=Paper=
{{Paper
|id=None
|storemode=property
|title=Visualizing
criminal networks reconstructed from mobile phone records
|pdfUrl=https://ceur-ws.org/Vol-1210/datawiz2014_03.pdf
|volume=Vol-1210
|dblpUrl=https://dblp.org/rec/conf/ht/FerraraMCF14
}}
==Visualizing
criminal networks reconstructed from mobile phone records==
https://ceur-ws.org/Vol-1210/datawiz2014_03.pdf
Visualizing criminal networks
reconstructed from mobile phone records
Emilio Ferrara Pasquale De Meo Salvatore Catanese,
School of Informatics and Computing Department of Ancient and Giacomo Fiumara
Indiana University Bloomington, USA Modern Civilizations Department of Mathematics
ferrarae@indiana.edu University of Messina, Italy and Computer Science
pdemeo@unime.it University of Messina, Italy
{scatanese,gfiumara}@unime.it
ABSTRACT 1. INTRODUCTION
In the fight against the racketeering and terrorism, knowl- Criminal Network Analysis allows to identify structure and
edge about the structure and the organization of criminal flow of information among the members of a criminal net-
networks is of fundamental importance for both the investi- work and to acquire the knowledge necessary to plan proac-
gations and the development of efficient strategies to prevent tive and reactive interventions. Among the more frequently
and restrain crimes. Intelligence agencies exploit informa- used analytic techniques there is the mapping of interactions
tion obtained from the analysis of large amounts of heteroge- among the members of the organization and their activities
neous data deriving from various informative sources includ- by means of a graph [25]. A graph representation allows
ing the records of phone traffic, the social networks, surveil- to overview the network structure, to identify the cliques,
lance data, interview data, experiential police data, and po- the groups, and the key players. The possibility of mapping
lice intelligence files, to acquire knowledge about criminal the attributes of data and metrics of the network using vi-
networks and initiate accurate and destabilizing actions. In sual properties of the nodes and edges makes this technique
this context, visual representation techniques coordinate the a powerful investigative tool. Often, however, visualization
exploration of the structure of the network together with the techniques become discouraging as a consequence of density
metrics of social network analysis. Nevertheless, the utility and dimensions of the network. Some obstacles such as the
of visualization tools may become limited when the dimen- overlap of nodes and the dense intersections of edges severely
sion and the complexity of the system under analysis grow reduce the readability of the graph. In other words, there
beyond certain terms. In this paper we show how we employ is a limit to the number of elements which can be distinctly
some interactive visualization techniques to represent crim- viewed from the human eye. An influential theory about
inal and terrorist networks reconstructed from phone traffic the improvement of the quality of network visualization has
data, namely foci, fisheye and geo-mapping network layouts. been suggested by Shneiderman in [31], where the so-called
These methods allow the exploration of the network through “Network Nirvana” is described. According to this theory,
animated transitions among visualization models and local some demanding targets must be pursued: i) the visibility
enlargement techniques in order to improve the comprehen- of each node; ii) the possibility of counting the degree of
sion of interesting areas. By combining the features of the each node; iii) the possibility of following each edge from
various visualization models it is possible to gain substantial the source to the destination nodes and, iv) the possibility
enhancements with respect to classic visualization models, of identifying the clusters. Although it can be challenging,
often unreadable in those cases of great complexity of the or even impossible, to satisfy all these conditions at the same
network. time as the network grows in size and complexity, an effec-
tive network analysis strategy should try to optimize the
visualization methods in order to incorporate these guide-
Categories and Subject Descriptors lines. In this work, we present three visualization techniques
[Information systems]: World Wide Web—Social net-
that yield better network representations that, in turn, allow
works; [Networks]: Network types—Social media net-
for enhanced data interpretability; we discuss these layout
works
techniques, namely fisheye, foci and network geo-mapping,
specifically in the context of criminal network analysis, but
Keywords we do not exclude a broader applicability to other domains
Mobile phone networks, criminal networks, visualization of social network analysis (SNA).
