of the following: subgraph matching, path matching, or matrix algebra.
40. The system of claim 39 wherein the one or more dataset operations further comprise a second dataset operation on a result of the first dataset operation.
41. The system of claim 40 wherein the second dataset operation comprises aggregating all pairs of typed nodes that result from the first dataset operation.
42. The system of claim 33 wherein the graph analytics platform software further comprises instruction code which when executed by the processor generates a link based solely on features inherent in the link-oriented data set.
43. The system of claim 33 wherein the graph analytics platform software further comprises instruction code which when executed by the processor induces at least one link between two or more of the plurality of observable data points.
44. The system of claim 43 wherein the link-oriented dataset comprises a plurality of nodes and wherein the graph analytics platform software further comprises instruction code which when executed by the processor induces a link between at least one pair of nodes that satisfies a distance function.
45. The system of claim 44 wherein the distance function comprises geospatial proximity.
46. The system of claim 44 wherein the distance function comprises nearness of an attribute.
47. The system of claim 46 wherein the nearness of an attribute comprises name similarity.
48. The system of claim 33 wherein the graph analytics platform software further comprises instruction code which when executed by the processor provides the functions of:
selecting a first node and a second node; and
identifying at least one path between the first node and the second node, wherein identifying at least one path between the first node and second node comprises performing a dataset operation.
49. The system of claim 48 wherein the graph analytics platform software further comprises instruction code which when executed by the processor selectively includes or excludes one or more links in the link-oriented data set from the dataset operation.
50. The system of claim 49 wherein at least one of the one or more links in the link-oriented data set that are selectively included or excluded from the dataset operation is an induced link or a derived link.
51. The system of claim 48 wherein the graph analytics platform software further comprises instruction code which when executed by the processor selectively includes or excludes one or more nodes in the link-oriented data set from the dataset operation.
52. The system of claim 51 wherein one or more nodes are selectively included or excluded from the dataset operation based on type.
53. The system of claim 48 wherein the dataset operation comprises a shortest path algorithm.
54. The system of claim 48 wherein at least one path between the first node and second node comprises an induced link or a derived link.
55. The system of claim 33 in which the link-oriented data set comprises data pedigree information.
56. The system of claim 33 in which the link-oriented data set comprises at least one association node.
57. The system of claim 33 wherein the graph analytics platform software further comprises instruction code which when executed by the processor produces link information.
58. The system of claim 57 wherein the graph analytics platform software further comprises instruction code which when executed by the processor displays the link information on a display device coupled to the processor.
59. The system of claim 57 wherein the graph analytics platform software further comprises instruction code which when executed by the processor outputs the link information in a specified format.
60. The system of claim 57 wherein the graph analytics platform software further comprises instruction code which when executed by the processor produces a trajectory.
61. The system of claim 60 wherein the trajectory comprises two or more data points having geospatial attributes.
62. The system of claim 60 wherein the trajectory comprises group activity.
63. The system of claim 57 wherein the graph analytics platform software further comprises instruction code which when executed by the processor produces an association node.
64. The system of claim 57 wherein the link-oriented dataset includes a first node, a second node, and a connected path between the first node and second node that includes one or more intermediate nodes; and wherein the graph analytics platform software further comprises instruction code which when executed by the processor selectively produces or excludes from production at least one of the one or more intermediate nodes.
65. A software program product comprising:
a computer readable medium; and
program code on the computer readable medium that when executed provides the functions of
representing a plurality of collected observable data points in a link-oriented dataset; and
abstracting information for use in link analysis from the plurality of collected observable data points by generating links between two or more of the plurality of observable data points.
66. A software program product of claim 65 further comprising program code on the computer readable medium that when executed provides the functions of deriving at least one link between two or more of the plurality of observable data points.
67. A software program product of claim 65 further comprising program code on the computer readable medium that when executed provides the functions of inducing at least one link between two or more of the plurality of observable data points.
68. A software program product of claim 65 further comprising program code on the computer readable medium that when executed provides the functions of:
selecting a first node and a second node; and
identifying at least one path between the first node and the second node, wherein identifying at least one path between the first node and second node comprises performing a dataset operation.
69. A software program product of claim 65 further comprising program code on the computer readable medium that when executed provides the function of producing link information.
70. The software program product of claim 69 wherein the function of producing link information comprises displaying the link information.
US12/747,868 2007-12-12 2008-12-12 Method and System for Abstracting Information for Use in Link Analysis Abandoned US20110225158A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US12/747,868 US20110225158A1 (en) 2007-12-12 2008-12-12 Method and System for Abstracting Information for Use in Link Analysis

