There is an abundance of semi-structured reports on events being written and made available on the World Wide Web on a daily basis. These reports are primarily meant for human use. In this paper we present a new linked data set and a method for automatically adding such RDF metadata to semi-structured reports to speed up the creation of geographical mashups and visual analytics applications. We showcase our method on piracy attack reports issued by the International Chamber of Commerce (ICC-CCS). We show how the semantic representation makes it possible to easily analyze and visualize the aggregated reports to answer domain questions. Our pipeline includes conversion of the reports to RDF, linking their parts to external resources from the Linked Open Data cloud and exposing them to the Web.
topic of the reports is also of contemporary socio-economic concern and are related to research questions that go beyond what classic data mining can easily answer. We therefore chose to take this example as a showcase for the feasibility and usability of event extraction coupled with novel research question answering methods.
We represent LOP data in RDF with the Simple Event Model (SEM) [
This paper is organized as follows. In Section 2, we show how we created RDF event descriptions from web pages. In Section 3, we discuss the modeling of the events in SEM. In Section 4, we show example domain questions from UNOSAT that can easily be answered using our event representation. In Section 5, we discuss related work and in Section 6, we conclude with a discussion and future plans. 2
We start crawling of the ICC-CCS IMB webpage with the links to the yearly archives in the menu of the Live Piracy Map page. Figure 1 (top) shows what an ICC-CCS piracy report looks like. The reports are semi-structured, and concern seven predened types of events: Hijacked, Boarded, Robbed, Attempted, Fired Upon, Suspicious (vessel spotted) and Kidnapped. The reports contains a eld for the vessel type of the ship broadcasting the report; although the types of the vessels are often recurring, this eld is lled manually, which gives rise to spelling variations (e.g., redupon vs red upon) and a lack of certainty in terms of coverage; a new ship type could be lled in any day. The description of the event itself is done in full text, without a specic formatting except that it is preceded, in the same eld, by the geographic and temporal coordinates of the event. The geographic and temporal coordinates are repeated in an independent eld each.
For each of these pages we follow all the links in the descriptions of the placemarks on the overview map, returning us one semi-structured description pages for each event. We fetch the various elds from these pages using XPath queries and Prolog rules for value conversion and xing irregularities. In this way we fetch: (1) The IMB’s attack number, which consists of the year and a 8 SWI-Prolog, http://www.swi-prolog.org/ counter. From this we generate an event identier by prepending a namespace and by appending a sux whenever there are duplicate attack numbers in a year; (2) The date of the attack, which we convert to ISO 8601 format; (3) The vessel type, which we map to URIs with rules that normalize a few spelling variations of the types. (4) The location detail, which we use as a label for the place of the event; (5) The attack type, which we map to URIs in the same way as the vessel type; (6) The incident details, which we convert to a comment describing the event itself. The rst line is split into a time and place indication. These are used as backup sources to derive the date and location, should the parsing of elds 2, 4 and 7 fail; (7) The longitude and latitude of the placemark on the map insert. These are used as coordinates of a generated anonymous place (i.e., without a URI) for the event. The time fetched from the date (3) or narrative (6) eld has a number of dierent representations in the source pages. Some time indications are in local time, while others are in UTC. Often there is no indication of the time zone. For many events the indicated time is 00:00 (midnight) to denote the time of attack is unknown. These inconsistencies in the time notation, in combination with the fact that there are few events on the same day, led us to the decision to use the date without a time indication whenever there is ambiguity about the time.
To demonstrate that representing extracted events in SEM aids the integration of data sources, we take another set of piracy reports and integrate these with the IMB reports. For this, we use the Worldwide Threat to Shipping reports by the US National Geospatial-Intelligence Agency describing 36 piracy events between 26 March 2010 and 16 April 2010. 31 of these events overlap with the IMB reports. The remaining 5 come from other sources: Reuters (2) 9, UKMTO10, MSCHOA11, and ReCAAP12. These reports are (re)posted on many websites, some of which are plain-text representations of the reports, while others add some additional layout tags to separate the place, time, and state of the ship during the attack from the narrative. Two example NGA reports are shown in Figure 1 (bottom).
By changing the XPath and grammar rules to suit the dierent structure of the NGA reports we were able to recognize the same 7 attributes we got from the IMB website. The event terminology is nearly the same as on the IMB website, except there is a distinction between boardings and robberies. There is also some extra information in 34 of the 36 reports about the state of the ship during the attack, (e.g., moored or underway). For some of the events there are no explicit coordinates of the location of the event, but there is a textual description, for example, \approximately 150NM northwest of Port Victoria, Seychelles". For these events we look up the coordinates of Port Victoria using GeoNames 13, which returns RDF. From this location we use trigonometry along the geoid with the haversine formula in the specied direction. For example, in the case of 150NM northwest we compute the coordinates 150 minutes of angle at a bearing of 315 degrees. We treated time in the NGA reports in the same way as in the IMB reports, reducing them to an ISO 8061 date.
