supporting crisis management via detection of sub-events...

20
Supporting Crisis Management via Detection of Sub-Events in Social Networks Daniela Pohl*, Abdelhamid Bouchachia + , Hermann Hellwagner* *Institute of Information Technology, Alpen-Adria-Universität Klagenfurt, Austria {daniela,[email protected]} + Smart Technology Research Center, Bournemouth University, UK {[email protected]} ABSTRACT Social networks provide the opportunity to gather and share knowledge about a situation of relevance. User-generated content is getting increasingly important during crisis management. It facilitates the collaboration with citizens or involved parties from the very beginning of the crisis. The information captured in the form of images, text or videos is a valuable source of identifying sub-events of a crisis. In this study, we use metadata of images and videos collected from Flickr and YouTube to extract crisis sub-events. We investigate the suitability of clustering techniques to detect sub-events. In particular two algorithms are evaluated on several data sets related to crisis situations. The results show the high potential of the proposed approach. In addition, we validate the idea of sub-event detection for our future research based on a survey conducted among practitioners. Their responses show the potential of using social media in combination with sub-event detection during emergency management. Keywords: Crisis Management, Sub-Event Detection, Clustering, Information Retrieval INTRODUCTION In crisis management a large number of different actors work together for handling the crisis situation (Hiltz, van de Walle, & Turoff, 2010). This collaboration would not work without knowledge sharing between the involved parties. It is essential to gather and share information during a crisis to gain several perspectives for enabling clarification and stabilization of the situation. Hence, consulting social media platforms turns out to be an interesting instrument, not only for information sharing but also for communication and collaboration, as stated in (Yates & Paquette, 2011). There exist two aspects where social media can support crisis management. First, social media is used to involve citizens. People use existing social network platforms because they are familiar with them for documenting (standard) situations. So, they can apply these platforms in any situation they are involved in. This aspect is especially of importance if it is not possible to be at the scene from the very beginning and/or when sudden new situations emerge. Social media platforms have a high value in crisis management, given that people increasingly use social media platforms to document the situation they are engaged in (Palen, 2008). Second, social media platforms can also be used as collaboration and documentation tools for first responders, enabling knowledge sharing and information gathering. For example, during emergency response of the Haiti earthquake, social network platforms were used for collaboration (Yates & Paquette, 2011). Collaboration in this paper is restricted to the spreading of information about a crisis situation by different people and via different social media infrastructures. At the practical level,

Upload: others

Post on 23-Aug-2020

3 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

Supporting Crisis Management via Detection

of Sub-Events in Social Networks

Daniela Pohl*, Abdelhamid Bouchachia+, Hermann Hellwagner*

*Institute of Information Technology, Alpen-Adria-Universität Klagenfurt, Austria

{daniela,[email protected]} +Smart Technology Research Center, Bournemouth University, UK

{[email protected]}

ABSTRACT

Social networks provide the opportunity to gather and share knowledge about a situation of

relevance. User-generated content is getting increasingly important during crisis management. It

facilitates the collaboration with citizens or involved parties from the very beginning of the

crisis. The information captured in the form of images, text or videos is a valuable source of

identifying sub-events of a crisis. In this study, we use metadata of images and videos collected

from Flickr and YouTube to extract crisis sub-events. We investigate the suitability of clustering

techniques to detect sub-events. In particular two algorithms are evaluated on several data sets

related to crisis situations. The results show the high potential of the proposed approach. In

addition, we validate the idea of sub-event detection for our future research based on a survey

conducted among practitioners. Their responses show the potential of using social media in

combination with sub-event detection during emergency management.

Keywords: Crisis Management, Sub-Event Detection, Clustering, Information Retrieval

INTRODUCTION

In crisis management a large number of different actors work together for handling the

crisis situation (Hiltz, van de Walle, & Turoff, 2010). This collaboration would not work without

knowledge sharing between the involved parties. It is essential to gather and share information

during a crisis to gain several perspectives for enabling clarification and stabilization of the

situation. Hence, consulting social media platforms turns out to be an interesting instrument, not

only for information sharing but also for communication and collaboration, as stated in (Yates &

Paquette, 2011).