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US1327307P 2007-12-12 2007-12-12
PCT/US2008/086729 WO2009148473A1 (en) 2007-12-12 2008-12-12 Method and system for abstracting information for use in link analysis
US12/747,868 US20110225158A1 (en) 2007-12-12 2008-12-12 Method and System for Abstracting Information for Use in Link Analysis

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2008/086729 A-371-Of-International WO2009148473A1 (en) 2007-12-12 2008-12-12 Method and system for abstracting information for use in link analysis

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/990,421 Continuation US11055350B2 (en) 2007-12-12 2018-05-25 Method and system for abstracting information for use in link analysis

Publications (1)

Publication Number Publication Date
US20110225158A1 true US20110225158A1 (en) 2011-09-15

Family

ID=41398380

Family Applications (4)

Application Number Title Priority Date Filing Date
US12/747,868 Abandoned US20110225158A1 (en) 2007-12-12 2008-12-12 Method and System for Abstracting Information for Use in Link Analysis
US15/990,421 Active 2029-11-06 US11055350B2 (en) 2007-12-12 2018-05-25 Method and system for abstracting information for use in link analysis
US17/368,717 Active 2029-03-14 US11762909B2 (en) 2007-12-12 2021-07-06 Method and system for abstracting information for use in link analysis
US18/240,320 Pending US20230409638A1 (en) 2007-12-12 2023-08-30 Method and system for abstracting information for use in link analysis

Family Applications After (3)

Application Number Title Priority Date Filing Date
US15/990,421 Active 2029-11-06 US11055350B2 (en) 2007-12-12 2018-05-25 Method and system for abstracting information for use in link analysis
US17/368,717 Active 2029-03-14 US11762909B2 (en) 2007-12-12 2021-07-06 Method and system for abstracting information for use in link analysis
US18/240,320 Pending US20230409638A1 (en) 2007-12-12 2023-08-30 Method and system for abstracting information for use in link analysis

Country Status (2)

Country Link
US (4) US20110225158A1 (en)
WO (1) WO2009148473A1 (en)

Cited By (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100293203A1 (en) * 2009-05-18 2010-11-18 Henry Roberts Williams User interface for graph database data
US20110131208A1 (en) * 2009-09-23 2011-06-02 Verint Systems Ltd. Systems and methods for large-scale link analysis
US20120159392A1 (en) * 2010-12-15 2012-06-21 Sap Ag System and Method of Adding User Interface Element Groups
US20130290878A1 (en) * 2012-04-13 2013-10-31 Huawei Technologies Co., Ltd. Generation and display method of user interface and user interface device
US20140101179A1 (en) * 2012-10-08 2014-04-10 International Business Machines Corporation Mapping Infrastructure Layout Between Non-Corresponding Datasets
US20150026158A1 (en) * 2012-01-31 2015-01-22 Kent State University Systems, methods, and software for unified analytics environments
US20150220588A1 (en) * 2014-02-03 2015-08-06 International Business Machines Corporation Distributed analytics for entity resolution
US9336302B1 (en) 2012-07-20 2016-05-10 Zuci Realty Llc Insight and algorithmic clustering for automated synthesis
US20160179901A1 (en) * 2014-12-23 2016-06-23 Palo Alto Research Center Incorporated Computer-Implemented System And Method For Providing Selective Contextual Exposure Within Social Network Situations
US20170039295A1 (en) * 2015-08-07 2017-02-09 New Jersey Institute Of Technology Tribal abstraction network
US20170148026A1 (en) * 2015-11-24 2017-05-25 Vesta Corporation Exclusion of nodes from link analysis
US9898541B2 (en) 2014-11-20 2018-02-20 International Business Machines Corporation Generating derived links
US10489786B2 (en) 2015-11-24 2019-11-26 Vesta Corporation Optimization of fraud detection model in real time
US10510078B2 (en) 2015-11-24 2019-12-17 Vesta Corporation Anomaly detection in groups of transactions
US10628826B2 (en) 2015-11-24 2020-04-21 Vesta Corporation Training and selection of multiple fraud detection models
US20210312352A1 (en) * 2017-09-22 2021-10-07 1Nteger, Llc Systems and methods for investigating and evaluating financial crime and sanctions-related risks
US11205103B2 (en) 2016-12-09 2021-12-21 The Research Foundation for the State University Semisupervised autoencoder for sentiment analysis
US20230004889A1 (en) * 2017-09-22 2023-01-05 1Nteger, Llc Systems and methods for risk data navigation

