U.S. patent application number 14/068900 was filed with the patent office on 2014-05-15 for data analysis system.
This patent application is currently assigned to SynerScope B.V.. The applicant listed for this patent is SynerScope B.V.. Invention is credited to Johannes Cornelius Adrianus BUENEN, Danny Hubertus Rosalia HOLTEN.
Application Number | 20140132623 14/068900 |
Document ID | / |
Family ID | 50681271 |
Filed Date | 2014-05-15 |
United States Patent
Application |
20140132623 |
Kind Code |
A1 |
HOLTEN; Danny Hubertus Rosalia ;
et al. |
May 15, 2014 |
DATA ANALYSIS SYSTEM
Abstract
A data analysis system (1) for displaying data facilitating
visual analysis of communication transaction includes a
transactions database (3) operable to cause representations of the
communication transactions to be displayed on a display screen (13)
by determining for each transaction a first set of control
co-ordinates; determining for each transaction a set of control
co-ordinates for drawing a straight line between co-ordinates
associated with the source and destination associated with the
communication transaction; calculating as a set of control
co-ordinates for representing a transaction weighted averages of
corresponding co-ordinates in the first and second set, weighted by
a bundling factor; and representing each of the communication
transaction as a line drawn utilizing the calculated control
co-ordinates for each transaction.
Inventors: |
HOLTEN; Danny Hubertus Rosalia;
(Kerkrade, NL) ; BUENEN; Johannes Cornelius Adrianus;
(S-Hertogenbosch, NL) |
|
Applicant: |
Name |
City |
State |
Country |
Type |
SynerScope B.V. |
S-Hertogenbosch |
|
NL |
|
|
Assignee: |
SynerScope B.V.
S-Hertogenbosch
NL
|
Family ID: |
50681271 |
Appl. No.: |
14/068900 |
Filed: |
October 31, 2013 |
Related U.S. Patent Documents
|
|
|
|
|
|
Application
Number |
Filing Date |
Patent Number |
|
|
13102648 |
May 6, 2011 |
|
|
|
14068900 |
|
|
|
|
Current U.S.
Class: |
345/593 ;
345/440; 345/634 |
Current CPC
Class: |
G06T 11/206 20130101;
G06T 2207/20072 20130101; G06T 11/001 20130101 |
Class at
Publication: |
345/593 ;
345/440; 345/634 |
International
Class: |
G06T 11/20 20060101
G06T011/20; G06T 11/00 20060101 G06T011/00 |
Claims
1. A method of generating a display, displaying data representing a
plurality of communication transactions, the method comprising:
determining a hierarchy having a tree structure wherein leaf nodes
in the lowest level of the hierarchy correspond to sources and
destinations associated with communication transactions to be
represented; associating elements of the hierarchy with
co-ordinates on a display screen; and representing each of the
plurality of communication transactions by: determining for each
transaction a first set of control co-ordinates comprising the
co-ordinates associated with elements in a path in the tree
structure connecting the source and destination associated with a
communication transaction via the closest common parent in the
hierarchy common to the source and destination; determining for
each transaction a second set of control co-ordinates for drawing a
straight line between co-ordinates associated with the source and
destination associated with the communication transaction;
calculating as a set of control co-ordinates for representing a
transaction weighted averages of corresponding co-ordinates in the
first and second set, weighted by a bundling factor; and
representing each of the communication transactions as a line drawn
utilizing the calculated control co-ordinates for each
transaction.
2. The method of claim 1 wherein determining for each transaction a
first set of control co-ordinates comprising the co-ordinates
associated with elements in a path in the tree structure connecting
the source and destination associated with a communication
transaction via the closest common parent in the hierarchy common
to the source and destination comprises: determining a list of
nodes on the tree structure for connecting the source and
destination associated with a communication transaction via the
closest common parent in the hierarchy common to the source and
destination and removing the node corresponding to the closest
common parent if the source and destination for the transaction are
not both child nodes of a single parent node.
3. The method of claim 1 further comprising appending as control
co-ordinates in the set of control co-ordinates for representing a
transaction multiple sets of control co-ordinates associated with
the source and destination of the transaction to be
represented.
4. The method of claim 3 wherein representing each of the
communication transaction as a line drawn utilizing the calculated
control co-ordinates for each transaction comprises representing
each communication transaction as an appended series of b-splines
as defined by groups of control co-ordinates in the calculated
set.
5. The method of claim 4 wherein representing each communication
transaction as an appended series of b-splines comprises:
determining co-ordinates for a number of points lying on the curve
defined by the appended series of b-splines; and calculating
co-ordinates for a set of quadrilaterals for representing the
transaction on the basis of the co-ordinates of the number of
points.
6. The method of claim 5 wherein the calculation of the
co-ordinates for a set of polygons is such to cause the points
lying on the curve defined by the appended series of b-splines to
lie on the midpoints of opposing ends of the quadrilaterals and the
other sides of the quadrilaterals are parallel to a line connecting
the midpoints of the opposing ends.
7. The method of claim 5 further comprising representing said
transactions by coloring said quadrilaterals.
8. The method of claim 7 wherein the coloring of the quadrilaterals
is determined based upon a criterion associated with the
transaction represented by the quadrilateral.
9. The method of claim 8 wherein the criterion associated with a
transaction comprises a criterion associated with any of: the
timing, frequency or amount associated with a transaction.
10. The method of claim 7 wherein the coloring of said
quadrilaterals varies along the length of the line drawn utilizing
the calculated control co-ordinates.
11. The method of claim 1 wherein representing each of the
communication transactions as a line drawn utilizing the calculated
control co-ordinates for each transaction comprises rendering each
of the lines in a graphics buffer and then combining the rendered
images.
12. The method of claim 11 wherein combining the rendered images
comprises: determining maximum color values for areas where lines
overlap; determining color values for rendering lines in a constant
color and calculating an alpha blend of the rendered lines; and
utilizing the calculated maximum color values and the values of the
determined alpha blend of constant color lines to determine the
colors to be included in a final display.
13. The method of claim 1 wherein the communication transactions
comprise transactions selected from the group comprising: telephone
calls, emails, text messages, instant messages, social media
messages or posts, and communications between computers.
14. The method of claim 1 wherein the hierarchy is geospatial such
that the tree structure defines a hierarchical arrangement of
geographical areas and leaf nodes correspond to geographical
locations of sources and destinations.
15. The method of claim 14 wherein the elements of the hierarchy
are associated with co-ordinates on the display screen that
correspond to relative geospatial coordinates of the elements.
16. The method of claim 1 wherein the data representing a plurality
of communication transactions includes a time at which each
communication transaction occurred.
17. The method of claim 16 wherein only those transactions that
occurred within a defined period of time are represented on the
display.
18. The method of claim 1 and further comprising, upon a selection
of a representation of a communication transaction, querying a
database of event information using data associated with the
communication transaction, and displaying the event information
provided in response to the query.
19. A data analysis system for displaying data facilitating visual
analysis of communication transactions: the system comprising: a
transactions database operable to store transaction records
defining communication transactions; a display screen operable to
display representations of communication transactions as lines
connecting positions associated with a source and a destination for
a communication transaction; and a processing module operable to
determine a hierarchy having a tree structure wherein leaf nodes in
the lowest level of the hierarchy correspond to sources and
destinations associated with communication transactions represented
by transaction records stored in the transactions database;
associate elements of the hierarchy with co-ordinates on a display
screen; and cause the display screen to show the representations of
the communication transactions by: determining for each transaction
a first set of control co-ordinates comprising the co-ordinates
associated with elements in a path in the tree structure connecting
the source and destination associated with a communication
transaction via the closest common parent in the hierarchy common
to the source and destination; determining for each transaction a
second set of control co-ordinates for drawing a straight line
between co-ordinates associated with the source and destination
associated with the communication transaction; calculating as a set
of control co-ordinates for representing a transaction weighted
averages of corresponding co-ordinates in the first and second set,
weighted by a bundling factor; and representing each of the
communication transactions as a line drawn utilizing the calculated
control co-ordinates for each transaction.