There exist two aspects where social media can support crisis management. First, social

media is used to involve citizens. People use existing social network platforms because they are

familiar with them for documenting (standard) situations. So, they can apply these platforms in

any situation they are involved in. This aspect is especially of importance if it is not possible to

be at the scene from the very beginning and/or when sudden new situations emerge. Social media

platforms have a high value in crisis management, given that people increasingly use social

media platforms to document the situation they are engaged in (Palen, 2008). Second, social

media platforms can also be used as collaboration and documentation tools for first responders,

enabling knowledge sharing and information gathering. For example, during emergency response

of the Haiti earthquake, social network platforms were used for collaboration (Yates & Paquette,

2011). Collaboration in this paper is restricted to the spreading of information about a crisis

situation by different people and via different social media infrastructures. At the practical level,

Page 2: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

different organizations may collaborate to make use of the information collected from people and

to coordinate their actions to efficiently cope with the emergency.

Therefore, the data directly collected from response teams or any sensors in the field is an

important source (Lachner & Hellwagner, 2008). Independently of the origin/purpose of the used

social media platforms, such information is worth using for gaining an overview of the situation.

Clearly, the amount of data collected (especially for a large scale crisis) is overwhelming. Data

overload (especially for unstructured data, like e-mails) is one of the most challenging problems

within crisis management (Turoff, Chumer, Walle, & Yao, 2004). To help the first responders to

deal with the situation at hand, automatic processing/analysis of the collected data is valuable.

In this contribution, we describe a general framework for analyzing data collected from

social networks for supporting crisis management. We use in particular Flickr and YouTube

information to detect sub-events (i.e., special hotspots) related to a crisis situation.

Events are often described as a whole (e.g., concerts, festivals like in (Becker, Naaman,

& Gravano, 2010), or soccer games), not considering the different aspects an event has.

However, events can be segmented into sub-events, describing important facets of that event.

Hence, sub-events show situations which are of particular importance.

The same is true for a crisis situation. Crisis situations contain different sub-events (or

mini-crises (Yates & Paquette, 2011)) on which crisis management has to focus on; e.g., at

different places a crisis has different consequences. Considering an earthquake, at one place

some buildings may collapse, whereas in another place a fire may break out. These sub-events

need special attention in crisis management to stabilize the situation, as sub-events describe

dominant threats in a crisis.

Hence, we specify an event via time and location (Yang, et al., 1999) describing the

parent context in which sub-events occur. Concluding, the event describes the crisis context, like

the UK riots 2011, and sub-events define more refined parts, e.g., looting in Hackney London.

Thus, detecting such sub-events as soon as possible helps in efficiently managing the situation.

Sub-event detection aims at identifying potential and dominant threats of a crisis.

Collaboration with those people that have information from the very beginning is vital.

Therefore, the broad acceptance of social media, also in crisis situations, in the public enables

this collaboration and makes the application of sub-event detection a powerful tool in the context

of automatic analysis.

We study clustering techniques for their appropriateness (i.e., possibility to identify

known threats of an incident) in sub-event detection which is applied for analyzing data in

existing social media platforms. Based on our previous work (Pohl, Bouchachia, & Hellwagner,

2012), we evaluate two different clustering techniques: Self-Organizing Maps (SOM) and

Agglomerative Clustering (AC). Additionally, we evaluate our idea of sub-event detection by

conducting a survey among practitioners from various fields. The survey shows if we should

keep up the idea of sub-event detection as a further research direction.

This paper is structured as follows. The next section gives an overview of related work.