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2009148473A1 (en) * 2007-12-12 2009-12-10 21Ct, Inc. Method and system for abstracting information for use in link analysis
CN109726282A (en) * 2018-12-26 2019-05-07 东软集团股份有限公司 A kind of method, apparatus, equipment and storage medium generating article abstract
US20210329053A1 (en) * 2020-04-21 2021-10-21 Sling TV L.L.C. Multimodal transfer between audio and video streams

Citations (46)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5469367A (en) * 1994-06-06 1995-11-21 University Technologies International Inc. Methodology and apparatus for modular partitioning for the machine design of asynchronous circuits
US5963942A (en) * 1996-01-16 1999-10-05 Fujitsu Limited Pattern search apparatus and method
US6038560A (en) * 1997-05-21 2000-03-14 Oracle Corporation Concept knowledge base search and retrieval system
US6108645A (en) * 1997-11-26 2000-08-22 International Business Machines Corporation Method and apparatus for efficient profile matching in a large scale webcasting system
US6154736A (en) * 1997-07-30 2000-11-28 Microsoft Corporation Belief networks with decision graphs
US20020091680A1 (en) * 2000-08-28 2002-07-11 Chirstos Hatzis Knowledge pattern integration system
US20020129014A1 (en) * 2001-01-10 2002-09-12 Kim Brian S. Systems and methods of retrieving relevant information
US6480856B1 (en) * 1995-10-20 2002-11-12 Microsoft Corporation Method and system for implementing software objects
US6505197B1 (en) * 1999-11-15 2003-01-07 International Business Machines Corporation System and method for automatically and iteratively mining related terms in a document through relations and patterns of occurrences
US6529891B1 (en) * 1997-12-04 2003-03-04 Microsoft Corporation Automatic determination of the number of clusters by mixtures of bayesian networks
US20040015478A1 (en) * 2000-11-30 2004-01-22 Pauly Duncan Gunther Database
US20040139070A1 (en) * 1999-05-11 2004-07-15 Norbert Technologies, L.L.C. Method and apparatus for storing data as objects, constructing customized data retrieval and data processing requests, and performing householding queries
US20040143560A1 (en) * 2003-01-20 2004-07-22 Chun Bao Zhu Path searching system using multiple groups of cooperating agents and method thereof
US20040172347A1 (en) * 2003-02-28 2004-09-02 Knut Barthel Determining the occurrence of events using decision trees
US20050086238A1 (en) * 1999-05-25 2005-04-21 Nevin Rocky Harry W.Iii Method and apparatus for displaying data stored in linked nodes
US20050096880A1 (en) * 2003-09-02 2005-05-05 Kabushiki Kaisha Toshiba Inverse model calculation apparatus and inverse model calculation method
US20060085370A1 (en) * 2001-12-14 2006-04-20 Robert Groat System for identifying data relationships
US20060106847A1 (en) * 2004-05-04 2006-05-18 Boston Consulting Group, Inc. Method and apparatus for selecting, analyzing, and visualizing related database records as a network
US20060253418A1 (en) * 2002-02-04 2006-11-09 Elizabeth Charnock Method and apparatus for sociological data mining
US20070061266A1 (en) * 2005-02-01 2007-03-15 Moore James F Security systems and methods for use with structured and unstructured data
US7197451B1 (en) * 1998-07-02 2007-03-27 Novell, Inc. Method and mechanism for the creation, maintenance, and comparison of semantic abstracts
US20070097959A1 (en) * 2005-09-02 2007-05-03 Taylor Stephen F Adaptive information network
US7216116B1 (en) * 1996-05-06 2007-05-08 Spotfire Ab Data analysis system with automated query and visualization environment setup
US20070226248A1 (en) * 2006-03-21 2007-09-27 Timothy Paul Darr Social network aware pattern detection
US7343374B2 (en) * 2004-03-29 2008-03-11 Yahoo! Inc. Computation of page authority weights using personalized bookmarks
US20080086551A1 (en) * 2006-03-21 2008-04-10 Melanie Tina Moy Computer automated group detection
US20080109730A1 (en) * 2006-11-08 2008-05-08 Thayne Richard Coffman Sna-based anomaly detection
US20080201339A1 (en) * 2007-02-21 2008-08-21 Mcgrew Robert J Providing unique views of data based on changes or rules
US20080258880A1 (en) * 2007-01-10 2008-10-23 Smith Richard A Information Collecting and Decision Making Via Tiered Information Network Systems
US20080288587A1 (en) * 2007-05-18 2008-11-20 International Business Machines Corporation Method and system for scoring and ranking a plurality of relationships in components of socio-technical system
US7512612B1 (en) * 2002-08-08 2009-03-31 Spoke Software Selecting an optimal path through a relationship graph
US20090150128A1 (en) * 2004-03-15 2009-06-11 Zhongfei Zhang Method for detecting people of interest from information sources
US20090160658A1 (en) * 2007-04-17 2009-06-25 Semandex Networks Inc. Systems and methods for providing semantically enhanced identity management
US7660705B1 (en) * 2002-03-19 2010-02-09 Microsoft Corporation Bayesian approach for learning regression decision graph models and regression models for time series analysis
US20100070542A1 (en) * 2004-02-18 2010-03-18 Tarabunk Fund Limited Liability Company Machine-implemented activity management system using asynchronously shared activity data objects and journal data items
US20100070448A1 (en) * 2002-06-24 2010-03-18 Nosa Omoigui System and method for knowledge retrieval, management, delivery and presentation
US7686214B1 (en) * 2003-05-12 2010-03-30 Id Analytics, Inc. System and method for identity-based fraud detection using a plurality of historical identity records
US7730085B2 (en) * 2005-11-29 2010-06-01 International Business Machines Corporation Method and system for extracting and visualizing graph-structured relations from unstructured text
US20100145771A1 (en) * 2007-03-15 2010-06-10 Ariel Fligler System and method for providing service or adding benefit to social networks
US20100211924A1 (en) * 2005-07-05 2010-08-19 Microsoft Corporation Discovering and exploiting relationships in software repositories
US7912842B1 (en) * 2003-02-04 2011-03-22 Lexisnexis Risk Data Management Inc. Method and system for processing and linking data records
US20110167343A1 (en) * 2004-03-29 2011-07-07 Oculus Info Inc. System and Method for Applying Link Analysis Tools for Visualizing Connected Temporal and Spatial Information on a User Interface
US20110246483A1 (en) * 2006-03-21 2011-10-06 21St Century Technologies, Inc. Pattern Detection and Recommendation
US8200700B2 (en) * 2005-02-01 2012-06-12 Newsilike Media Group, Inc Systems and methods for use of structured and unstructured distributed data
US8316060B1 (en) * 2005-01-26 2012-11-20 21st Century Technologies Segment matching search system and method
US8515983B1 (en) * 2005-10-28 2013-08-20 21st Century Technologies Segment matching search system and method