20. A computer readable medium storing computer implementable
instructions which when implemented by a programmable computer
cause the computer to: determine a hierarchy having a tree
structure wherein leaf nodes in the lowest level of the hierarchy
correspond to sources and destinations associated with
communication transactions to be represented; associate elements of
the hierarchy with co-ordinates on a display screen; and represent
each of the plurality of communication transactions by: determine
for each transaction a first set of control co-ordinates comprising
the co-ordinates associated with elements in a path in the tree
structure connecting the source and destination associated with a
communication transaction via the closest common parent in the
hierarchy common to the source and destination; determine for each
transaction a second set of control co-ordinates for drawing a
straight line between co-ordinates associated with the source and
destination associated with the communication transaction;
calculate as a set of control co-ordinates for representing a
transaction weighted averages of corresponding co-ordinates in the
first and second set, weighted by a bundling factor; and represent
each of the communication transactions as a line drawn utilizing
the calculated control co-ordinates for each transaction.
Description
CROSS-REFERENCE TO RELATED APPLICATIONS
[0001] This application is a continuation-in-part of U.S. patent
application Ser. No. 13/102,648, entitled "DATA ANALYSIS SYSTEM"
and filed May 6, 2011, the contents of which are incorporated in
their entirety by reference.
FIELD OF THE INVENTION
[0002] The present application concerns a data analysis system.
[0003] More specifically embodiments of the present application
concern methods and apparatus for processing transaction data to
identify deviations or anomalies from normal or expected patterns
of transactions and to assist in the interpretation of these
deviations or anomalies. Such transactions may include
communication transactions (e.g. telephone calls, emails, text
messages, instant messages, social media etc), financial
transactions, accounting transactions, insurance transactions,
security trading, and security access. Such deviation may arise due
to the occurrence of significant events, system problems or
failures, design mistakes, erroneous data entries or fraudulent
activity.
BACKGROUND TO THE INVENTION
[0004] Current methods for detecting issues and analyzing
disruptions within telecommunications networks are often reactive,
such that diagnostic and corrective action is not initiated until
after problems have been reported. This leads to a poor experience
for network users as they must deal with interrupted services and
face lengthy issue-resolution times. The identification of
deviations or anomalies from normal or expected patterns of
communication transactions can be very useful for proactively
identifying network issues before they have a significant impact on
users, and enabling the diagnostic and corrective action to be
initiated promptly. Furthermore, the ability to analyse
communication transactions in this way provides a valuable means
for accelerating both the diagnosis and resolution of such
issues.
[0005] In addition, such an analysis of communication transactions
can also be used to identify system design issues in order to
optimise network configuration and utilisation, identify fraudulent
behaviour etc. Moreover, such an analysis can also be used as a
means for identifying and even interpreting significant events
(e.g. weather, social, political and economic events). For example,
it is possible to use the analysis of deviations in the expected
patterns of mobile telecommunications such as calls and text
messages to identify events such as crisis situations and the early
signs of epidemics.
[0006] With the rapid advancement and wide-spread uptake of
communication technologies, there are now vast numbers of
communication transactions taking place daily. For example,
worldwide there are more than 200 billion emails, 4 billion text
messages and 90 million tweets sent every day. Consequently, one of
the main problems faced when attempting to implement an analysis of
communication transaction data is the massive amounts of data
involved, and the incredible rate at which new data is created. In
particular, communication transaction data is usually so
substantial, dynamic and varied that it is extremely difficult to
carry out a meaningful and conclusive analysis in a short space of
time.
[0007] In view of the above an analysis system is desirable which
assists with the efficient identification of deviations or
anomalies in normal or expected patterns of transactions, entries
or events, and the interpretation or diagnosis of the cause of
these deviations or anomalies.
SUMMARY OF THE INVENTION
[0008] In accordance with one aspect of the present invention there
is provided a method of generating a display, displaying data
representing a plurality of communication transactions, the method
comprising: determining a hierarchy having a tree structure wherein
leaf nodes in the lowest level of the hierarchy correspond to
sources and destinations associated with communication transactions
to be represented; associating elements of the hierarchy with
co-ordinates on a display screen; and representing each of the
plurality of communication transactions by: determining for each
transaction a first set of control co-ordinates comprising the
co-ordinates associated with elements in a path in the tree
structure connecting the source and destination associated with a
communication transaction via the closest common parent in the
hierarchy common to the source and destination; determining for
each transaction a second set of control co-ordinates for drawing a
straight line between co-ordinates associated with the source and
destination associated with the communication transaction;
calculating as a set of control co-ordinates for representing a
transaction weighted averages of corresponding co-ordinates in the
first and second set, weighted by a bundling factor; and
representing each of the communication transactions as a line drawn
utilizing the calculated control co-ordinates for each
transaction.
[0009] Determining a first set of control co-ordinates may comprise
determining a list of nodes on the tree structure for connecting
the source and destination associated with a communication
transaction via the closest common parent in the hierarchy common
to the source and destination and removing the node corresponding
to the closest common parent if the source and destination for the
transaction are not both child nodes of a single parent node.
[0010] Determining a first set of control co-ordinates may also
comprise appending as control co-ordinates in the set of control
co-ordinates for representing a transaction multiple sets of
control co-ordinates associated with the source and destination of
the transaction to be represented.
[0011] Communication transactions may be represented as lines drawn
utilizing the calculated control co-ordinates for each transaction
with each communication transaction being represented by an
appended series of b-splines as defined by groups of control
co-ordinates in the calculated set of co-ordinates.
[0012] The lines corresponding to the b-splines may be determined
by: determining co-ordinates for a number of points lying on the
curve defined by the appended series of b-splines; and calculating
co-ordinates for a set of quadrilaterals for representing the
transaction on the basis of the co-ordinates of the number of
points. The calculation of the co-ordinates for a set of polygons
may be such to cause the points lying on the curve defined by the
appended series of b-splines to lie on the midpoints of opposing
ends of the quadrilaterals and the other sides of the
quadrilaterals are parallel to a line connecting the midpoints of
the opposing ends. Such quadrilaterals may then be colored.
[0013] The coloring of such quadrilaterals may be determined based
upon a criterion associated with the transaction represented by the
quadrilateral such as the timing, frequency or an amount associated
with a transaction. Alternatively the coloring of quadrilaterals
may vary along the length of the line drawn to represent a
transaction.
[0014] Drawing lines representing each of the communication
transactions may comprise rendering each of the lines in a graphics
buffer and then combining the rendered images. Combining the
rendered images may comprise: determining maximum color values for
areas where lines overlap; determining color values for rendering
lines in a constant color and calculating an alpha blend of the
rendered lines; and utilizing the calculated maximum color values
and the values of the determined alpha blend of constant color
lines to determine the colors to be included in a final
display.
[0015] The communication transactions represented may include:
various kinds of communication transactions such as telephone
calls, emails, text messages, instant messages, social media
messages or posts; and various kinds of other transaction data like
securities trading, insurance, electronic security access data and
financial transactions such as credit card transactions; debit card
transactions, banking transactions etc.
[0016] In accordance with another aspect of the present invention
there is provided a data analysis system for displaying data
facilitating visual analysis of communication transactions: the
system comprising: a transactions database operable to store
transaction records defining communication transactions; a display
screen operable to display representations of communication
transactions as lines connecting positions associated with a source
and a destination for a communication transaction; and a processing
module operable to determine a hierarchy having a tree structure
wherein leaf nodes in the lowest level of the hierarchy correspond
to sources and destinations associated with communication
transactions represented by transaction records stored in the
transactions database; associate elements of the hierarchy with
co-ordinates on a display screen; and cause the display screen to
display the representations of the communication transactions by:
determining for each transaction a first set of control
co-ordinates comprising the co-ordinates associated with elements
in a path in the tree structure connecting the source and
destination associated with a communication transaction via the
closest common parent in the hierarchy common to the source and
destination; determining for each transaction a second set of
control co-ordinates for drawing a straight line between
co-ordinates associated with the source and destination associated
with the communication transaction; calculating as a set of control
co-ordinates for representing a transaction weighted averages of
corresponding co-ordinates in the first and second set, weighted by
a bundling factor; and representing each of the communication
transactions as a line drawn utilizing the calculated control
co-ordinates for each transaction.