1.1 Literature on criminal network analysis
In the last thirty years academic research related to the ap-
plication of social network analysis to intelligence and study
of criminal organizations has constantly grown. One of the
most important studies is due to Malcolm Sparrow [33], re-
lated to the application of the techniques of analysis of net-
works, and their vulnerabilities, for intelligence scopes.
Sparrow defined four features peculiar of criminal networks explicitly designed to identify groups within the network,
(CNs), namely: i) limited dimension — CNs are often com- while others have been developed to show social positions of
posed of at most few thousand nodes; ii) information incom- group members. The most common graphical layouts have
pleteness — criminal or terrorist networks are unavoidably historically been the node-link and the matrix representa-
incomplete due to fragmentary available information and er- tions [17].
roneous information; iii) undefined borders — it is difficult
to determine all the relations of a node; and, iv) dynamics — Visualization has become increasingly important to gain in-
new connections imply a constant evolution of the structure formation about the structure and the dynamics of social
of the network. networks: since the introduction of sociograms, it appeared
clear that a deep understanding of a social network was not
Thanks to Sparrow’s work, other authors tried to study achievable only through some statistical network character-
criminal networks using the tools of SNA. For example, ization [35].
Baker and Faulkner [3] studied illegal networks in the field
of electric plants and Klerks [21] focused on criminal organi- For all these reasons, a number of different challenges in
zations in The Netherlands. In 2001, Silke [32] and Brennan network visualization have been proposed [30]. The study
et al. [8] acknowledged a slow growth in the fight against of network visualization focuses on the solution of the prob-
terrorism, and examined the state of the art in the field of lems related to clarity and scalability of the methods of au-
criminal network analysis. tomatic representation. The development of a visualization
system exploits various technologies and faces some funda-
Arquilla and Ronfeldt [1] summarize prior research by intro- mental aspects such as: i) the choice of the layout; ii) the
ducing the concept of Netwar and its applicability to terror- exploration dynamics; and, iii) the interactivity modes in-
ism. They illustrate the difference between social networks troduced to reduce the visual complexity.
and CNs, demonstrating the great utility of network models
to understand the nature of criminal organizations. Recent studies tried to improve the exploration of networks
by adding views, user interface techniques and modes of in-
All these early studies somehow neglected the importance teraction more advanced than the conventional node-link
of network visualization, stressing aspects related more to and force-directed [18] layouts. For example, in SocialAc-
statistical network characterization, or interpretation of in- tion [27] users are able to classify and filter the nodes of
dividuals’ roles rooted in social theory. However, in 2006, the network according to the values of their statistical prop-
a popular work by Valdis Krebs [22] applied graph analysis erties. In MatrixExplorer [20] the node-link layout is inte-
in conjunction with network visualization theory to analyze grated with the matrix layout. Nonetheless, these visual-
the Al Qaeda cell responsible of the 2001-09-11 terrorist at- ization systems have not been explicitly developed with the
tacks in the USA. This work represents a starting point of aim of the exhaustive comprehension of all properties of the
a series of academic papers in which social network analysis network. Users need to synthesize the results coming from
methods become applied to a real-world cases, differently some views and assemble metrics with the overall structure
from previous work where mostly toy models and fictitious of the network.
networks were used. Krebs’ paper is one of the more cited
papers in the field of application of social network analy- Therefore, we believe that an efficient method to enhance
sis to Criminal Networks and it inspired further research in the comprehension and the study of social networks, and in
network visualization for the design and development of bet- particular of criminal networks, is to provide a more explicit
ter SNA tools applications to support intelligence agencies and effective node-link layout algorithm. This way, impor-
in the fight against terror, and law enforcement agencies in tant insights could be obtained from a unique layout rather
their quest fighting crime. than from the synthesis derived from some different layouts.