Family Cites Families (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6556983B1 (en) * 2000-01-12 2003-04-29 Microsoft Corporation Methods and apparatus for finding semantic information, such as usage logs, similar to a query using a pattern lattice data space
US7519542B1 (en) * 2001-08-14 2009-04-14 Versata Development Group, Inc. System and method for modeling and applying a people network representation
US7657540B1 (en) * 2003-02-04 2010-02-02 Seisint, Inc. Method and system for linking and delinking data records
US7580947B2 (en) * 2003-03-27 2009-08-25 Hewlett-Packard Development Company, L.P. Data representation for improved link analysis
US7562814B1 (en) * 2003-05-12 2009-07-21 Id Analytics, Inc. System and method for identity-based fraud detection through graph anomaly detection
US20060053175A1 (en) * 2004-09-03 2006-03-09 Biowisdom Limited System and method for creating, editing, and utilizing one or more rules for multi-relational ontology creation and maintenance
US8126890B2 (en) * 2004-12-21 2012-02-28 Make Sence, Inc. Techniques for knowledge discovery by constructing knowledge correlations using concepts or terms
US20060149674A1 (en) * 2004-12-30 2006-07-06 Mike Cook System and method for identity-based fraud detection for transactions using a plurality of historical identity records
US9104779B2 (en) * 2005-03-30 2015-08-11 Primal Fusion Inc. Systems and methods for analyzing and synthesizing complex knowledge representations
US7958120B2 (en) * 2005-05-10 2011-06-07 Netseer, Inc. Method and apparatus for distributed community finding
US7672865B2 (en) * 2005-10-21 2010-03-02 Fair Isaac Corporation Method and apparatus for retail data mining using pair-wise co-occurrence consistency
US7668787B2 (en) * 2006-06-27 2010-02-23 Xerox Corporation Method, apparatus, and program product for efficiently adding entities and relationships in a comprehension state of a collection of information
US8010646B2 (en) * 2006-06-27 2011-08-30 Palo Alto Research Center Incorporated Method, apparatus, and program product for efficiently defining relationships in a comprehension state of a collection of information
US20140230030A1 (en) * 2006-11-22 2014-08-14 Raj Abhyanker Method and apparatus for geo-spatial and social relationship analysis
US10007895B2 (en) * 2007-01-30 2018-06-26 Jonathan Brian Vanasco System and method for indexing, correlating, managing, referencing and syndicating identities and relationships across systems
US20080228698A1 (en) * 2007-03-16 2008-09-18 Expanse Networks, Inc. Creation of Attribute Combination Databases
US8862622B2 (en) * 2007-12-10 2014-10-14 Sprylogics International Corp. Analysis, inference, and visualization of social networks
WO2009148473A1 (en) * 2007-12-12 2009-12-10 21Ct, Inc. Method and system for abstracting information for use in link analysis
US10394895B2 (en) * 2016-11-28 2019-08-27 International Business Machines Corporation Identifying relationships of interest of entities
US20200265090A1 (en) * 2019-02-20 2020-08-20 Oracle International Corporation Efficient graph query execution engine supporting graphs with multiple vertex and edge types