The following section, Exploration Framework, describes our general framework for exploring

and analyzing data retrieved from social networks. In Sub-Event Detection the application of

clustering techniques for sub-event detection is explored. In the section Comparison, two

clustering techniques are compared. Within the section Survey: Study with Practitioners the

Page 3: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

results and conclusion of the conducted survey are presented. The last section concludes the

work and shows our future investigations.

RELATED WORK

Most of the research concerning social networks and crisis management concentrates on

analyzing micro-blogs, like Twitter, which is mainly used as broadcast medium (Hughes &

Palen, 2009). Vieweg et al. (2012), for example, show the role of Twitter during two hazards:

Red river floods and the Oklahoma grassfires in 2009. The authors extract different categories of

tweets, ranging from warning messages to weather and evacuation information. The resulting

categorization gives hints for automatic extraction methods.

Marcus et al. (2011) summarize events extracted from Twitter messages and visualize

them for the user. The identification of events is based on finding peaks in the frequency of

messages from the incoming stream. Petrović et al. (2010) focus on story detection for

identifying events based on an incoming Twitter message stream. Mathioudakis and Koudas

(2010) also describe a system for trend detection based on a Twitter stream. Becker et al. (2011)

introduce a cluster and classification framework for the identification of events also through a

Twitter stream.

Beside the textual information, the work in crisis management benefits from using visual

information, like images or videos. The work of Bergstrand and Landgren (2009) show for

example the importance of videos within crisis response. Liu et al. (2008) depict the importance

and role of online photo sharing platforms, like Flickr, during a disaster. In this work, Flickr

activities related to several disasters, e.g., London Bombings 2005 and Virginia Tech Shooting

2007, are studied. The work stresses the relevance of such platforms. Fontugne et al. (2011)

exploit the behavior of users on Flicker to recognize disasters. Rattenbury et al. (2007) study the

role of Flickr tags related to specific events. An algorithm is proposed which determines the

relationship between tags from social media platforms and the corresponding real-word events.

Becker et al. (2012) investigate the identification of planned social events, e.g. concerts,

via a query formulation problem. However, in crisis situations, it must be possible to handle

unforeseen events, which cannot always be learned in advance.

Due to the importance of visual information in emergency management, we focus as a

first step on social media data including videos, pictures and their associated annotations. As

crises are no planned events with unique characteristics, we aim to use unsupervised approaches

that do not need additional effort in labeling and preparing data.

EXPLORATION FRAMEWORK

For handling the data collected during crisis in an efficient way, we introduce a Media

Exploration Framework (MEF) (see Figure 1), which relieves users from performing a

cumbersome manual browsing task. It helps in aggregating data collected from social media (or

in the future directly from within the field) via sub-event detection in an offline and online

manner.

Page 4: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

Figure 1: Media Exploration Framework

The MEF analyses data from different social networks (currently Flickr and YouTube)

related to a crisis. The data is collected from social media platforms through a collection

mechanism based on common interfaces. The collection is performed via a simple keyword

based search, c.f. interactive keyword search on Flickr. The keywords (e.g., UK riots 2011) are

inputs inserted by the user. Keywords can be changed over time as the context and knowledge of

a disaster could also change over time.

Through the collection mechanism different metadata fields (e.g., title, description, and

tags) are retrieved from the items of the social media platforms. The resulting metadata from

each image and video entry is used to perform a clustering-based sub-event detection algorithm.

Currently, the user can also assign different weights to metadata fields, to support the clustering

mechanism in attracting attention to more relevant fields.

The results of the clustering algorithm are subject to a prioritization mechanism in order

to select the most important items based on the created clusters (e.g., based on the number of

related items). For creating a user-friendly representation, the clusters get labels via a labeling

mechanism (i.e., most frequent terms), which help to illustrate the related sub-events. The whole

process results in a summary or situational report, describing and representing the most

important sub-events to the user.