BRIEF DESCRIPTION OF THE DRAWINGS
[0017] Embodiments of the present invention will now be described
in detail with reference to the accompanying drawings in which:
[0018] FIG. 1 is a schematic block diagram of a data analysis
system in accordance with an embodiment of the present
invention;
[0019] FIG. 2 is a schematic illustration of a user interface
representing transactions to a user;
[0020] FIG. 3 is a flow diagram of the data processing of the data
analysis system of FIG. 1;
[0021] FIG. 4 is a flow diagram of the processing of the data
analysis system of FIG. 1 for generating display data;
[0022] FIG. 5 is a tree diagram illustrating an exemplary
hierarchy;
[0023] FIG. 6 is a schematic diagram illustrating the assignment of
co-ordinates to the nodes of the tree diagram of FIG. 5;
[0024] FIG. 7 is a flow diagram of the processing of the data
analysis system of FIG. 1 to draw a connection between two
positions associated with leaf nodes in an exemplary hierarchy;
[0025] FIG. 8A and FIG. 8B are schematic illustrations of the
manner in which the illustration of connections between a plurality
of points can be varied in dependence upon a bundling factor;
[0026] FIG. 9 is a schematic illustration of a connection between
two positions associated with leaf nodes in an exemplary
hierarchy;
[0027] FIG. 10 is a flow diagram of the processing undertaken to
determine a set of shapes to represent a curve;
[0028] FIG. 11 is an illustrative section of a curve to be
rendered; and
[0029] FIGS. 12-17 are illustrative screen displays of the above
described system in use for analyzing transaction data relating to
bookkeeping entries and bank transactions.
DESCRIPTION OF THE EMBODIMENTS
[0030] FIG. 1 is a schematic block diagram of a data analysis
system 1 in accordance with an embodiment of the present invention.
The data analysis system 1 comprises a transactions database 3
arranged to store transaction records 5; a processing module 11;
and optionally an accounts database 7 arranged to store accounts
records 9. The processing module 11 is arranged to retrieve data
from the transactions and accounts databases 3, 5 and generate a
graphic representation representing the transactions. Data for
rendering representations of the transactions as lines on a display
13 generated and stored in a graphics buffer 14 connected to the
processing module 11 and the display 13. In addition the processing
module 11 is also responsive to user input via a keyboard 15 and a
mouse 17 to enable a user to interact with the display and select
groups of transactions for processing.
[0031] In this embodiment where the data analysis system 1 is
arranged to facilitate the analysis of communication transaction
data, the transactions database 3 will be configured to store
transactions data relating to communication transactions. For
fields other than communication transactions, the databases will or
can be configured otherwise and hold different kinds of
transactional data.
[0032] In a system for analyzing communication transactions each
transaction record 5 stored in the transactions database 3 will
comprise a number of data fields, which in the case of
communication transactions will typically include any of the
following: [0033] Source (e.g. telephone number, email address,
user identity etc.) [0034] Destination (e.g. telephone number,
email address, user identity etc.) [0035] Date and Time [0036]
Transaction type (e.g. call, text message, email etc) [0037] Size
(e.g. duration, number of characters, data volume etc) [0038] Cost
[0039] Source location information (e.g. physical address, IP
address, longitude and latitude, serving mobile base station
location etc.) [0040] Destination location information (e.g.
physical address, IP address, serving mobile base station location
etc.)
[0041] If required, the accounts database 7 can store details
relating to the account or subscription information of individual
users of a communication system. For example, the accounts database
7 could store data relating to individual accounts such as: [0042]
User identity (e.g. name, telephone number, email address, username
etc) [0043] User location information (e.g. physical address etc)
[0044] Account number [0045] Subscription details (e.g. tariff
etc)
[0046] In this case, the accounts database 7 can be used in
conjunction with the transactions database 3 to determine
additional information regarding a communication transaction. By
way of example, if the transactions database 3 contained
transaction records 5 relating to fixed line telephone calls, but
did not specify the source and destination locations, then the
accounts database 7 could be used to perform a lookup between the
telephone number of the source and/or destination and the location
information/physical address of the source/destination. The records
5 in the transactions database 3, and optionally the accounts
database 7, enables communications to be monitored. If unusual
patterns of communication are detected, further investigation of
potential issues or significant events can be initiated. Detection
is, however, difficult due to the very large volumes of variable
and highly dynamic data that are involved. It is for this reason
that it is very important how the data is processed and the results
of that processing are displayed as having the processing module 11
generate display data which makes potentially anomalous
transactions more apparent to a user and thereby greatly
facilitates the detection of issues or significant events.
[0047] As will be described in detail, in accordance with the
present application data representing transactions is processed in
a manner which enables large volumes of transaction data to be
displayed simultaneously and facilitates user selection of subsets
of the transaction data and rapid update of the display. This then
enables an investigator to focus on transactions which share
certain common attributes for further investigation.
[0048] The analytical process, apparatus and method described in
this embodiment are designed to display and help the user detect
the anomalous patterns resulting from anomalous behaviour. The
patterns are the result of a sequence of transactions or
transaction flow, and in the examples described herein the
transactions take the form of communications transactions. The
detection of anomalies that differentiate from the "normal" pattern
of transactions can be expedited by leveraging visual analytics, in
which the patterns in the communication transactions are
represented visually. The human eye and brain can more quickly
adapt to changes in visual representations of data then to
representations where data is presented as indexes in rows, columns
or tables.
[0049] The apparatus and method are designed for the purpose of
visually representing the relationships and sequences that exist
within the transactions, such that the detection of irregular
activity occurs faster and more accurately as visually it stands
out from the crowd of regular transactions. The greater the amount
of data which can be visualized the more effective the analyst or
observer/user can detect patterns, and the more accurate and timely
the analysis can be performed, which is essential for communication
transactions, as very large quantities of transactions are
occurring at any given time. The larger the amount of data that a
tool can visualize the larger the amount of time can be
conceptualized thus the more stable and accurate the pattern
analysis can be.
[0050] This can lead to an operator of a telecommunications network
being able to quickly identify points of disruption or congestion
within the network, determine the time frame of the disruption or
congestion, identify the possible cause of the disruption or
congestion, and take proactive steps to remedy the issue or
counteract the problem.
[0051] To facilitate the identification of anomalous transactions,
as will be described, in this embodiment, transactions are
illustrated by lines connecting an origin (e.g. a base station of a
mobile telecommunications network that is serving a source) and a
destination (e.g. the base station serving the destination). The
processing module 11 then generates a visual display which causes
representations of transactions sharing similar characteristics to
be bundled together.
[0052] FIG. 2 is a schematic illustration of a user interface
representing transactions to a user. In FIG. 2 curved lines connect
points at the perimeter of a circle. Each of the lines is shaded
from lighter to darker to indicate a direction of connection.
Around the perimeter points are arranged into a hierarchy such as
for example a hierarchy of locations e.g. country, region,
sub-region, which can correspond to locations of base stations,
telephone exchanges, email servers etc. These are illustrated by
the curved sections at the perimeter of the illustration with the
elements at the top of the hierarchy shown at the outside of the
circle labelled layers 0-4, the new level of the hierarchy shown as
units 1-50 and the lowest level of the hierarchy shown adjacent the
lines in connecting points at the perimeter of the circle.
[0053] As indicated, transactions sharing common portions of a
hierarchy are bundled together to indicate a volume of flow between
two locations. As will be described by selecting data either by
selecting groups of locations or a subset of transactions etc a
user can home in on a group of suspect transactions for more
investigation.
[0054] Additionally the display can be modified to highlight
certain information. Thus for example in certain circumstances it
may be desirable to distinguish between the source and destination
of transactions. This could enable a subset of transactions to be
displayed. The screen display could then be modified to color code
the representations of the transactions to highlight some other
aspect of the transactions such as the timing of the transactions
or the frequency or size of the transactions to make potentially
anomalous patterns more apparent.
[0055] The processing of the processing module 11 to generate a
display such as is shown in FIG. 2 will now be described in detail
with reference to FIGS. 3-10.