2. THE PROBLEM We recently presented a framework, called LogAnalysis [9,
15], that incorporates various features of social network anal-
In criminology and research on terrorism, SNA has been
ysis tools, but explicitly designed to handle criminal net-
proved a powerful tool to learn the structure of a criminal
works reconstructed from phone call interactions. This frame-
organization. It allows analysts to understand the structural
work allows to visualize and analyze the phone traffic of a
relevance of single actors and the relations among members,
criminal network by integrating the node-link layout repre-
when regarded as individuals or members of (one or more)
sentation together with the navigation techniques of zoom-
subgroup(s). SNA defines the key concepts to characterize
ing and focusing and contextualizing. The reduction of the
network structure and roles, such as centrality [16], node
visual complexity is obtained by using hierarchical cluster-
and edge betweenness [16, 6, 14], and structural similarity
ing algorithms. In this paper we discuss three new network
[24]. The understanding of network structure derived from
layout methods that have been recently introduced in Lo-
these concepts would not be possible otherwise [35]. The
gAnalysis, namely fisheye, foci and geo-mapping, and we
above-mentioned structural properties are heavily employed
explain how these methods help investigators and law en-
to visually represent social and criminal networks as a sup-
forcement agents in their quest to fight crime.
port decision-making processes.
It’s worth noting that various tools to support network anal-
SNA provides key techniques including the possibility to de-
ysis exist. However, only few of them have been developed
tect clusters, identify the most important actors and their
specifically for criminal network investigations. We mention,
roles and unveil interactions through various graphical rep-
among others, commercial tools like COPLINK [10, 37], An-
resentation methodologies [40]. Some of these methods are
alyst’s Notebook1 , Xanalysis Link Explorer2 and Palantir
Government3 . Other prototypes described in academic pa-
pers include Sandbox [36] and POLESTAR [28]. Some of
these tools show similar features to LogAnalysis, but, to the
best of our knowledge, none of them yields the same effective
and scalable network visualization with support to criminal
networks reconstructed from phone call records.
2.1 Aspects of structural analysis
A central node of a criminal network may play a key role
by acting as a leader, issuing orders, providing regulations
or by effectively assuring the flow of information through
the various components of the CN. The removal of these
central nodes may efficiently fragment the organization and
interrupt the prosecution of a criminal activity. Figure 1: Phone calls network of a suspected. In-
vestigators start from some known entities, analyze
Apart from studying the roles of various members, inves- the associations they have with others and expand-
tigative officers must pay particular attention to subgroups ing the associations until some significant link is un-
or gangs each of which may be in charge of specific tasks. covered. Here are highlighted personal interactions
Members of the organization must interact and cooperate (gray arrows), links between criminal and personal
in order to accomplish their illicit activities. Therefore, the connections of the suspect (yellow) and connections
detection of subgroups whose members are tightly interre- between members of the organization (in red).
lated may increase the comprehension of the organization
of the CN. Moreover, groups may interact according to cer-
tain schemes. For example, the members of a clan could Figure 1 shows a stylized representation of a criminal net-
frequently interact with the members of another and seldom work reconstructed from phone call records. We show the
with the remaining members of the network. The detection flow of phone communications of an individual subject of
of interaction models and the relations among the subgroups investigation, and we highlight various kind of phone inter-
highlights information particularly useful about the overall actions among individuals belonging to that person’s social
structure of the network. circles, and those belonging to the same criminal organiza-
tion the individual is part of.
A significant aspect of the analysis of criminal networks is
that it requires, differently from other networks, the ability In the following we discuss three techniques that allow to effi-
of integrating information deriving from other sources in or- ciently and scalably inspect criminal networks reconstructed
der to precisely understand its structure, operation and flow from phone interactions.
of information. A typical process employed by an investi-
gator is to start from one, or a few, known entities; after
analyzing the associations these entities have with others, if 3. VISUALIZATION TECHNIQUES
any interesting association emerges, one may follow such a Typical network visualization tools rely on the popular force-
lead and keep expanding the associations until any signifi- directed layout [18]. The force-directed model represents the
cant link is uncovered between seemingly unrelated entities. structure of the graph on the same foot as a physical system,
in which nodes are physical points subject to various forces;
Mobile phone networks and online platforms are constantly nodes’ coordinates (and therefore the layout itself) derive
used to perform or coordinate criminal activities [38, 26]. from the search of an equilibrium configuration of the phys-
Phone networks can be used to connect individuals involved ical system modeled by the algorithm [7]. This particular
in criminal activities in real time, often during real-world layout arrangement has the advantage of grouping users in
criminal events, from simple robberies to terror attacks. On- clusters which can be identified according to the heightened
line platforms, instead, can be exploited to carry out illicit connectivity. The Barnes-Hut algorithm [4] associated to
activities such as frauds, identity thefts or to access classified this layout simulates a repulsive N-body system in order to
information. continuously update the position of the elements.