Currently, our framework supports after-the-fact analysis (offline or static analysis) of

crisis-related data which is, for example, important for training toward similar occurrences in the

future. In a next step, we aim at extending the framework to support just-in-time stream

processing. This will facilitate real-time sub-event detection based on incoming information. The

information sources are, up to now, Flickr and YouTube data, but will be extended to additional

repositories, e.g., Twitter, information collected from professional first responders, or including

news media archives.

Page 5: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

SUB-EVENT DETECTION

For sub-event detection, we analyze two different clustering approaches, namely Self-

Organizing Maps (SOM) (Larose, 2005) and Agglomerative Clustering (AC) (Duda, Hart, &

Stork, 2001). In our experiments, for showing the existence of the described sub-events in crisis-

related social media data, we use four data sets (see Table 1). The data sets contain data from

significant crises that occurred during 2011. They are constructed via a pre-selection mechanism

based on keywords to find the most relevant information from social media platforms (in our

case Flickr and YouTube).

Table 1: Data sets for processing sub-event detection (Pohl, Bouchachia, & Hellwagner, 2012)

Name/Abbreviation Period Pictures / Videos

Mississippi Flood (MF) 04-19 May 2011 2039 / 442

Oslo Bombing (OB) 22 Jul. 2011 31 / 222

UK Riots (UK) 06-10 Aug. 2011 178 / 274

Hurricane Irene (HI) 20-29 Aug. 2011 455 / 700

The data sets represent illustrative data from different incidents in the year 2011. They

reflect crises of different sizes, with different origins, and with a different number of related sub-

events. The Oslo data set, as an example, contains two specific sub-events: the bomb explosion

in Oslo and the shooting at the Utøya island. In comparison to other data sets, it has a lower

number of sub-events. The Hurricane Irene and UK Riots data show impacts on several cities

and states.

For the experiments, we use metadata information of videos and pictures taken from the

Flickr and YouTube platforms. We consider for each media item the title, the description and the

tags associated with this item. We do not use data describing the time when a picture was taken

or geo-referenced data, since this information is rarely available on the Flickr and YouTube

platforms.

Our experiments with the social network data show that metadata fields are not of equal

importance. Therefore, the suggested framework supports a weighting mechanism for those

fields. The constraint for the weights α, β and ɣ is expressed in Equation (1). We tried different

settings for performing our social media analysis (see section Comparison).

(1)

For both event detection methods, an appropriate representation of the items

(documents) that have to be clustered must be found and therefore a suitable Natural Language

Processing (NLP) step is needed. We use term frequency-inverse document frequency (tf-idf)

(Manning, Raghavan, & Schütze, 2008) for indexing the items collected. This results in a set of

word-value pairs for each document, called word vector. Irrelevant words are removed using a

stopword list. For NLP we used mainly the WEKA (Hall, et al., 2009) framework with some

additional extensions (see Figure 2) to build the word vectors.

Page 6: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

Figure 2: From multimedia metadata to tf-idf vector space model

First, for NLP we integrated the Porter Stemmer (Porter, 1980) as it is one of the most

common algorithms. Second, we performed an initial semantic analysis. During our previous

work (Pohl, Bouchachia, & Hellwagner, 2012) we recognized the importance of a semantic

analysis to handle similar words (like demo, demonstration) in creating a text representation for

the clustering approach. Hence, we extended the pre-processing step by introducing an initial

semantic analysis based on WordNet for the English language (Fellbaum, 1998). Similar or

closely related concepts are grouped together and treated as one stem (e.g., car, automobile; riot,

rioter).

In this processing step, we considered different relationships between nouns and verbs

extracted from the metadata, such as synonyms and derivated-from using WordNet. For

integrating them into our Java-based application, we used the JWNL Java API (JWNL (Java

WordNet Library), 2012).

A third extension deals with explicit weighting of the fields. As mentioned earlier, in

addition to the tf-idf weighting method, we promote and denote the resulting weights by

rescaling using α, β and ɣ. Such scaling allows controlling the contribution of the words

depending on their positions in the document.