[0056] Referring to FIG. 3 which is a flow diagram of the
processing undertaken by the processing module 11, as an initial
step (s3-1), the processing module 11, in response to user input
via the keyboard 15 and mouse 17 initially accesses the
transactions database 3 to identify transaction records 5 which are
to be utilized to generate a display 13. In the case of this
initial step the records 5 which are to be displayed can be
selected on any basis as determined by the user and indicated to
the processing module 11 by user input. Thus for example a user
could select a group of records corresponding to a particular time
period, location, or transaction type, all of which is recorded
either directly or indirectly within the transaction records 5
themselves. Alternatively some indirect measure could be utilized
to select the transactions for display such as by processing
transaction records 5 to identify sources and/or destinations which
for example are associated with an unusually low frequency of
transactions or low transaction volumes.
[0057] Once the initial dataset has been determined, the processing
module 11 then determines (s3-2) in response to user input the
hierarchy against which the selected transaction data is to be
displayed.
[0058] The hierarchy to be utilized could be determined in response
to user input selecting a pre-stored hierarchy from a list. One
example of such a hierarchy would be a hierarchy based on location
of source and/or destination. In such a case the various locations
could be grouped by geographic location into countries, regions and
sub-regions etc.
[0059] Alternatively an artificial hierarchy could be constructed
from the available data fields in the transaction records 5 and,
when present, the account records 9. Thus for example a user might
decide to categorize transaction size (e.g. duration, data volume
etc) into a number of ranges and assign this as the top level of
the hierarchy, followed for example by groups of mobile phone
number prefixes for a second level in the hierarchy, with high
level location data being assigned to a third level in the
hierarchy.
[0060] Any user selected hierarchy could be utilized provided the
selected hierarchy enables individual transactions to be assigned
both a source location and a destination location within the
hierarchy. In the case of a simple geographical hierarchy it will
be appreciated that both the source and the destination can utilize
the same hierarchy (e.g. country, region sub-region, etc.). In
other cases the hierarchies could be utilized where source
locations and destination locations are determined using different
data sets. All that is required is that the selected hierarchy data
is sufficient to enable transaction data to be identified with
distinct pairs of items of data.
[0061] Having entered or selected the hierarchy to be utilized to
order the transaction data to be displayed, the processing module
11 then (s3-3) proceeds to generate a display image for the
currently selected data set and organizational hierarchy.
[0062] By way of example, if a number of base station transceivers
(e.g. masts/antennas) in a particular region of a mobile
telecommunications network are affected by a local electrical
failure, then this will lead to at least a partial decrease in the
number of mobile calls and text messages that are both sent to and
sent from those base stations. The visual representations displayed
to a user in accordance with the methods and apparatus described
herein would enable the user to quickly recognise this pattern of
unusually low communication transaction volumes for the affected
base station transceivers, and to determine that these base station
transceivers are located in the same region. It would therefore be
apparent that there is a localised problem that is causing this low
volume of communication transactions. Moreover, if the information
identifying the base station transceivers is supplemented with
information identifying the hub via which they are connected to the
electricity supply (e.g. the electrical substation), this factor
could be introduced into the hierarchy. Doing so would provide a
visual indication that all of the affected transceivers share a
common connection to the electricity supply, thereby providing an
indication this may be the likely point of failure. For example, if
this type of detailed information is not included in the
transactions database 3 itself, then the system could be configured
with a separate database of supplemental information that could be
interrogated as and when the analysis requires supplemental
information (e.g. when selected by the user).
[0063] The processing undertaken by the processing module 11 to
generate display data will now be explained with reference to FIGS.
4-10.
[0064] Turning first to FIG. 4 which is a flow diagram of the
processing undertaken by the processing module 11, initially (s4-1)
the processing module 11 assigns each of the elements in the
hierarchy being used to a screen location.
[0065] FIG. 5 is a tree diagram illustrating an exemplary
hierarchy. In such a tree diagram a route node A.sub.0 is provided
at the top of the hierarchy. A first set of categories, shown in
the figure as A.sub.1, B.sub.1, C.sub.1, forms the first level of
the hierarchy. The next level of the hierarchy is shown as A.sub.2,
B.sub.2, C.sub.2, D.sub.2, E.sub.2, F.sub.2, G.sub.2. Finally a
third layer of the hierarchy is shown as A.sub.3, B.sub.3, C.sub.3,
D.sub.3, F.sub.3, G.sub.3, H.sub.3, I.sub.3, J.sub.3, K.sub.3. Thus
for example if the hierarchy were to represent geographical
location A.sub.1, B.sub.1, C.sub.1 might correspond to countries,
A.sub.2, B.sub.2, C.sub.2, D.sub.2, E.sub.2, F.sub.2, G.sub.2 might
correspond to regions and B.sub.3, C.sub.3, D.sub.3, F.sub.3,
G.sub.3, H.sub.3, I.sub.3, J.sub.3, K.sub.3 might correspond to
sub-regions.
[0066] In the present embodiment, once a hierarchy has been
identified to the processing module, the various items on the
hierarchy are assigned a screen location. FIG. 6 is a schematic
diagram illustrating the assignment of co-ordinates to the nodes of
the tree diagram of FIG. 5. In FIG. 6 the various nodes of the tree
of FIG. 5 have been allocated positions corresponding to a series
of concentric circles with the route node A.sub.0 placed in the
centre and the remaining nodes placed in successive concentric
circles about the route node with the nodes at lower levels of the
hierarchy shown in sections next to their parent nodes in the
higher sections of the hierarchy.
[0067] Having assigned a set of co-ordinates for the elements of
the hierarchy, the processing module then proceeds to calculate and
draw a series of lines representing each of the transactions which
is to be plotted. More specifically, first of all an initial
transaction to be plotted is selected (s4-2). The processing module
then (s4-3) determines a set of control-co-ordinates to represent
the transaction. As will be explained these control co-ordinates
are selected on the basis of the co-ordinates associated with nodes
on the hierarchy and a bundling factor which cause the resultant
line curve to a lesser or greater extent so that lines associated
with corresponding portions of the hierarchy are shown as being
bundled together.
[0068] FIGS. 7 and 8 are a flow diagram of the processing of the
processing module to determine a set of control points and a
schematic illustration of a connection between two positions
associated with leaf nodes in an exemplary hierarchy.
[0069] Referring initially to FIG. 7, having selected a transaction
to be illustrated on the display 13, the values for the source and
destination associated with a line to be drawn are identified and
their relative locations on the selected hierarchy are
determined.
[0070] Thus for example say a transaction is to be illustrated
where the lines are to be drawn connecting positions corresponding
to the location of a base station serving the source of the
communication transaction and the location of a base station
serving the destination of the communication transaction. In such a
case, nodes on the hierarchy corresponding to the source base
station location and the destination base station location would be
identified. The processing module 11 then determines (s7-1) the
least common ancestor (LCA) for the two identified locations within
the hierarchy being used which connect the nodes corresponding to
the source base station location and the destination base
station.
[0071] Taking the hierarchy of FIG. 5 as an example, in the case of
nodes A.sub.3 and D.sub.3, data corresponding to the hierarchy
would be processed to determine that stepping back through the tree
the least common ancestor for A.sub.3 and D.sub.3 would be A.sub.1.
It will be appreciated that identification of the least common
ancestor could be determined using any conventional process for
determining the common parent for nodes in a tree structure.
[0072] Thus for example if the hierarchy of FIG. 5 were to
correspond to geographical locations where location A.sub.1,
B.sub.1, C.sub.1 correspond to countries, A.sub.2, B.sub.2,
C.sub.2, D.sub.2, E.sub.2, F.sub.2, G.sub.2 correspond to regions
and A.sub.3, B.sub.3, C.sub.3, D.sub.3, F.sub.3, G.sub.3, H.sub.3,
I.sub.3, J.sub.3, K.sub.3 correspond to individual towns in the
example above it would be determined that the transaction linking a
source with an address associated with the town identified by
A.sub.3 communicated with a destination in another town D.sub.3 in
a different region but in the same country as A.sub.3.
[0073] Having identified the least common ancestor for the source
and destination points to be illustrated, the processing module 11
then proceeds (s7-2) to generate a list for the path connecting the
source node to the destination node which passes via the least
common ancestor. This can also be determined using conventional
techniques.