The analysis of a criminal network is thus aimed at uncover To optimize the visualization, it is possible to interactively
the structural schemes of the organization, its operations modify the parameters relative to the tension of the springs
and, even more importantly, the flow of communications (edges). Nodes with low degree are associated a small ten-
among its members. In modern investigative techniques the sion and the elements are located in peripheral positions
analysis of phone records represents a first approach that with respect to high degree nodes. Other parameters can be
precedes a more refined scrutiny covering financial transac- tuned, such as spring tension, gravitational force and viscos-
tions and interpersonal relations. For these reasons a struc- ity. Our goal, in the following, is to suggest two methods to
tured approach is needed. improve force-directed based layouts. As we will show, these
techniques are especially well suited for criminal network
1
ibm.com/software/products/analysts-notebook/ analysis; however, they could potentially be generalized for
2
http://www.xanalys.com/products/link-explorer/ broader usage in other domains of network analysis — for
3
http://www.palantir.com/solutions/ example, for applications in social and political sciences.
Figure 2: The left picture shows a force-directed layout of a criminal network. On the right we depict the
fisheye view of the same graph using transformation with distortion.
3.1 Focus and context based visualization 3.2 Fisheye layout
The number of edges within a network usually grows faster Focus and context is an interactive visualization technique
than the number of nodes. As a consequence, the network [23]. It allows the user to focus on one or more areas of a
layout would necessarily contain groups of nodes in which social network, to dynamically tune the layout as a func-
some local details would easily become unreadable because tion of the focus, and to improve the visualization of the
of density and overlap of the edges. As the size and complex- neighboring context. The fisheye view is a particular focus
ity of the network grow, eventually nodes and edges become and context visualization technique which has been applied
indistinguishable. This problem is known as visual over- to visualize self-organizing maps in the Web surfing [39]. It
load [2]. A commonly used technique to work around visual was first proposed by Furnas [19] and successively enriched
overload consists of employing a zoom-in function able to by Brown et al. [29]. It is known as a visualization technique
enlarge the part of the graph of interest. The drawback of that introduces distortion in the displayed information.
this operation is the detriment of the visualization of the
global structure which, during the zooming, would not be The fisheye layout is a local linear enlargement technique
displayed. However, such a compromise is reasonable in a that, without modifying the size of the visualization canvas,
number of situations including, in some cases, the domain allows to enhance the region surrounding the focus, while
of criminal network analysis. compressing the remote neighboring regions. The overall
structure of the network is nevertheless maintained. An ex-
During an investigation, it is crucial to narrow down the ample of application of this technique is show in Figure 2.
analysis to the relevant suspects, to efficiently employ human The picture shows a moderately small criminal network re-
and computational resources. Police officers typically draw constructed from phone call interactions of about 75 indi-
some hypotheses about an individual suspect of being part viduals. The layout on the left panel is obtained by using a
of a criminal organization, or of being involved (or about force-directed method implemented in our framework, Log-
to) in some crime; they concentrate the initial investigation Analysis. The analyst can inspect the nodes of the network,
on this individual, and on that person’s social circles, as a which contains known criminals, suspects, and their social
ground to build the social network object of analysis. The circles. When the focus is applied on a given node, the vi-
main role of visual analysis lies in allowing the detection sualization transitions to the fisheye layout (see the right
of unknown relations, on the base of the available limited panel). A tool-tip with additional information about the
information. A typical procedure starts from known entities, node appears when the node is selected — it shows the phone
to analyze the relations with other subjects and continue to number, personal details, address, photo, etc. The layout
expand the network inspecting first the edges appearing the causes edges among remote nodes to experience stronger
most between individuals apparently unrelated. During this distortions than local nodes. The upside of the presented
procedure, only some nodes are relevant and it is important method is the possibility to achieve the three recommen-
to focus on them rather than on the network as a whole. dations of Network Nirvana [30] when focusing on a given
node: all the nodes’ neighbors are clearly visible, the node
Nevertheless, a spring embedded layout (including force- degree is easily countable, and the edges incident on that
directed ones) does not provide any support to this kind node can be identified and followed.