For event-detection, we analyze the data using two different approaches. Due to space

limitation, we focus in the following on two data sets, namely UK Riots and Oslo Bombing. In

the section Discussion, we also give insights into the other data sets. Words followed by * are

written in their stem form. Bold words in cluster labels are related to a sub-event. The clusters

are sorted based on their hit counts (the number of items/documents belonging to this cluster, it

stands for an importance factor).

Self-Organizing Maps (SOM)

One clustering method for detecting events in social networks is based on SOM (Pohl,

Bouchachia, & Hellwagner, 2012). SOM (see Figure 3) is a neural network dedicated to

clustering (Larose, 2005). In SOM, input data is mapped onto a lower-dimensional map

consisting of units around which clusters are built. Input vectors that are closely related in the

input space are mapped to closer map units in the output space (map) and are therefore also

closely related in the lower-dimensional map.

Page 7: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

Figure 3: SOM with a 3x3 map (resulting in 9 cluster/map units)

For the input vector representation, we used the weight vectors generated during the NLP

step, where weights are the tf-idf values of the words appearing in the documents. For

performing the clustering, we take a normalized version of the word vectors.

Clusters are described by so called codebooks which are word vectors. They represent the

prototypes of the documents' clusters. In the best case, each cluster represents one sub-event. For

transforming the created clusters into a user-readable form, the clusters are labeled. Codebooks

describing the clusters serve as labels. The first five words with the highest tf-idf in the

codebooks are the corresponding labels of the clusters. Investigations of this method based on

Flickr and YouTube data sets (see Table 1) show that the identification of sub-events is possible,

by considering only textual information (Pohl, Bouchachia, & Hellwagner, 2012).

Based on our extended NLP step, we get the following results for Oslo and UK data sets

(see Table 2 and Table 3). The tables show the composite label of each cluster. The bold words

indicate the relation to specific sub-events. In this first experiment, all fields (title, description

and tags) are of equal importance, i.e., {α=0.33, β=0.33, ɣ=0.33} (EQ).

Table 2: Oslo bombing 2011: SOM Results (EQ)

Clusters (#hits) Labels

Cluster 1 (134) terror*, attack*, killer, shoot*, camp

Cluster 2 (54) minist*, explos*, injur*, offic*, build*

Cluster 3 (33) Oslo, bomb, govern*, explos*, rock*

Cluster 4 (32) youth, camp, polic*, shoot*, peopl*

The resulting clusters show a distinction between the two events of the shooting at the

Utøya island and the bombing in the center of Oslo. Clearly, most of the information covers the

explosion in the center of Oslo, as this was in the area of a public and highly frequented city. The

shooting in contrast was more isolated and due to the instant nature of the crisis there are no

pictures/videos available directly from the attack; yet, there exist a few reports/news about the

attack.

Page 8: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

Table 3: UK riots 2011: SOM Results (EQ)

Clusters (#hits) Labels

Cluster 1 (149) riotpolic*, demo*, life, urban, polit*

Cluster 2 (135) england, birmingham, london, peopl*, uk

Cluster 3 (104) london, riot*, loot*, polic*, fire

Cluster 4 (40) london, england, loot*, riot*, Birmingham

Cluster 5 (19) loot*, london, fire, riot*, peopl*

Cluster 6 (5) riotpolic*, urban, salford, manchester, life

For the UK Riots data set, the clusters show the major hotspots (sub-events) of the crisis

with some commonalities of the cities Birmingham, London and Manchester (see Table 3).

There is also a cluster (Cluster 1) which contains common information about all affected cities.

This can be seen by analyzing other labels, which contain Manchester, Salford etc. (not shown in

the table). By increasing the number of clusters, it is possible to partition Cluster 1 into smaller

segments. The SOM clustering method shows high potential for sub-event detection.