[0074] Thus in the case of nodes A.sub.3 and D.sub.3 for the
example hierarchy of FIG. 5 the following path data would be
determined A.sub.3, A.sub.2, A.sub.1, C.sub.2, D.sub.3.
[0075] The processing module 11 then (s7-3) proceeds to determine
whether the generated list contains more than three elements. If
this is not the case, this will mean that the nodes associated with
the transaction to be illustrated share the same parent node. In
this case the list of nodes is left unamended. If, however the path
data contains more than three elements, in this embodiment the
reference to the closest least common ancestor is removed (s7-4)
from the list.
[0076] Thus in the case of the path data A.sub.3, A.sub.2, A.sub.1,
C.sub.2, D.sub.3 and the hierarchy of FIG. 5, the path data would
be modified to become A.sub.3, A.sub.2, C.sub.2, D.sub.3. In
contrast where path data for say data associated with nodes A.sub.3
and B.sub.3 were to be determined, here the least common ancestor
would be identified as being node A.sub.2 and path data for
connecting nodes A.sub.3 and B.sub.3 would be generated as A.sub.3,
A.sub.2, B.sub.3. In such a case as the path data includes only
three elements no modification of the path data would be made and
the generated path data would remain as A.sub.3, A.sub.2,
B.sub.3.
[0077] After having removed the reference to the least common
ancestor from path data containing more than three elements, the
path data is then (s7-5) modified by appending three copies of the
first and last elements in the list to the beginning and end of the
list respectively.
[0078] Thus for example in the case of path data comprising the
following list A.sub.3, A.sub.2, C.sub.2, D.sub.3, the list would
be modified to become A.sub.3, A.sub.3, A.sub.3, A.sub.3, A.sub.2,
C.sub.2, D.sub.3, D.sub.3, D.sub.3, D.sub.3.
[0079] At this stage, the co-ordinates associated with the elements
in the list of path data will define a first set of control points
for drawing a line comprising appended b-slines to connect the
positions at the beginning and end of the list. Such a curve will
bend towards the various control points associated with nodes at
different levels of the hierarchy and hence bend towards the
co-ordinates of the various positions associated with elements of
the hierarchy being utilized such as is illustrated in FIG. 6.
[0080] Merely drawing a line based on the co-ordinate positions
associated with the elements in the data path would only enable a
connection between two points to be drawn in a single way and would
not enable a user to vary the extent to which lines deviate towards
the various control points. The ability to vary the extent to which
lines representing transactions deviate is advantageous as stronger
deviation enables connections associated with shared higher
elements in the hierarchy to be grouped together which facilitates
the selection of transactions for greater scrutiny.
[0081] This is illustrated by FIG. 8A and FIG. 8B which are
schematic illustrations of the manner in which the illustration of
connections between a plurality of points can be varied in
dependence upon a bundling factor. In FIG. 8A transactions
associated with shared elements in the upper portions of the
hierarchy are shown by lines which deviate less than in FIG. 8B. As
can be seen by inspecting FIGS. 8A and 8B, this means that the
extent to which transactions share such upper elements in the
hierarchy is less clear in FIG. 8A compared with FIG. 8B. This is
achieved by bundling the representations more closely together in
the central portions of the figures.
[0082] Bundling of lines is also used to free up screen space so
structure and patterns can become visible and more easily detected
and recognized by the user. The bundling operation is essential as
the display mentioned in this embodiment can hold very large
numbers of lines each representing a set of transactions. Display
real estate (pixels) does not allow such a quantity of lines to be
presented on the display screen in a single instance; rather the
lines are displayed in a (virtual) overlay mode. Long before the
physical limits of the computer display are reached a user will no
longer be able to easily identify individual line(s) of interest,
instead the human eye and brain only perceive clutter as shown in
FIG. 8A. The bundling as shown in FIG. 8B provides structure to the
image for better human perception and comprehension and helps the
user identify the flow of transactions. In case the user wishes to
see details of sub-sets or even individual transactions the user
can move his mouse to the perimeter of the line view and by
hovering over the lines is able to highlight these while the other
lines are faded into the background. To render individual lines
visible the system allows for dynamic interrogation of parts of the
display that renders the data set, as a zoom-in function.
[0083] In order to provide the ability to vary the extent to which
lines representing transactions are bundled together, having
determined path data identifying a first set of control points
corresponding to the co-ordinates associated with the list of path
data, the processing module 11 then (s7-6) proceeds to determine an
alternative set of control points for drawing a straight line
between the end points of the line defined by the first set of
control points.
[0084] FIG. 9 is a schematic illustration of a connection between
two positions labeled A and G connected by a curve shown by a thick
line in FIG. 9. The curve comprises a set of appended b-splines
defined by control points A, B, C, D, E, F, G.
[0085] An alternative connection between the two positions A and G
would be a straight line between those two points. Such a line can
also be represented by a set of appended b-splines where the
control points for such b-splines have co-ordinates which lie along
the line connecting A and G.
[0086] An alternative set of control points for a straight line
connection can be derived from the co-ordinates associated with
positions A and G and then selecting a number of points on the
line. In this embodiment the alternative control points B', C', D'
and E' are determined by calculating the positions on the line A-G
nearest to the positions of the control points B, C, D and E
respectively.
[0087] Control points for a line connecting A and G which curves to
a lesser or greater extent can then be determined (s7-7) by using a
weighted average of the co-ordinates associated with the original
and the alternative control points. That is to say control points
for drawing a connection between A and G can be selected to be at
positions along any of the dotted lines shown in FIG. 9 connecting
B and B', C and C', D and D' and E and E'. The control points for
such lines can be calculated using the following equation:
Control point co-ordinates=(1-B)*(original
co-ordinates+B(alternative co-ordinates) where B is the selected
bundling factor to be utilized.
[0088] If a bundling factor of 1 is selected the curved lines will
utilize the original co-ordinate positions as control points
whereas if a bundling factor of 0 is selected connections will be
represented by straight lines connecting the start and end
points.
[0089] Overlapping groups of four of the set of generated control
points can then be used to draw a line between the positions
associated with the source and destination elements. More
specifically each set of four control points can be utilized as
control points for a cubic b-spline with the entire line connecting
the source and destination elements being the piece wise cubic b
spline formed by the concatenation of these individual
b-splines
[0090] Returning to FIG. 4 having determined a set of control
points for representing a transaction as a b-spline connecting two
positions corresponding to the source and destination for the
transaction, the processing module 11 then proceeds to determine a
set of shapes (s4-4) for drawing the each b-spline using the
control points.
[0091] Mathematically a b-spline is fully defined based solely on
the co-ordinates associated with a set of control points. When
rendering a b-spline as an image, it is necessary to break the
mathematical curve which is to be drawn into a set of shapes which
can be rendered by the computer. This is necessary because in order
to be rendered the curve must be given a thickness so that the
rendering of the curve can be seen.
[0092] The processing to determine such a representation will now
be described with reference to FIGS. 10 and 11 which are a flow
diagram of the processing of the processing module 11 and an
illustrative section of a curve to be rendered
[0093] To achieve such a rendering, initially (s10-1) a set of
points on the line to be rendered is determined. The co-ordinates
for the points can be determined directly by processing the control
co-ordinates for the b-spline for the curve to be rendered. These
will comprise a set of points all of which should lie at the middle
of the curve which is to be rendered.
[0094] FIG. 11 is an illustrative section of a curve to be
rendered. In the illustration the points 50,51,52,53 lying on the
thick black line comprise points mathematically determined to
correspond to the portion of the line to be rendered.
[0095] Starting with the first point 50, the processing module then
(s10-2) determines co-ordinates for the edge of the line at that
point. This is achieved by determining normal (N) to a vector
connecting the first 50 and second 51 points on the line a length
of .+-.w/2 from the first point 50 and assigning these co-ordinates
to the corners 54,55 of the beginning of the line to be rendered.
In this way two co-ordinates 54,55 separated by a distance w
corresponding to the selected width of the line to be rendered are
identified where the first selected point 50 lies in the middle of
the two points 54,55.
[0096] Having determined the initial end points 54, 55, the
processing module 11 then proceeds to calculate (s10-3) a unit
vector (V.sub.1) which bisects the angle formed by lines connecting
the first 50 and second 51 and the second 51 and third points 52
which lie on the mathematical line being rendered.