We match the NGA reports to the IMB reports by picking the nearest event that occurred on the same day that has compatible actor types, i.e., when the types are not the same, one has to be sem:subTypeOf the other. This enables us to automatically map 30 of the 31 overlapping reports correctly. We store these matches with an owl:sameAs property between the two matching events. We believe the single unmatched report was mistakingly identied as a distinct IMB report, because it is extremely similar to another report (the same date, place, time, victim vessel type, and similar narrative) which has a matching IMB report. Therefore, we believe there should only have been 30 overlapping reports, which we were all able to match. 3
We use the set of 7 elements (see Section 2) extracted per report to generate a semantic event description using SEM. We generate a URI for the event described in each report and a URI for the victim ship, which we represent as a sem:Actor, based on the IMB attack number (nr. 1). The date (nr. 2) is attached to the 9 Reuters, http://www.reuters.com/ 10 UK Maritime Trade Operations, http://www.mschoa.org/Links/Pages/UKMTO.aspx 11 The Maritime Security Center { Horn of Africa, http://www.mschoa.org/ 12 The Regional Cooperation Agreement on Combating Piracy and Armed Robbery against Ships in Asia, http://www.recaap.org/ 13 GeoNames search, http://sws.geonames.org/search -4.23333 41.31667 eez:Kenya geonames:inCountry geonames: 192950 clossekMosa:tch rdf:type wn30:synsethijackingnoun-1 sem:EventType poseidon:etype _piracy
rdf:type sem:ActorType sem:Event by means of the sem:hasTimeStamp property. The sem:hasTimeStamp datatype property was chosen over the sem:hasTime object property, because we do not need type hierarchies over time instances to answer our domain questions. The vessel type (nr. 3) is typed as a sem:ActorType attached to the victim ship sem:Actor with the sem:actorType property, a subproperty of rdf:type. The location detail (nr. 4) is made a rdfs:label of the blank node representing the location of the attack. We chose not to use the Exclusive Economic Zones (EEZs) 14 (usually dened as 200 nautical miles from the coast of the nearest state), or the GeoNames identier of the nearest relevant place, as the URI of the location of the attack because this would have removed the distinction between the exact location of the attack and the more general region. We did use the EEZs for an initial partitioning of the world into regions (e.g. Gulf of Aden, Carribean). The remaining surface of the earth, including the international waters and inland seas is partitioned based on the nearest EEZ. The area nearest to an EEZ is assigned a new URI, e.g., the international waters o the coast of Liberia and closest to Liberia’s EEZ (i.e., not closest to Ascension’s, Co^te d’Ivoire, Sierra Leone’s, or Saint Helena’s EEZs) is assigned the URI eez:Nearest to Liberia. Based on the distribution of the piracy events, we grouped particular sections of the world together. This grouping is only specic to the piracy event domain.
The attack type (nr. 5) is modeled analogously to the vessel type as a sem:EventType , which is attached to the event using the sem:eventType property. The event type robbery that we found in the NGA set was modeled as a sem:subTypeOf the IMB event type boarding. The mooring and underway vessel states are modeled as additional event types of the piracy event using sem:eventType properties attached to the event. All event types used in this data set are sem:subTypeOf the piracy event type, poseidon:etype piracy. The narrative of the report (nr. 6) is attached to the event as a rdfs:comment . The WGS84 14 http://www.vliz.be/vmdcdata/marbound/ coordinates (nr. 7) are assigned to the blank node with the W3C WGS84 vocabulary. Additional ship names are attached to the sem:Actor using the ais:name property, a domain-specic label for ship names.
We create local URIs to represent the types of the extracted events and the types of their participants (e.g., poseidon:etype hijacked or poseidon:atype yacht). The SEM piracy events are aligned with WordNet 2.0 15, 3.016, OpenCyc17 and Freebase18. WordNet gives us the advantage of relating dierent lexical variations to a unique URI e.g., mapping highjacking and hijacking to hijacking. This can also be used to automatically transform piracy descriptions to types. As WordNet has a hierarchy of hyponym relations between synsets (e.g., a tankership is a hyponym of cargoship ) we can do hyponym inference.
We can not map all of our types to any one of these three vocabularies, but by mapping to all three of them we get a good coverage of our domain-specic type vocabulary. Our data set contains 73 ActorTypes and 26 EventTypes, which is too few to make it worthwhile to use an automatic mapping method, so we manually created the following mappings: 70 skos:closeMatch (24 to Freebase, 24 to OpenCyc, 25 to WordNet);10 skos:broadMatch (5 to OpenCyc, 4 to WordNet, 1 to Freebase); 33 skos:relatedMatch (13 to OpenCyc, 11 to WordNet, 9 to Freebase). A \related" relation hold for example between WordNet’s to re and the event type red upon , because to re only conveys part of the meaning. 4
In this section, we show how the SEM representation simplies answering domain questions through visualizations and analyses. We rst show how the enriched 15 WordNet 2.0, http://www.w3.org/2006/03/wn/wn20/ 16 WordNet 3.0, http://semanticweb.cs.vu.nl/lod/wn30/ 17 OpenCyc, http://sw.opencyc.org/ 18 Freebase, http://{www|rdf}.freebase.com/ data could be used to recreate UNOSAT questions. Then we show the added value of the mappings and hierarchies in an additional set of domain questions. 4.1
Rebuilding UNOSAT Reports
The analysis performed and compiled for the UNOSAT reports [
The conclusion of map 1 in the UNOSAT 2009 Q1 report, namely that the attacks have shifted southward and extended further east-west along the axis of the International Recommended Transit Corridor (IRTC) 19 can be reproduced by combining plotting the attacks on a map along with information about the IRTC. This is illustrated in Figure 3, a time animation in KML is available online20. Although more coastguard and marine vessels are present in the recommended corridor, pirates also know that there are more ships there, hence more chances of nding a victim. 4.2
Additional Questions We start with an easy visualization of number of attacks per region per year (top left Figure 4). We can see that the most active regions are the Gulf of Aden, Indonesia, India and East Africa. The graph also shows that Indonesia used to be the most active region, but sometime in 2007 activity in the Gulf of Aden and East Africa have become the regions with most piracy activity.