of focus and analysis. In these situations, focus and context
visualization techniques are needed in order to help a user Note that fisheye and force-directed layouts can be used in
to explore a specific part of a complex network. To this a complementary way. By combining the two methods, our
purpose, we here introduce the fisheye and the foci layouts. framework efficiently yields focus and context views.
Figure 3: Foci layout.
3.3 Foci layout
The foci layout implements three network visualization mod- Figure 4: Geo-mapping layout.
els: force-directed, semantic and clustered layouts. The lat-
ter is based on the Louvain community detection algorithm
[5, 11]. Future implementations will explore other methods responding GPS entries to ascertain their distribution. This
[12, 13]. Our model supports multilayer analysis of the net- localization technique produces satisfactory results with a
work through interactive transitions from the force-directed reduction of the error amounting to a 20% with respect to
layout, with a single gravitational center, to the clustered the blind approach. Traag et al. in [34] used Bayesian inter-
one with more force centers placed in predetermined distinct ference to deduce, starting from phone traffic data, profiles
areas. This layout allows to analyze the network on various about the places and the proximity of a given social event.
layering levels depending on specified node attributes. Fig-
ure 3 shows the phone traffic network of some clans the Our framework provides network geo-mapping by using this
previous criminal network, in which the color of the nodes type of techniques to infer the spatial origin of each call. We
denotes the type of crime committed by the members. here describe the network geo-mapping visualization method
adopted in LogAnalysis. This layout allows to simultane-
In this example, the clustering truthfully reflects the known ously carry out spatial and temporal relational analysis of
territorial division among the groups belonging to the orga- phone call logs. It places nodes of the network on a map,
nization. In Figure 3 the focus is on a specific node. Using in correspondence of the coordinates of the cells linked dur-
this layout it is possible to contextually analyze the commu- ing the events recorded in the logs. Nodes are connected
nity structure, the type of committed crime in respect to the by links related to displacements. Contacts falling within
members of the clan, and the direct relations of each single the sectors of a given zone are represented with nodes of
individual. This layout integrates also the forth Network the same color. Information about displacements, routines
Nirvana recommendation, namely the possibility to identify and areas of interest for the investigation are displayed. The
clusters and to highlight the community structure. adoption of network geo-mapping has proved extremely use-
ful during real investigations. Figure 4 shows, as an exam-
ple, a case study in which larger nodes identify zones in
3.4 Network geo-mapping which, in the time period of the investigation, a high num-
It is possible to extend the phone traffic analysis to include
ber of contacts has been recorded among some members of
the phone logs recorded by the BTS (Base Transceiver Sta-
the CN. Unsurprisingly, the inspection by police officers of
tion), in which the GPS coordinates of the cell are reported.
such high-profile locations provided crucial insights on the
All base stations are provided with directional antennas and
investigation. Unfolding the temporal evolution of the geo-
each cell has two or more sectors. For each cell it is known
mapped phone traffic network also allows to reproduce in-
the azimuth (direction) corresponding to the central axis of
dividuals’ movements and communication dynamics during
each sector, together with the width of the beam of each
specific criminal events embedded in space and time, like
antenna, which determines the coverage angle of the sector.
robberies, assaults, or homicides.
These data do not allow to localize the geo-referenced posi-
tion of the phones involved in the events recorded in the logs.