[0097] Co-ordinates for the quadrilateral representing an initial
section of the curve are then (s10-4) determined by identifying
points 56, 57 a distance .+-.w/(2 sine.crclbar..sub.1) V.sub.1 from
the second point 51 lying on the mathematical curve being rendered
where .crclbar..sub.1 is the angle between the line connecting the
first and 50 second points 51 on the curve being rendered and the
vector V.sub.1.
[0098] Having calculated co-ordinates for the quadrilateral for
rendering the first section, the processing module 11 then checks
(s10-5) to see if the complete line has now been rendered.
[0099] If this is not the case the processing module 11 then
proceeds to calculate (s10-3) a vector bisecting lines connecting
the next two pairs of point on the mathematical curve being
rendered. Thus having processed the first 50, second 51 and third
52 points on the line the processing module 11 will then determine
a vector V.sub.2 bisecting the lines connecting the second 51 and
third 52 and the third 52 and fourth 53 points on the curve being
rendered.
[0100] Once this vector has been determined, the end points for the
next quadrilateral for representing the next section of the curve
is then (s10-4) determined utilizing the vector V.sub.2 and the
angle between the lines connecting the second 51 and third 52 and
the third 52 and fourth 53 points on the curve being rendered
.crclbar..sub.2 bisected by the vector V.sub.2. After which the
processing module 11 once again checks (s10-5) whether the end of
the curve being rendered has been reached.
[0101] Returning to FIG. 4, having determined a set of
quadrilaterals to represent the line connecting the positions
corresponding to the source and destination for a transaction, the
processing module then (s4-5) determines a coloring for the
line.
[0102] The coloring for the line can be determined in a number of
different ways, depending on what information a user wishes to
highlight. If so selected by a user, the processing module 11 may
be arranged to render lines which vary in color say from red to
green to enable a user to distinguish the source and destination
for a represented transaction. In such a case the determination for
the coloring of the line segments would be made where the color
assigned to a portion of a line was dependent upon the portions
position on the line.
[0103] Alternatively, the processing module 11 could be arranged to
color code the transactions based on some other factor. For example
different colors could be assigned to transactions depending upon
the timing of the transactions, the size of the transactions or the
frequency with which particular transactions were made. Such a
coloring would then enable a user to identify transactions sharing
certain criteria for further analysis.
[0104] Having determined the coloring to be used to color the line
representing a transaction, the processing module 11 then (s4-6)
renders the line to the graphics buffer 14 using standard open GL
techniques.
[0105] When rendering different lines corresponding to different
transactions the lines could be rendered in order with earlier
rendered lines being overwritten by later rendered lines. However
where lines are colored to indicate additional information about
transactions it is preferable that when the renderings of different
transactions are combined the processing module 11 determines
maximum color values for any particular position based on the
rendering. Such an approach has the benefit of highlighting lines
which differ from most transactions and hence make outliers more
apparent.
[0106] Having rendered the currently selected transaction as a line
on the display, the processing module 11 then determines (s4-7)
whether the final transaction has been reached. If this is not the
case the next transaction is selected (s4-8) and processed
(s4-3-s4-5) and rendered (s4-6) to the graphics buffer 14 before
the processing module checks (s4-7) once again whether the final
transaction has been reached.
[0107] When the final transaction has been processed the processing
module 11 then can cause the image stored in the graphics buffer 14
to be displayed (s4-9).
[0108] In some embodiments it may be preferable to modify the
content of the graphics buffer 14 before display. In particular
where lines representing transactions are rendered by determining
maximum color values for particular channels at points of overlap
between lines representing different transactions, the processing
module 11 may proceed to modify the color values to mimic some kind
of alpha blending for the representation.
[0109] As noted above where lines are rendered which overlap one
another one approach to deal with such areas is merely to utilize
the final overwrite and display that information on the screen.
Another approach would be to take an alpha blend of the multiple
representations. This would cause areas of overlap to appear darker
and hence would provide a user with information about the numbers
of transactions in an area of overlap. However utilizing an alpha
blend approach averages out color representations and hence where a
transaction differs in appearance from the majority of transactions
shown in a particular portion of the screen that difference may not
be apparent because the single outlier transaction will have a very
limited influence on the average appearance of the area of
overlap.
[0110] It is for this reason that it can be preferable to render
areas of overlap utilizing maximum color values. In this way if say
for example the majority of transactions in a portion of the screen
were to be rendered green and an outlier transaction were to be
rendered red the existence of the outlier transaction would still
be apparent on the screen.
[0111] A disadvantage with such an approach is that utilizing
maximum color values to represent areas of overlap rather than
utilizing alpha blending results in images where the number of
times an area is overwritten is not apparent. Thus by utilizing
just the maximum color values for a position it ceases to be
possible to identify the numbers of transactions rendered in a
particular area of the screen.
[0112] A compromise approach, can however, be achieved which
enables outlier transactions to be highlighted and for the numbers
of transactions rendered in a particular area to be made apparent.
This is to render areas of overlap selecting maximum color values
and then to combine the results with a re-rendering of the lines in
solid color (i.e. black or white) using alpha blending. The
re-rendering in solid color then provides data as to how the
maximum color values should be altered to account for the numbers
of lines overlapping at a particular position.
[0113] Alternatively, the coloring of lines could be determined in
other ways. Frequently it will be desirable that the full range of
colors or shades should be utilized to represent lines on an image.
In such embodiments the extent of over-writing of particular points
on the screen could be determined and the coloring scaled so that
the most and least over-written portions of the screen are mapped
to the lightest and darkest colors with intermediate portions of
the screen being mapped to intermediate colors. In such embodiments
the mapping of intermediate portions of the screen could be linear.
However in some embodiments some kind of non-linear mapping may be
preferable. Suitable non-linear color mappings could include for
example a logarithmic or exponential mapping. Using non-linear
mappings may be preferable as they would enable outlier values to
be more clearly represented.
[0114] When a representation of the selected transactions has been
rendered and displayed on the screen a user can then input
selections via the keyboard 15 and mouse 17 to vary the
display.
[0115] Typically the user input will instruct the processing module
11 to re-render the display based on an alternative selection of
transactions, attributes belonging either to transactions or
elements, hierarchy and/or rendering.
[0116] FIGS. 12-16 are illustrative screen displays of the above
described system in use for analyzing transaction data relating to
mobile telecommunications transactions.
[0117] As shown in FIG. 12, in this example the screen display is
shown as being in two parts. A first section 100 in which
transactions are shown as lines connecting sources and destinations
arranged in a circle and a second section 102 where transactions
are shown as straight lines arranged in order of time or sequence
associated with the transactions.
[0118] In this example the hierarchy used comprises geographical
locations associated with base station transceivers. In the figures
in the first section 100 of the screen the individual base station
locations are shown. In the second section 102 of the screen the
hierarchy used is shown above the lines representing transactions.
In this section of the screen the individual lines extend between
points corresponding to the sources and destinations of
transactions.
[0119] In both the first and the second sections 100,102 lines
corresponding to transactions are shaded to indicate (a) selected
attribute(s), for example direction from source to destination, or
age of the flow of the transaction. In embodiments this may be best
shown using color. FIG. 12 shows an illustration of 8777 lines
corresponding to transactions in both of the sections 100,102 of
the screen.
[0120] The illustration of transaction data in the manner shown in
FIG. 12 facilitates user investigation and manipulation of the
transaction data. In particular the first section 100 of the screen
using the selected hierarchy illustrates communications flowing
between source and destination base stations. Whereas the second
section 102 provides a user with information relating to the timing
of individual transactions. The ordering of the lines in the second
section 102 could be based either on an identifier or some other
data associated with each individual base station transceiver or on
the basis of time data associated with transactions. The display
may include a representation of a scale to identify the range of
transactions being displayed. Thus for example an indication of a
range of base station transceivers or a range of dates or times
might be displayed.
[0121] Using the keyboard 15 or the mouse 17, a user can then drill
down within the available information to investigate further.