Although the narrative section of each report are not split up and represented in RDF yet, we can give some ideas on dierences in weapon use by comparing the number of occurrences of the terms \guns" and \knives" in the dierent reports. For instance, there are no reports that mention knives in the Gulf of Aden region at all, while there are 109 in the Indonesia region while there are 85 that mention guns in the Gulf of Aden and only 25 in Indonesia. The pie charts in Figure 4 show an overview of ve weapons types. In order to properly analyse these we will use more sophisticated NLP techniques in future work.
If we further look into the four most active areas, we can use the ship type mapping to compare dierences in ships attacked in dierent regions. The stacked bar chart in Figure 4 immediately highlights the dierence between Indonesia and the other areas, namely that in the Indonesia region far more tugs 19 http://www.icc-ccs.org/news/163-coalition-warships-set-up-maritimesecurity-patrol-area-in-the-gulf-of-aden 20 http://semanticweb.cs.vu.nl/poseidon/piracy_reports_2005-2010.kmz Number of Attacks per Region edn 28% 25% A f o lf uG 47% rpgs sticks guns knives a i s e n o Ind 79% 18%
11%% automatic weapons 04053006020170 FSBARNHituoioorjaesaetbcdprmbSdkiecpupeedieptoddecoudinfsied East Africa 0 2005 2006 2007 2008 2009 2010 are attacked than in the other regions. In the Gulf of Aden, for a larger number of attacks the ship type of the victim is not known. Interestingly, the attacks on bulk carriers has been declining in the Asian regions until 2009, whereas it was on the rise in the African regions. In order to explain this, extra information is needed, for example on the number of ship movements in these areas. Unfortunately, such data is not openly available.
We can also split out the attacks by types of attack to see whether pirates take a dierent approach in dierent regions. Plotting these statistics in a graph, split out per region, has the advantage that one can quickly see the dierences, whereas plotting these on a map still requires interpretation from the user. Here, the region clustering shows its merit. In the last series of charts in Figure 4, one can see that signicant dierences exist between the regions in the types of attacks. In Asia, for example, far more often ships are boarded (which often also means robbed) than in the African regions. In the Gulf of Aden attacks have become more aggressive and more often victim ships are red upon. In the Gulf of Aden, also more attempted hijackings occur than elsewhere.
This work essentially describes an Open Government Data project, like data.gov
[
We have shown that the ideas behind the Open Government Data initiative can also be applied to information sources from intergovernmental organizations without the need for changing their entire information workow. Automatic conversion of online open data can bring their data to the Web and help these organizations with their business by making it easier to answer questions about their data. In this case study, the representation we use is the Simple Event Model, which helps to integrate spatio-temporal reasoning with web semantics. SEM has an appropriate level of abstraction for the integration of piracy event data: it is more general than the dierences between the data sources taken into account in this paper, but still specic enough to answer domain-specic questions. This modularity of the exible event extraction set allows us to combine data sources with relatively little change in the code base. We have shown that dierent data sources provide dierent aspects of an event, and their combination allows for interesting and serendipitous data analysis. As future work, we aim at doing further natural language processing on each report’s content description in plain text in order to extract more information: the types of weapons used during the attack, the number of pirate boats and pirates, the intervention of a coalition war ship or helicopter, the outcome of the attack which would help to answer even more domain questions. Also, we would like to investigate the possibility to interlink the Linked Open Piracy data set with news items on the 21 http://www.franz.com/agraph/allegrograph/ 22 SEM, http://semanticweb.cs.vu.nl/2009/11/sem/ World Wide Web. This would provide additional background information to the semantic event descriptions, but also a semantic description of the news articles on the Web. 7
This work has been carried out as a part of the Poseidon project and the Agora project. Work in the Poseidon project was done in cooperation with Thales Nederland, under the responsibilities of the Embedded Systems Institute (ESI). The Poseidon project is partially supported by the Dutch Ministry of Economic Affairs under the BSIK03021 program. The Agora project is funded by NWO in the CATCH programme, grant 640.004.801. We would like to thank Davide Ceolin, Juan Manuel Coleto, and Vincent Osinga for their signicant contributions. We thank the ICC-CCS IMB and the NGA for providing the open piracy reports.