{'fraction_non_alphanumeric': 0.017727639000805803, 'fraction_numerical': 0.0040290088638195, 'mean_word_length': 5.50261780104712, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Visualizing anomalous activity in the movement of critical infrastructure employees

The paper presents an approach to the movement analysis of the employees of critical infrastructure based on combination of data-mining and visualizations techniques. It consists of two stages — finding groups of employees with similar behavior and detection of the anomalies. The groups of similarities are defined using Kohonen self-organizing map (SOM); spatiotemporal patterns of the behavior are presented using stacking based visualization technique named Band View. To detect anomalies in employees' behavior, we propose a mechanism for rating deviations from a normal behavior according to its temporal and spatial attributes, i.e. we consider when, where, how long and how often it took place. The rating mechanism is fully controlled by the analyst and allows filtering out insignificant deviations and highlighting suspicious ones. The rated deviations are displayed using interactive heat map that allows analyst to spot zones and time intervals with suspicious activity easily. We present results of the application of the approach proposed to the VAST MiniChallenge-2 2016 data set describing employees' movement within organization building.