[0122] Thus for example a user might input criteria for selecting
transactions limited to a certain time period, size or frequency to
be displayed and only transactions meeting such criteria would then
be extracted from the transactions database 3 for display on the
screen. The screen display 13 could be arranged to display user
selectable menus to facilitate such selection or entry of data
indicating the selection criteria to be used.
[0123] Alternatively a subset of the displayed transactions could
be made by identifying a section of the screen using a pointer
under the control of the mouse 17. In such a case it would be
necessary to identify which transactions resulted in the rendering
of display data to a particular section of screen. This could be
achieved by checking the display data rendered to the graphics
buffer 14 which was utilized to render a particular display.
[0124] A problem with such an approach arises where transactions
are selected by drawing a line on the screen to identify
transactions to be investigated. This is because it is possible
that the line will not intersect with pixels which are rendered.
This is particularly a problem where an oblique line is drawn as it
is possible that a rendering of an oblique line will pass through
another line at a different angle without there being any pixels in
common. Such a problem can be avoided by utilizing the
identification of a line with a pointer to define a box of a number
of pixels thicknesses and identify renderings which occur anywhere
in that box. However this can result in too many transactions being
identified as being of interest.
[0125] An alternative approach would, however, be to utilize the
drawing of a line to identify an angle and re-render a
representation of the current display in the graphics buffer 14
without updating the display where the rendering applied a rotation
to the display based on the angle of the line. This would then
ensure that the selected line corresponds to a row or column of
pixels in the re-rendered image. In such a case any renderings of
transactions which correspond to the selected portion of the row or
column could be reliably identified.
[0126] In the case of the transactions shown in FIG. 12, it is
apparent from the Figure that the transactions shown in the second
section 102 of the screen naturally form 4 blocks 104-110.
[0127] FIG. 13 is an illustration of how the screen would be
updated if the first 104 of the blocks 104-110 in FIG. 12 were to
be selected for display. This would restrict reduce the numbers of
transactions to be illustrated from 8777 to 1499. Reviewing the
content of the display shown in FIG. 13 would then reveal in this
example that the block consisted mainly of corresponding
communication transactions between a particular pair of base
stations with the greatest numbers of transactions shown by the
thickest bundles of lines 112.
[0128] FIG. 14 is an illustration of how the screen would be
updated if the second 104 of the blocks 104-110 in FIG. 12 were to
be selected for display. This would cause a different set of
transactions to be highlighted.
[0129] As is shown in FIG. 14, when restricting the rendering of
transactions just to transactions in this block, a further
subdivision 116 of the transactions becomes apparent in the second
102 section of the display.
[0130] In a similar way this subdivision can be selected and the
results displayed. The results of making such a selection are
illustrated in FIG. 15
[0131] Illustrating communication transaction data makes unusual
patterns of data more apparent to a user. A number of such unusual
patterns are illustrated in FIG. 16.
[0132] FIG. 16 which is an illustration of the results of
restricting the transactions of FIG. 12 to the third block of
transactions 108. However in contrast to FIG. 14 where all the
transactions have a common origin, in FIG. 16 one of the
transactions 118 is shown as being connected to a different origin
base station and a number of the transactions 120 are shown as
having both a different source and a different destination.
Additionally in FIG. 16, a group of transactions 122 is apparent in
the second section 102 of the screen which might require additional
investigation.
[0133] Any such transactions may potentially be due to a fault and
hence warrant further investigation and to facilitate such
investigations, selection of such individual or groups of
transactions could cause additional information about such
transactions to be displayed.
[0134] In addition to selecting groups of transactions for further
investigation and other means for selecting subsets of transactions
to be viewed could also be provided. A user might be able to select
portions of the hierarchy and eliminate them from the transactions
being considered. In such an example any transactions relating to
the excluded portions of the hierarchy would not be rendered.
Additionally, the processing module 11 could be arranged to
reassign co-ordinate positions to the remaining portions of the
hierarchy to enable the remaining transactions to be better
distinguished.
[0135] An additional way to facilitate investigation and selection
of transactions would be to enable the processing module 11 to be
responsive to user input to alter the bundling factor to be
utilized to render an image. As shown in FIGS. 8A and 8B varying
the bundling factor varies the extent to which transactions sharing
higher elements in the hierarchy are grouped together. This would
then facilitate on-screen selection of such groups of
transactions.
[0136] A further way in which the display could be altered would be
for the processing module 11 to be responsive to user input to
alter the co-ordinates associated with the selected hierarchy. Thus
for example instead of associating elements in a hierarchy with
positions arranged in a series of concentric circles such as is
illustrated in FIG. 6, hierarchy elements could be arranged in a
series of lines. Such an arrangement would be particularly suitable
when analyzing data where the source and destination data for
transactions was to be analyzed against different hierarchies.
[0137] Another alternative would be to alter the rules for coloring
images to for example color lines based on a time ordering rather
than in a manner to distinguish between sources and
destinations.
[0138] In the previous examples transaction data has been
illustrated as being rendered as a set of connections between
points arranged around the perimeter of a circle. It will be
appreciated that the arrangement of transactions is determined by
the assignment of co-ordinates to control points for drawing lines
and hence by the assignment of co-ordinates to elements in the
hierarchy being used.
[0139] Instead of assigning a set of co-ordinates to elements in a
hierarchy arranged in a series of concentric circles, an
alternative approach would be to arrange such co-ordinates to lie
in a series of straight lines. FIG. 17 is an illustration of a set
of transactions rendered using a set of co-ordinates assigned to
hierarchy members where such co-ordinates are arranged in a series
of straight lines.
[0140] In FIG. 17, a separate set of labels 200, 202 is shown
identifying a hierarchy for sources and for destinations.
Co-ordinates for the elements in the hierarchies are then assigned
positions where the co-ordinates lie on one of a set of parallel
the lines 204 with elements highest in the hierarchy lying on lines
closest to the centre of the set 204 and the leaf nodes are
associated with points lying on lines immediately adjacent the
labels.
[0141] It will be appreciated that illustration of transactions in
this way is particularly suitable for illustration of transactions
where the hierarchies to be utilized for source and destination
elements are different.
[0142] As a further alternative, if the source and destination of
the communication transactions are defined by physical location
information, such as the longitude and latitude of the base station
transceivers involved in a mobile telecommunication transaction, or
the address associated with a fixed line telephone call, then these
coordinates could be applied to a map display. Communication
transactions could then be rendered onto such a geospatial view as
arcs.
[0143] By way of example, arcs representing communication
transactions could be rendered as quadratic Bezier curves, with the
direction of the communication encoded clockwise. This could be
achieved by determining the vector from the source to the
destination, computing the orthogonal to this vector and giving the
orthogonal vector a length of half of that of the source to
destination vector. This orthogonal vector can then be positioned
halfway between the source and destination, and the end point of
this orthogonal vector used as the control point for a quadratic
Bezier curve. Given that the computation of the orthogonal vector
in this way takes into account that vector direction is from the
source to the destination, the clockwise direction of the
communication transaction is automatically inferred. Markers
representing the source and the destination can then be rendered
onto the geospatial view/map. For example, these markers could take
the form of white dots with a radial gradient from white opaque
(innermost) to full transparent blue (outermost). Finally, additive
blending techniques could be used to render the sources, the
destinations, and the arcs on the geospatial view/map in order to
create a `glow` effect, wherein the intensity provides an
indication of the density of sources, destinations, and
transactions.
[0144] In addition, when displayed on a geospatial view, color can
be used to depict whether the number of communication transactions,
or some other measure associated with an arc, is lower or higher
when compared to a previous point in time (e.g. the previous day).
For example, when the measure to be depicted by a color has
decreased for a particular arc, this could be represented by a red
color, whilst an increase in the measure could be represented by a
green color, and any precisely overlapping arcs where one is
increasing (green) and the other decreasing (red) could be rendered
as yellow. Moreover, the opacity of the arcs can also be used to
indicate some value associated with each arc relative to that of
the other arcs (e.g. the number of transactions, size or cost of
transactions etc). Both the coloring and opacity of the arcs can
therefore emphasize the communication transactions that are likely
to be of most significance. Representing communication transactions
in this way enables users to quickly recognise patterns of
communication transactions to and/or from specific locations, and
allows users to differentiate between increasing and decreasing
levels of communication traffic.