Nevertheless, it is possible, within a certain approximation, 4. CONCLUSIONS
to localize the users falling within the coverage area. Criminal network analysis benefits from visualization meth-
ods used to support the investigations, especially when deal-
Zang et al. [41] described a technique based on Bayesian ing with networks reconstructed from heterogeneous data
interference to localize mobile phones using additional in- sources, characterized by increasing size and complexity. In
formation, such as the round-trip-time of data transmission this paper we integrated the spring embedded algorithm
packets and the measure of SINR (Signal to Interference plus with the fisheye and foci layouts to allow interactive ex-
Noise Ratio). The parameters obtained experimentally have ploration of criminal networks through our network analy-
been compared with the records of phone calls and the cor- sis framework. The combination of these techniques proved
helpful to support investigators in the extraction of useful dual-representation system to explore social networks.
information and critical insights, to identify key members IEEE Transactions on Visualization and Computer
in terrorist groups, and to discover specific paths of inter- Graphics, 12(5):677–684, Sept. 2006.
action among members of criminal organizations. Experi- [21] P. Klerks and E. Smeets. The network paradigm
applied to criminal organizations: Theoretical
mental results show that the combination of force-directed nitpicking or a relevant doctrine for investigators?
layouts, distortion techniques and multi-force systems yield Connections, 24:53–65, 2001.
better performance in terms of both efficiency and efficacy. [22] V. Krebs. Mapping networks of terrorist cells.
Connections, 24(3):43–52, 2002.
5. REFERENCES [23] Y. K. Leung and M. D. Apperley. A review and
[1] J. Arquilla and D. Ronfeldt. Networks and netwars: taxonomy of distortion-oriented presentation
The future of terror, crime, and militancy. Survival, techniques. ACM Trans. Comput.-Hum. Interact.,
44(2):175–176, 2001. 1(2):126–160, June 1994.
[2] J. Assa, D. Cohen-Or, and T. Milo. Displaying data in [24] F. Lorrain and H. C. White. Structural equivalence of
multidimensional relevance space with 2d visualization individuals in social networks. The Journal of
maps. In Proc. Visualization ’97, pages 127–134, 1997. Mathematical Sociology, 1(1):49–80, 1971.
[3] W. Baker and R. Faulkner. The social organization of [25] J. Mena. Investigative Data Mining for Security and
conspiracy: illegal networks in the heavy electrical Criminal Detection. Butterworth-Heinemann, 2003.
equipment industry. Am. Social. Rev., 58, 1993. [26] C. Morselli. Assessing vulnerable and strategic
[4] J. Barnes and P. Hut. A hierarchical o(n log n) force positions in a criminal network. Journal of
calculation algorithm. Nature, 324:446–449, 1986. Contemporary Criminal Justice, 26(4):382–392, 2010.
[5] V. D. Blondel, J.-L. Guillaume, R. Lambiotte, and [27] A. Perer and B. Shneiderman. Balancing systematic
E. Lefebvre. Fast unfolding of communities in large and flexible exploration of social networks. IEEE
networks. Journal of Statistical Mechanics: Theory Trans. Visual. and Computer Graphics, pages
and Experiment, 2008(10):P10008+, July 2008. 693–700, 2006.
[6] U. Brandes. A faster algorithm for betweenness [28] N. J. Pioch and J. O. Everett. Polestar: collaborative
centrality. Journal of Mathematical Sociology, knowledge management and sensemaking tools for
25(2):163–177, 2001. intelligence analysts. In Proc. 15th ACM international
conference on Information and knowledge
[7] U. Brandes. Drawing on physical analogies. In management, pages 513–521. ACM, 2006.
Drawing Graphs, pages 71–86. Springer, 2001.
[29] M. Sarkar and M. H. Brown. Graphical fisheye views.
[8] D. W. Brannan, P. F. Esler, and N. T. Comm. ACM, 37(12):73–84, 1994.