Patent Citations (50)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5469367A (en) * 1994-06-06 1995-11-21 University Technologies International Inc. Methodology and apparatus for modular partitioning for the machine design of asynchronous circuits
US6480856B1 (en) * 1995-10-20 2002-11-12 Microsoft Corporation Method and system for implementing software objects
US5963942A (en) * 1996-01-16 1999-10-05 Fujitsu Limited Pattern search apparatus and method
US7216116B1 (en) * 1996-05-06 2007-05-08 Spotfire Ab Data analysis system with automated query and visualization environment setup
US6038560A (en) * 1997-05-21 2000-03-14 Oracle Corporation Concept knowledge base search and retrieval system
US6154736A (en) * 1997-07-30 2000-11-28 Microsoft Corporation Belief networks with decision graphs
US6108645A (en) * 1997-11-26 2000-08-22 International Business Machines Corporation Method and apparatus for efficient profile matching in a large scale webcasting system
US6529891B1 (en) * 1997-12-04 2003-03-04 Microsoft Corporation Automatic determination of the number of clusters by mixtures of bayesian networks
US6807537B1 (en) * 1997-12-04 2004-10-19 Microsoft Corporation Mixtures of Bayesian networks
US7197451B1 (en) * 1998-07-02 2007-03-27 Novell, Inc. Method and mechanism for the creation, maintenance, and comparison of semantic abstracts
US20040139070A1 (en) * 1999-05-11 2004-07-15 Norbert Technologies, L.L.C. Method and apparatus for storing data as objects, constructing customized data retrieval and data processing requests, and performing householding queries
US20050086238A1 (en) * 1999-05-25 2005-04-21 Nevin Rocky Harry W.Iii Method and apparatus for displaying data stored in linked nodes
US8019786B2 (en) * 1999-05-25 2011-09-13 Nevin Iii Rocky Harry W Method and apparatus for displaying data stored in linked nodes
US6505197B1 (en) * 1999-11-15 2003-01-07 International Business Machines Corporation System and method for automatically and iteratively mining related terms in a document through relations and patterns of occurrences
US20020091680A1 (en) * 2000-08-28 2002-07-11 Chirstos Hatzis Knowledge pattern integration system
US20040015478A1 (en) * 2000-11-30 2004-01-22 Pauly Duncan Gunther Database
US20020129014A1 (en) * 2001-01-10 2002-09-12 Kim Brian S. Systems and methods of retrieving relevant information
US20060085370A1 (en) * 2001-12-14 2006-04-20 Robert Groat System for identifying data relationships
US20060253418A1 (en) * 2002-02-04 2006-11-09 Elizabeth Charnock Method and apparatus for sociological data mining
US7660705B1 (en) * 2002-03-19 2010-02-09 Microsoft Corporation Bayesian approach for learning regression decision graph models and regression models for time series analysis
US20100070448A1 (en) * 2002-06-24 2010-03-18 Nosa Omoigui System and method for knowledge retrieval, management, delivery and presentation
US7512612B1 (en) * 2002-08-08 2009-03-31 Spoke Software Selecting an optimal path through a relationship graph
US20040143560A1 (en) * 2003-01-20 2004-07-22 Chun Bao Zhu Path searching system using multiple groups of cooperating agents and method thereof
US7912842B1 (en) * 2003-02-04 2011-03-22 Lexisnexis Risk Data Management Inc. Method and system for processing and linking data records
US20040172347A1 (en) * 2003-02-28 2004-09-02 Knut Barthel Determining the occurrence of events using decision trees