[0145] Such a geospatial view could also be supplemented with
additional view formats for further exploration of the
communication transactions displayed on the geospatial view.
[0146] For example, the geospatial view could be supplemented with
a line graph that is rendered to illustrate the change in an
aggregate measure associated with the transactions over time. To do
so, time could be plotted on the y-axis of the line graph with one
or more aggregate measures (e.g. number of communication
transactions, size of communication transaction, etc) plotted on
the x-axis. Such a line graph would provide a further means by
which a user could identify significant points in time.
[0147] As a further example, the geospatial view could also be
supplemented with a bar graph representing the contribution of each
communication channel (i.e. source-destination pair) to an
aggregate measure at a selected point in time, wherein the relative
size of each bar would indicate the relative contribution. Color
coding of each bar could then be used to depict whether the measure
for that communication channel is lower or higher when compared to
a previous point in time (e.g. the previous day).
[0148] As a yet further example, the geospatial view could also be
supplemented with a matrix view in which individual sources and/or
destinations of communications transactions are plotted on the
vertical or y-axis, with time being represented on the horizontal
or x-axis. For each source and/or destination, the variance in the
measure is then rendered onto the matrix view as a heat map, in
which the color of a particular area in the matrix represents the
value of the measure at the corresponding point in time for the
corresponding source/destination. Such a matrix view provides a
further means for a user to identify sources and/or destinations
that display similar behaviour over time. Furthermore, by apply
clustering methods to the rows shown in the matrix, the rows of the
matrix can be re-ordered such that sources and/or destinations that
display similar behaviour are grouped together.
[0149] The ability to analyse and understand patterns of
communication transactions can provide a means for identifying the
occurrence of significant events (e.g. weather, social, political
and economic events), as such events will typically have an impact
on communication traffic in the affected areas. For example, the
occurrence of a significant event such as a protest or a clash
between communities is likely to result in increased volumes of
communication transactions in the affected location, probably due
to individuals informing each other of the disruption and
contacting friends and family.
[0150] Moreover, the data analysis system could be configured such
that, upon selection of a particular communication transaction or a
particular location on a particular date (e.g. by double-clicking
on an area of the geospatial view), a default web search platform
is opened and an automatically constructed search string is entered
into the web search platform in order to search for information on
events that may correlate with an identified pattern of
communication transactions. The system can therefore provide a
means for interpreting patterns in the communication transactions,
so as to provide an insight into the potential cause of the
pattern.
[0151] Alternatively, or in addition, the data analysis system
could be provided with or connected to an events database that can
be configured to store information regarding significant events
(e.g. environmental, weather, seismic, social, political and
economic events etc). For example, this information would typically
include the date, time, and location of the event, together with
descriptive information explaining the event. The data analysis
system could then be configured such that, upon selection of a
particular communication transaction or a particular location on a
particular date (e.g. by double-clicking on an area of the
geospatial view), a database query is automatically generated in
order to search for events in the events database that could
correlate with/be associated with the rendered communication
transactions. For example, when a user selects the representation
of a communication transaction or a bundle of communication
transactions, the data analysis system could automatically query
the database for events that occurred at or around the same time
and/or location as the selected communication transactions. The
data analysis system could then display the results of the query to
the user, thereby assisting the user in identifying any events that
could be the cause of, or otherwise provide an explanation for, any
anomalous communication transactions.
[0152] Although in the above described a system has been described
which facilitates the analysis of communications transactions and
an example has been illustrated which facilitates the analysis of
mobile communications transactions within a network, it will be
appreciated that the system could be adapted for the imaging,
mapping and analysis of any type of transactional data where
transactions can be associated with a source and a destination and
the source and destination can be associated with nodes in a
hierarchy. Thus for example the described system could be adapted
to facilitate the review and interrogation of many types of
financial or banking data.
[0153] Communication data could be combined with data from other
sources to facilitate investigation of transactions. Thus for
example where transactions can be associated with individuals,
communication transaction data could be supplemented with data
identifying other interactions between those individuals such as
financial transactions.
[0154] In the above embodiments transactions are described as being
represented as lines where data for representing transactions is
rendered to a graphics buffer 14 connected to a display. It will be
appreciated that the representation of transactions in such a
manner facilitates rapid update of a display 13. More specifically
as described transactions are illustrated by a set of primitive
elements rendered to a graphics buffer 14. When a subset of
transactions is to be displayed instructions to update a display
can be limited to an instruction to cause only data for the
selected transactions to be utilized to update the display 13. Data
for the remaining transactions can, however, still remain within
the graphics buffer 14 for use in rendering subsequent displays.
Further by causing transactions to be represented in the form of a
set of quadrilaterals corresponding to a spliced cubic b-spline,
the processing necessary to represent a transaction can be
undertaken by a dedicated graphics processor enhancing the speed of
the system.
[0155] As described in the above embodiments, the coloring of lines
representing relationships could be determined based upon some kind
of mapping between the number of times a portion of a screen was
over-written with the results being scaled so that the full range
of colors which can be represented was apparent on the screen. It
will be appreciated that in addition or as an alternative to
modifying the color of a line as it appears in an image, the
thickness of a line could be scaled in a similar way. Thus for
example where many similar transactions occur a thicker line could
be utilized to represent those transactions.
[0156] As with the coloring of lines, the selection of a suitable
line thickness could be made by determining the most and least
common transactions which are to be represented and mapping those
transactions to the thickest and thinnest lines and then
representing transactions of intermediate frequency with lines of
intermediate thickness.
[0157] In such embodiments it may be preferable to map the
frequencies based on some kind of scaling such as a logarithmic or
power function so that lines corresponding to less frequent
transactions are represented using thicker lines than their actual
frequency would suggest.
[0158] In some embodiments it may be preferable to arrange all
transactions to be drawn with lines of the same thickness. In other
embodiments it may be preferable to exaggerate the relative
thickness of less frequent transactions and minimize the relative
thickness representing more frequent transactions.
[0159] One approach to achieving such a scaling would be to
utilizing a power law such that a value x is mapped to a value
x.sup.P where the value p was selected on the basis of
representation to be utilized for the greatest value. In such an
embodiment, no scaling would occur if p was chosen to be equal to
0, positive values would cause more frequent transactions to be
empathized whereas negative values to increase the representation
of less frequent values.
[0160] Similarly a scaling function may also be utilized to
determine the size of the representation of the sections
representing the origin or destination for a transaction. Thus for
example rather than choosing the location of control point to be
evenly distributed along an edge or a circumference the spacing of
the control points could be based on the number of transactions to
be represented. Again such a value could be based either directly
on that number or based on a mapping which scaled the number either
to emphasize or de-emphasize the more frequent transactions.
[0161] It will also be appreciated that the selection of colors,
line thicknesses and the arrangement of control points at the
circumference or edge of an image could be determined based on
variables other than transaction frequency. Suitable variables
could be determined directly from data associated with transactions
or alternatively based on variables derived by processing such
data.
[0162] Although in the examples described in detail hierarchies
having three levels have been illustrated and discussed, it will be
appreciated that in other embodiments hierarchies having greater
more levels could be used.
[0163] Although the embodiments of the invention described with
reference to the drawings comprise computer apparatus and processes
performed in computer apparatus, the invention also extends to
computer programs, particularly computer programs on or in a
carrier, adapted for putting the invention into practice. The
program may be in the form of source or object code or in any other
form suitable for use in the implementation of the processes
according to the invention. The carrier may be any entity or device
capable of carrying the program.
[0164] For example, the carrier may comprise a storage medium, such
as a ROM, for example a CD ROM or a semiconductor ROM, or a
magnetic recording medium, for example a floppy disc or hard disk.
Further, the carrier may be a transmissible carrier such as an
electrical or optical signal which may be conveyed via electrical
or optical cable or by radio or other means.
[0165] When a program is embodied in a signal which may be conveyed
directly by a cable or other device or means, the carrier may be
constituted by such cable or other device or means.
[0166] Alternatively, the carrier may be an integrated circuit in
which the program is embedded, the integrated circuit being adapted
for performing, or for use in the performance of, the relevant
processes.
* * * * *