April 2004  Volume 3, Issue 4   
What's New?

The feedback relating to the VisuaLinks 3.0 release has been overwhelmingly positive with many clients commenting on the ease-of-use and simplified user interfaces. Not only does VisuaLinks 3.0 support basic and advanced user modes, but it allows the interface to be customized for each user. This lets users on the same server tailor the VisuaLinks interface to show different analytical modes, menus, and analytical services.

VAI has been working with SGI to test VisuaLinks 3.0 on their newest Altix 3000 servers. Initial tests supporting a 16 Itanium-2 processor configuration with 32 GB of RAM proved that SGI can deliver the horsepower needed to keep up with the high-end analytical requirements of VisuaLinks 3.0. The Altix 3000 system is expandable to 256 Itanium, 2 processors and up to 4 TB of memory - our Linux developers can't wait to try VisuaLinks on that configuration.

To learn more about SGI and their new line of servers, visit http://www.sgi.com.
Here are a few tips and tricks to help you use VisuaLinks quickly and more efficiently.
...that there are global settings that apply to managing all user accounts?

Administrators have access to an Admin menu containing an "Admin for Analysis Net" command, which flows into a submenu containing the following options:

The Manage User Accounts command brings up a window that lets you control the individual user accounts. At the bottom of this window there are two tabs. By default, the Users tab is selected. Click on the Global tab to display the global user account settings.

From the global settings, a number of different parameters can be set to help control the level of security enforced on the user accounts. Most of the controls are similar to those found in popular operating systems. The following example shows which global settings can be applied.
Merged Objects

Merged Objects is a mouse mode used to interactively select objects that are believed to be the same entities, but are represented in the display using different icons. For example, in the Money Laundering Model, there is a subject involved with 3 separate SAR transactions with 2 different addresses listed. Upon closer inspection, the addresses appear to be identical, except that one contains the full street name (including DR) and the other lists the country.
These two addresses are virtually identical and the chart can be cleaned up considerably by collapsing them into a single representation. Activate the Merge Objects mode using the icon in the Data Toolbar (above the View). Simply click and drag to draw a box around the objects you want to merge.
When you release the mouse button, a confirmation window displays to allow you to make some basic settings.
   First, the menu pull-down presents a list of all the selected objects being considered for merging. The one selected will act as the primary object to establish the label, icon, and other related attributes.

   The "label" entry is what will appear as the label for the merged objects (editing this label does not change any of the underlying data).

   The icon can also be overridden using the Set Merged Picture option. Finally, there is an entry to add the merged objects to the primary Alias List.

After you click the OK button, the objects will be merged together and a symbol will display under the object image to indicate it has been merged. This object will remain merged for the session and can be walked, detailed, or manipulated just like any other object in the display. You can unmerge objects by choosing the appropriate selection in the Merge Objects options menu (using the under the Merge Objects icon).
Employee Master File Analysis

This month's review is focused on exposing different types of situations that potentially indicate fraud. Corporations of all sizes have issues covering all aspects of their operations including personnel, goods/services, and finance/accounting. The following examples show the types of patterns and analyses that are being performed to better understand vulnerabilities and financial exposure within a mid-sized company.

One of the datasets used in this example is based on the Employee Master File, which contains general information for all employees including their name, address, telephone number, and employment status. In the following diagram, the data was clustered within VisuaLinks based on the employment status field to show a total of 4 active groups.


The majority of the values were either "T" for terminated or "A" for active (icons in the chart were defined according to these values).

It was also noted there are 6 people with both "T" and "A" as their employment status - clearly, this is an anomaly and represents a control problem within the HR system. The single employee with a value of "L" is on leave from the company.

Using this information, the networks were expanded to bring in the addresses contained in the Employee Master File. The next diagram shows a high-level chart depicting this data with 291 employees and 281 addresses. In the upper-left part of this chart, it can be seen there are several employees sharing the same addresses.

Upon closer examination of the data, there are some relationships that raise concern with respect to active and terminated employees residing at the same address. The names and addresses in this next diagram are hidden with box-overlays to protect their privacy.
   The upper-left network shows an address with 3 employees (2 active, 1 terminated) where the last names are different; this represents a roommate situation and the company should be somewhat concerned about retention matters.

   The next network (second from left in top row) depicts 3 employees (1 active, 2 terminated) where all the last names are the same; the company should be very concerned with this situation regarding retention, moral, or possible theft.

   The lower-right network shows an active and terminated employee living at the same apartment complex; most likely there is no direct relationship between the employees and the company should not be concerned here.

Other diagrams using the phone numbers listed (e.g., home phone, emergency phone, etc) could also be used to expose commonality among the employees. Additional analyses can also show employee-as-vendor patterns based on shared characteristics such as addresses, phone, and fax numbers. When these types of situations are encountered and are not previously known, the company must review its internal controls for contract award, bid requirements, and vendor payment history to determine if fraud has been committed.
To unsubscribe from this Newsletter, use the unsubscribe option in your support site profile. If you do not have a profile, please e-mail support@visualanalytics.com to unsubscribe.
Visual Analytics Home Site The Linkletter Archives Visual Analytics News Digital Information Gateway Software News VisuaLinks Software News The LinkLetter Cover Home of Visual Analytics The LinkLetter Archives Home of Visual Analytics Visual Analytics Inc. Digital Information Gateway VisuaLinks - Link Analysis, Data Mining Tool Visual Analytics Home Site The LinkLetter Newsletter Archives Visual Analytics, Inc. News Digital Information Gateway Software News VisuaLinks Software News The LinkLetter Cover