Agglomerative Clustering (AC)

Agglomerative Clustering is one form of hierarchical clustering, that merges in each step

two similar clusters (Duda, Hart, & Stork, 2001). At the beginning, each object that has to be

clustered is regarded as an individual cluster. In our case, an object is a word vector extracted

from the metadata information related to a picture or video. At each step, the two most similar

clusters are merged into a new cluster. It is possible to stop the clustering at a certain number of

clusters. Otherwise, at the end only one cluster remains. The AC approach results in a

hierarchical tree which can be visualized in the form of a dendrogram (see Figure 4). There exist

several measures to merge clusters (center, complete-linkage, single-linkage, average, and ward-

based measures) starting from single documents (Duda, Hart, & Stork, 2001) (Ward, 1963). We

used the ward-based measure.

Figure 4: Dendrogram with five merging steps

Page 9: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

To determine the optimal number of clusters, evaluation indices can be used. These

indices describe how well separated and how compact the identified clusters are. Therefore, the

inter-cluster and intra-cluster distances are very often considered. Very popular indices are: the

Dunn index, the Davies-Bouldin index, and the Silhouette index (Theodoridis & Koutroumbas,

2006) (Rousseeuw, 1987). These indices describe how well separated and how compact the

identified clusters are (see section Indices).

The generated clusters of the AC approach highlight the crisis-related sub-events.

Applying the approach to the Oslo data set (see Table 4), the two most important sub-events are

extracted. The metadata fields are weighted with equal importance, i.e., {α=0.33, β=0.33,

ɣ=0.33} (EQ).

Figure 5(a) illustrates the corresponding metrics calculated for the Oslo data set. Based

on the metrics it can be seen that the appropriate number of clusters lies - for equal weights - at

approx. seven.

Table 4: Oslo bombing 2011: Agglomerative Clustering Results (EQ)

# Clusters Step #hits Cluster Values

1 Cluster N 253 offic*, attack*, build*, govern*, minist*

2 Clusters n-1 158 offic*, build*, govern*, attack*, minist*

95 terror*, attack*, peopl*, explos*, build*

3 Clusters n-2 136 attack*, govern*, offic*, rock*, build*

95 terror*, attack*, peopl*, explos*, build*

22 report*, build*, polic*, shoot*, offic*

4 Clusters n-3 95 terror*, attack*, peopl*, explos*, build*

80 govern*, offic*, rock*, minist*, build*

22 build*, report*, polic*, shoot*, minist*

56 attack*, shoot*, camp*, polic*, car

The UK Riots data set shows a similar behavior when the AC algorithm is applied (see

Table 5). It shows, like the SOM, the major hotspots from cities like London, Birmingham, and

Manchester in the UK. At each aggregation step, the identified sub-events become more

abstract/general. The final cluster (Cluster 1) shows which cities are affected by the riots.

COMPARISON

For the comparison of both methods, we extended the SOM implementation. After the

SOM is executed and the map is created, AC is performed based on the codebook vectors of

SOM also with the similarity method ward. This results also in a dendrogram.

Page 10: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

In the following, we call this approach Aggregated SOM. The comparison of both

methods is performed on different levels:

1. Different weight settings.

2. Quality of clustering using different indices introduced in section Agglomerative

Clustering (AC).

3. Correspondence between the results of AC and Aggregated SOM (using the Rand

index (Gordon, 1999)).

Table 5: UK riots 2011: Agglomerative Clustering Results (EQ)

# Clusters Step #hits Cluster Values

1 Cluster n 452 london, salford, birmingham, burn*, peopl*

2 Clusters n-1 303 london, birmingham, burn*, peopl*, loot*

149 salford, riotpolic*, demo*, urban, life

3 Clusters n-2 152 london, peopl*, burn*, loot*, fire

151 birmingham, london, england, manchest*, fire

149 salford, riotpolic*, demo*, urban, life

4 Clusters n-3 152 london, peopl*, burn*, loot*, fire

149 salford, riotpolic*, demo*, urban, life

107 london, manchest*, england, loot, fire

44 birmingham, london, england fire, loot*

5 Clusters n-4 149 salford, riotpolic*, demo, urban, life

116 london, burn, fire, loot, enlgand

107 london, manchest*, england, loot*, fire

44 birmingham, london, england, fire, loot

36 peopl*, loot*, burn*, london, salford

Weights

We analyzed our data sets based on different weight settings. Here, it can be observed