US7686214B1 (en) * 2003-05-12 2010-03-30 Id Analytics, Inc. System and method for identity-based fraud detection using a plurality of historical identity records
US20050096880A1 (en) * 2003-09-02 2005-05-05 Kabushiki Kaisha Toshiba Inverse model calculation apparatus and inverse model calculation method
US20100070542A1 (en) * 2004-02-18 2010-03-18 Tarabunk Fund Limited Liability Company Machine-implemented activity management system using asynchronously shared activity data objects and journal data items
US20090150128A1 (en) * 2004-03-15 2009-06-11 Zhongfei Zhang Method for detecting people of interest from information sources
US7343374B2 (en) * 2004-03-29 2008-03-11 Yahoo! Inc. Computation of page authority weights using personalized bookmarks
US20110167343A1 (en) * 2004-03-29 2011-07-07 Oculus Info Inc. System and Method for Applying Link Analysis Tools for Visualizing Connected Temporal and Spatial Information on a User Interface
US20060106847A1 (en) * 2004-05-04 2006-05-18 Boston Consulting Group, Inc. Method and apparatus for selecting, analyzing, and visualizing related database records as a network
US8316060B1 (en) * 2005-01-26 2012-11-20 21st Century Technologies Segment matching search system and method
US20130166600A1 (en) * 2005-01-26 2013-06-27 21st Century Technologies Segment Matching Search System and Method
US20070061266A1 (en) * 2005-02-01 2007-03-15 Moore James F Security systems and methods for use with structured and unstructured data
US8200700B2 (en) * 2005-02-01 2012-06-12 Newsilike Media Group, Inc Systems and methods for use of structured and unstructured distributed data
US20100211924A1 (en) * 2005-07-05 2010-08-19 Microsoft Corporation Discovering and exploiting relationships in software repositories
US20070097959A1 (en) * 2005-09-02 2007-05-03 Taylor Stephen F Adaptive information network
US8515983B1 (en) * 2005-10-28 2013-08-20 21st Century Technologies Segment matching search system and method
US7730085B2 (en) * 2005-11-29 2010-06-01 International Business Machines Corporation Method and system for extracting and visualizing graph-structured relations from unstructured text
US20110246483A1 (en) * 2006-03-21 2011-10-06 21St Century Technologies, Inc. Pattern Detection and Recommendation
US7480712B2 (en) * 2006-03-21 2009-01-20 21St Century Technologies, Inc. Computer automated group detection
US20070226248A1 (en) * 2006-03-21 2007-09-27 Timothy Paul Darr Social network aware pattern detection
US20080086551A1 (en) * 2006-03-21 2008-04-10 Melanie Tina Moy Computer automated group detection
US20080109730A1 (en) * 2006-11-08 2008-05-08 Thayne Richard Coffman Sna-based anomaly detection
US20080258880A1 (en) * 2007-01-10 2008-10-23 Smith Richard A Information Collecting and Decision Making Via Tiered Information Network Systems
US20080201339A1 (en) * 2007-02-21 2008-08-21 Mcgrew Robert J Providing unique views of data based on changes or rules
US20100145771A1 (en) * 2007-03-15 2010-06-10 Ariel Fligler System and method for providing service or adding benefit to social networks
US20090160658A1 (en) * 2007-04-17 2009-06-25 Semandex Networks Inc. Systems and methods for providing semantically enhanced identity management
US20080288587A1 (en) * 2007-05-18 2008-11-20 International Business Machines Corporation Method and system for scoring and ranking a plurality of relationships in components of socio-technical system

