|
Consider
The objective of Consider is to detect and report various types of changes and trends in specific networks including:
Network behavior trends and analysis can be conducted on one of three levels:
For instance, an analyst may want to know what trend is developing regarding the connectivity between a group of phones defined by the user as being a network. For example, an indication of connectivity might be to what degree the communications between the members of the group are mutual. The lowest score would be if each member of the network received calls from only one other member and initiated calls to only one other member. This would indicate a highly structured compartmentalized group. At the other extreme would be a case where all members of the group initiated and received calls from all other members as in a family situation. An additional measurement could be added to take into account to what degree the members of the network communicate with people outside of the network. This would help discover additional members of the network. The system can measure the trend in this indicator of a period of time using time series data. A change in the trend can indicate a change in the relationship between the phones. 
In this example, the network had a stable level of connectivity for almost two weeks and then suddenly they stopped talking to each other. This is a change that analysts interested in this network would want to know about. It could indicate an impending operation or that an operation just took place. This change would not necessarily be revealed by monitoring each phone individually in that the phones may continue to have calls with phones that are not members of the defined network. Consider includes the possibility of reporting on the basis of threshold levels of various indicators or changes from previous trends. Another type of report can be issued if the system predicts that the trend of a particular set of indicators shows that a threshold will be exceeded within a given time in the future. Consider automatically analyzes networks on a periodic basis. The user may define multiple networks to be analyzed and the frequency of analysis (daily, weekly, etc.). Each network may be assigned to one or more analysts who automatically receive reports by email or other means describing changes in the networks. The issuance of the reports can be limited to particular situations so that the analysts will receive reports only when certain types or magnitudes of changes occur in the network. The reports are issued as an html document which contains hyperlinks directly to Contextor allowing the user to automatically view network trends graphs as described in the previous section. |