In Taltosh, you deal with entities (a named snapshot set of single or multiple identifiers) and events (factual data indicating what happened with the identifiers and/or entities) for example: “a license plate appeared at 23:42 at a certain gps coordinate“. Taltosh may automatically create relational links based on your preferences for example this event:”IMEI_A called IMEI_B at 12:34” also yields a link between the two entities. During manual investigations the goal is to apply a set of filters based on your domain specific logic and step-by-step to screen your data to eventually find your desired set of relevant facts with identifiers.
Location based filters are using 2D Geospatial coordinates to find events, identifiers and entities that are equipped with GPS coordinate pairs.
Combination of these geospatial filters with models and advanced questions for complex, multi step phenomenons are compressed into case resolvers that are also disposed at your service.
Geospatial filtering
Filter
Regular filtering
Data type
Relational event metric
Filter parameters
- Entity identifiers
- Timeframe (date from and date to)
- Geospatial zone definition: within a circle, rectangle or polygon, around a geospatial line (for example: border, road)
Filter
Graph distance
Data type
Relational event metric
Filter parameters
For a given ID (or set of identifiers aka. entities) like phone, location, social security id, plate, show all possible (but maximum N hop) relational routes, starting from the shortest.
Filter
Hubs
Data type
Relational event metric
Filter parameters
Rank common connections (relational routes) based on the number of events a given route is constitued. The more event (for example transactions to the same Bank account) the higher the common connection is.
Filter
Groups
Data type
Relational event metric
Filter parameters
From a given set of pre-determined events (or entities), find the highest number distinct set. This either gives the opportunity to understand distinct entities or groups that entities are members of. Also each entity is shown as a list of distinct identifiers and each groups are shown as a list of distinct entities. The filter is capable to accept specific parameters like: minimum and maximum group size, dimensions (and metric thresholds) on which linkage is allowed, group distinction function (how much cross-relations are allowed between groups to be considered distinct)
Filter
Flows
Data type
Relational event metric (directed)
Filter parameters
Certain events usually follow each other, like chain of financial transactions or a pattern of appearance of license plates on a camera log and much more. However certain operations have a distinct flow of events in time as those events are following each other in a pattern. This filter is able to show, from within a set of events filtered by IDs or entities, that what is a typical route of events through the graph. This allows for direct and intuitive flow visualization to understand and recognize habitual and operational patterns.
Network filters focus on filtering the entity space using the graph database of the already mapped relations. Primitive network filtering focuses on finding entities with specific relations within a given social distance or other set of co-relational metrics, and can also be used for quick clustering purposes, see below.
Metrics are generated for each incoming dimension using a built-in distance calculator that is able to calculate the multi-dimensional distance matrix between entities. The distance functions can also be implemented if new metric is introduced other than the built in geospatial, transactional, boolean and scalar ones.
Combination of these network & graph filters with models and advanced questions for complex, multi step phenomenons are compressed into case resolvers that are also disposed at your service.
Social and relational network filtering
Filter
Filter for relations
Data type
Relation indicator scalar or boolean
Filter parameters
- Dimensions (metrics) to find relations by (e.g. co-location, bank, cdr transactions, models)
- Maximum distance (how many hops through the search can spread)
- Relation strength (depending on the metrics or dimension), individual and aggregated
- Regular filters are available to apply (metric and dimension dependent) to exclude or include certain values (timeframe, gps zones, identifiers etc.)
Filter
Distance
Data type
Relation indicator scalar or boolean
Filter parameters
For a given ID (or set of identifiers aka. entities) like phone, location, social security id, plate, show all possible (but maximum N hop) relational routes, starting from the shortest.
Filter
Hubs
Data type
Relation indicator scalar or boolean
Filter parameters
Rank common connections (relational routes) based on the number of events a given route is constitued. The more event (for example transactions to the same Bank account) the higher the common connection is.
Filter
Groups
Data type
Relation indicator scalar or boolean
Filter parameters
From a given set of pre-determined events (or entities), find the highest number distinct set. This either gives the opportunity to understand distinct entities or groups that entities are members of. Also each entity is shown as a list of distinct identifiers and each groups are shown as a list of distinct entities. The filter is capable to accept specific parameters like: minimum and maximum group size, dimensions (and metric thresholds) on which linkage is allowed, group distinction function (how much cross-relations are allowed between groups to be considered distinct)
Filter
Flows
Data type
Relation indicator scalar or boolean
Filter parameters
Certain events usually follow each other, like chain of financial transactions or a pattern of appearance of license plates on a camera log and much more. However certain operations have a distinct flow of events in time as those events are following each other in a pattern. This filter is able to show, from within a set of events filtered by IDs or entities, that what is a typical route of events through the graph. This allows for direct and intuitive flow visualization to understand and recognize habitual and operational patterns.
Time series filters are designed to quickly find patterns around a given identifier or location. Events usually happen in a random pattern, however many features of the timeseries data of the event stream can be captured like: dense events around an identifier, regular events, co-integrated events between one or more identifier and much more.
Combination of these timeseries filters with models and advanced questions for complex, multi step phenomenons are compressed into case resolvers that are also disposed at your service.
Timeseries filtering
Filter
Regular filtering
Data type
Any event with timestamp
Filter parameters
- Applies to any event that has a timestamp (event_date, state_from_date and state_to_date)
- Regular filters for finding events between certain intervals, compound filtered with certain metrics
Filter
Concentration
Data type
Any event with timestamp
Filter parameters
- Find all events around a set of timestamps within a given interval.
- Find and count most events within a given interval and compound filters. For example: find, count and list top counting events occurring within 1 hour interval around a given gps coordinate
Filter
Correlation
Data type
Any event with timestamp
Filter parameters
Find all events that are usually timestamped before or after each other but having different (a) metric and/or (b) different identifier. This allows for cointegrated entitiy recognition.
- Who is following me (GPS + timestamp)
- Who am I doing peer-to-peer communication (data log event correlation)
- Who is on the same transportation vehicle
Filter
Pattern Scanner
Data type
Relational event metric
Filter parameters
Find identifiers with distinct events with at least N occurrence within a periodic timeframe. This is useful to scan for GPS coordinates that had peaks of activity around, find bank account numbers that have regular transactions and also useful to identify licence plates that had been occurring periodically between two highway detectors.
Do you have an unsolvable case?
Even if your case seems utterly complex we might already have a case resolver waiting for You!