Cited By (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100293203A1 (en) * 2009-05-18 2010-11-18 Henry Roberts Williams User interface for graph database data
US20110131208A1 (en) * 2009-09-23 2011-06-02 Verint Systems Ltd. Systems and methods for large-scale link analysis
US9135630B2 (en) * 2009-09-23 2015-09-15 Verint Systems Ltd. Systems and methods for large-scale link analysis
US20120159392A1 (en) * 2010-12-15 2012-06-21 Sap Ag System and Method of Adding User Interface Element Groups
US9342569B2 (en) * 2010-12-15 2016-05-17 Sap Se System and method of adding user interface element groups
US20150026158A1 (en) * 2012-01-31 2015-01-22 Kent State University Systems, methods, and software for unified analytics environments
US20130290878A1 (en) * 2012-04-13 2013-10-31 Huawei Technologies Co., Ltd. Generation and display method of user interface and user interface device
US9607023B1 (en) 2012-07-20 2017-03-28 Ool Llc Insight and algorithmic clustering for automated synthesis
US10318503B1 (en) 2012-07-20 2019-06-11 Ool Llc Insight and algorithmic clustering for automated synthesis
US9336302B1 (en) 2012-07-20 2016-05-10 Zuci Realty Llc Insight and algorithmic clustering for automated synthesis
US11216428B1 (en) 2012-07-20 2022-01-04 Ool Llc Insight and algorithmic clustering for automated synthesis
US20140101179A1 (en) * 2012-10-08 2014-04-10 International Business Machines Corporation Mapping Infrastructure Layout Between Non-Corresponding Datasets
US9552372B2 (en) * 2012-10-08 2017-01-24 International Business Machines Corporation Mapping infrastructure layout between non-corresponding datasets
US10424092B2 (en) 2012-10-08 2019-09-24 International Business Machines Corporation Mapping infrastructure layout between non-corresponding datasets
US9928620B2 (en) 2012-10-08 2018-03-27 International Business Machines Corporation Mapping infrastructure layout between non-corresponding datasets
US9390126B2 (en) * 2014-02-03 2016-07-12 International Business Machines Corporation Distributed analytics for entity resolution
US20150220588A1 (en) * 2014-02-03 2015-08-06 International Business Machines Corporation Distributed analytics for entity resolution
US9898541B2 (en) 2014-11-20 2018-02-20 International Business Machines Corporation Generating derived links
US10459982B2 (en) 2014-11-20 2019-10-29 International Businesss Machines Corporation Generating derived links
US20160179901A1 (en) * 2014-12-23 2016-06-23 Palo Alto Research Center Incorporated Computer-Implemented System And Method For Providing Selective Contextual Exposure Within Social Network Situations
US20170039295A1 (en) * 2015-08-07 2017-02-09 New Jersey Institute Of Technology Tribal abstraction network
US10489786B2 (en) 2015-11-24 2019-11-26 Vesta Corporation Optimization of fraud detection model in real time
US10496992B2 (en) * 2015-11-24 2019-12-03 Vesta Corporation Exclusion of nodes from link analysis
US10510078B2 (en) 2015-11-24 2019-12-17 Vesta Corporation Anomaly detection in groups of transactions
US10628826B2 (en) 2015-11-24 2020-04-21 Vesta Corporation Training and selection of multiple fraud detection models
US20170148026A1 (en) * 2015-11-24 2017-05-25 Vesta Corporation Exclusion of nodes from link analysis
US11205103B2 (en) 2016-12-09 2021-12-21 The Research Foundation for the State University Semisupervised autoencoder for sentiment analysis
US20210312352A1 (en) * 2017-09-22 2021-10-07 1Nteger, Llc Systems and methods for investigating and evaluating financial crime and sanctions-related risks
US20220222596A1 (en) * 2017-09-22 2022-07-14 1Nteger, Llc Systems and methods for investigating and evaluating financial crime and sanctions-related risks
US20230004889A1 (en) * 2017-09-22 2023-01-05 1Nteger, Llc Systems and methods for risk data navigation
US11734633B2 (en) * 2017-09-22 2023-08-22 Integer, Llc Systems and methods for investigating and evaluating financial crime and sanctions-related risks
US11734632B2 (en) * 2017-09-22 2023-08-22 Integer, Llc Systems and methods for investigating and evaluating financial crime and sanctions-related risks