Anders Strindberg. Talking to terrorists: Towards an
independent analytical framework for the study of [30] F. Schneider, A. Feldmann, B. Krishnamurthy, and
violent substate activism. Studies in Conflict and W. Willinger. Understanding online social network
Terrorism, 24(1):3–24, 2001. usage from a network perspective. In Proc. 9th
SIGCOMM conference on Internet measurement
[9] S. Catanese, E. Ferrara, and G. Fiumara. Forensic conference, pages 35–48. ACM, 2009.
analysis of phone call networks. Social Network
Analysis and Mining, 3(1):15–33, 2013. [31] B. Shneiderman and A. Aris. Network visualization by
semantic substrates. IEEE Trans. Visual. and
[10] H. Chen, D. Zeng, H. Atabakhsh, W. Wyzga, and Computer Graphics, 12(5):733–740, Sept 2006.
J. Schroeder. Coplink: managing law enforcement
data and knowledge. Comm. ACM, 46(1):28–34, 2003. [32] A. Slike. The devil you know: Continuing problems
with research on terrorism. Terrorism and Political
[11] P. De Meo, E. Ferrara, G. Fiumara, and A. Provetti. Violence, 13:1–14, 2001.
Generalized Louvain method for community detection
in large networks. In Proc. 11th International [33] M. K. Sparrow. The application of network analysis to
Conference on Intelligent Systems Design and criminal intelligence: An assessment of the prospects.
Applications, pages 88–93. IEEE, 2011. Social Networks, 13(3):251–274, 1991.
[12] P. De Meo, E. Ferrara, G. Fiumara, and A. Provetti. [34] V. A. Traag, A. Browet, F. Calabrese, and F. Morlot.
Enhancing community detection using a network Social event detection in massive mobile phone data
weighting strategy. Information Sciences, 222:648–668, using probabilistic location inference. In 2011 IEEE
2013. 3rd international conference on social computing
(socialcom), pages 625–628. IEEE, 2011.
[13] P. De Meo, E. Ferrara, G. Fiumara, and A. Provetti.
Mixing local and global information for community [35] S. Wasserman and K. Faust. Social network analysis:
detection in large networks. Journal of Computer and methods and applications. Cambridge Univ. Pr., 1994.
System Sciences, 80(1):72–87, 2014. [36] W. Wright, D. Schroh, P. Proulx, A. Skaburskis, and
[14] P. De Meo, E. Ferrara, G. Fiumara, and B. Cort. The sandbox for analysis: concepts and
A. Ricciardello. A novel measure of edge centrality in methods. In Proc. SIGCHI Conference on Human
social networks. Knowl-based Syst, 30:136–150, 2012. Factors in Computing Systems, pages 801–810, 2006.
[15] E. Ferrara, P. De Meo, S. Catanese, and G. Fiumara. [37] J. Xu and H. Chen. Crimenet explorer: a framework
Detecting criminal organizations in mobile phone for criminal network knowledge discovery. ACM
networks. Expert Systems with Applications, Trans. on Information Systems, 23(2):201–226, 2005.
41(13):5733–5750, 2014. [38] J. Xu and H. Chen. Criminal network analysis and
[16] L. Freeman. A set of measures of centrality based on visualization. Comm. ACM, 48(6):100–107, 2005.
betweenness. Sociometry, pages 35–41, 1977. [39] C. Yang, H. Chen, and K. Hong. Visualization of large
[17] L. C. Freeman. Visualizing social networks. Journal of category map for internet browsing. Decis. Support
Social Structure, 1, 2000. Syst., 35(1):89–102, Apr. 2003.
[18] T. Fruchterman and E. Reingold. Graph drawing by [40] C. Yang, N. Liu, and M. Sageman. Analyzing the
force-directed placement. Software: Practice and terrorist social networks with visualization tools. In
Experience, 21(11):1129–1164, 1991. Intelligence & security informatics. 2006.
[19] G. W. Furnas. Generalized fisheye views. SIGCHI [41] H. Zang, F. Baccelli, and J. Bolot. Bayesian inference
Bull., 17(4):16–23, Apr. 1986. for localization in cellular networks. In 2010
Proceedings IEEE INFOCOM, pages 1–9. IEEE, 2010.
[20] N. Henry and J.-D. Fekete. Matrixexplorer: A