Also Published As

Publication number Publication date
US11762909B2 (en) 2023-09-19
US20230409638A1 (en) 2023-12-21
US20180276311A1 (en) 2018-09-27
US11055350B2 (en) 2021-07-06
US20210342398A1 (en) 2021-11-04
WO2009148473A1 (en) 2009-12-10

Similar Documents

Publication Publication Date Title
US11762909B2 (en) Method and system for abstracting information for use in link analysis
Golfarelli et al. A model-driven approach to automate data visualization in big data analytics
O'Halloran et al. Multimodal approach to analysing big social and news media data
Goonetilleke et al. Twitter analytics: a big data management perspective
Colonna A taxonomy and classification of data mining
Hutchins et al. Hiding in plain sight: criminal network analysis
Strang et al. Analyzing relationships in terrorism big data using Hadoop and statistics
Shah et al. DaLiF: a data lifecycle framework for data-driven governments
Lee et al. Exploration of massive crime data sets through data mining techniques
Nissan An overview of data mining for combating crime
De et al. An introduction to data mining in social networks
CN103678350A (en) Social network searching result showing method and device
US10817545B2 (en) Cognitive decision system for security and log analysis using associative memory mapping in graph database
Li et al. Domain specific knowledge graphs as a service to the public: Powering social-impact funding in the us
Razzaq Malik et al. Multiagent semantical annotation enhancement model for iot-based energy-aware data
Purificato et al. A multimodal approach for cultural heritage information retrieval
Kumar Fake review detection using behavioral and contextual features
VandanaKolisetty et al. Integration and classification approach based on probabilistic semantic association for big data
Elzinga Formalizing the concepts of crimes and criminals
Reed et al. Analyzing behavior signatures for terrorist attack forecasting
Brambilla et al. Temporal analysis of social media response to live events: the milano fashion week
Stamou Data science for social good: development of a knowledge graph targeted to sustainable development goals
Gao Big Geo-Data
Signature Signature. ca
Zhang et al. A heterogeneous graph-based fraudulent community detection system

Legal Events

Date Code Title Description
AS Assignment

Owner name: 21CT, INC., TEXAS

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SYNDER, JIM;CHUAH, JOON HAO;DENTE, JOE;AND OTHERS;SIGNING DATES FROM 20110511 TO 20110516;REEL/FRAME:026310/0173

STCV Information on status: appeal procedure

Free format text: APPLICATION INVOLVED IN COURT PROCEEDINGS

STCV Information on status: appeal procedure

Free format text: COURT PROCEEDINGS TERMINATED

STCB Information on status: application discontinuation

Free format text: ABANDONED -- AFTER EXAMINER'S ANSWER OR BOARD OF APPEALS DECISION