that the weight settings depend mainly on the nature of the crisis. In our case, long-lasting crises

show a better performance for high weights for description and title. There, people have more

time to collect information and to document it. In a sudden outbreak of a crisis, the used

metadata is not of high maturity or in the worst case misleading due to the time pressure.

This can also be observed when comparing the results of the UK and Oslo data sets.

Changing the weight settings for both data sets from equal importance to a setting {α=0.1; β=0.2;

ɣ=0.7} (NOT_EQ) shows that the Oslo data set (representing a short-term and sudden event)

Page 11: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

ends in more compact results (c.f. Table 2 and Table 7). Empirical analysis of the data sets

highlights that the title is often an enumeration (Oslo_xx) and the description, if available, is

sometimes only auxiliary. This proposed setting shows the degradation of concepts like "Oslo"

and "shoot".

As to the UK Riots data set, it can be seen that important concepts like Birmingham are

missing (see Table 6), due to the fact that these get overruled by standard tags (like UK, police,

etc.) for describing the situation. During the UK riots, people had more time to annotate

multimedia files with information. Therefore, information from title and description is important

too. The results from the UK data set with {α=0.1; β=0.2; ɣ=0.7} (NOT_EQ) show that the

concept Birmingham is missing for both methods (see Table 6 compared to Table 3 and Table 5).

The selection of the significant words/weights for representing the multimedia documents

is important for both methods, as this has a high influence on the quality of the resulting clusters.

Table 6: UK riots 2011: Aggregated SOM and AC (NOT_EQ)

Clusters (#hits) Labels

Cluster_AC (452)

london, salford, loot*, fire, manchest*, street, anarchi*, polit*, precinct,

trouble, urban, life, riotpolic*, violenc*, demo*, brydonclos, enforc*,

polic*, uk, riot*

Cluster_Agg_SOM

(452)

riotpolic*, demo*, urban, life, polit*, salford, anarchi*, brydonclos,

enforec*, precinct*, troubl*, manchest*, street, violenc*, uk, polic*, fire,

riot*, loot*, london

Indices

Indices describe the quality of a clustering result based on the assignment of documents

to clusters. We use three popular indices: Dunn, Davies-Bouldin, and Silhouette index. The

Dunn index identifies very compact clusters, as it maximizes the inter-cluster distances and

minimizes the intra-cluster distances. The larger the index, the more well-defined clusters exist.

The Davies-Bouldin index also considers the inter- and intra-cluster distance. In contrast to the

Dunn index, the Davies-Bouldin index must be minimized to yield the best number of clusters.

In the case of the Silhouette index, for each object, the membership grade to each cluster is

calculated. The Silhouette metric represents how closely related the objects in clusters are. The

highest value of the metric corresponds to the optimal number of clusters.

The performance of an index depends on the characteristics (e.g., sharp or overlapping)

of the resulting clusters. As it is difficult for high-dimensional real-world data to judge about the

characteristics, it is best to have a look at different metrics. We use the indices to find the number

of clusters offering the best cluster quality for a specific setting. The metrics do not always agree

exactly on the same number of clusters, but they give a good hint for potential intervals of cluster

numbers. Figure 5(b) and Figure 5(c) show the results for the Aggregated SOM and AC using

the Oslo data set with uneven weight settings. For AC 3 or 4 clusters are appropriate and for the

Aggregated SOM exactly 3 clusters seem to be optimal.

Page 12: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

Result Comparison

We also compare the assignment of documents to the clusters by both methods based on

a common number of clusters. For example, for the settings {α=0.1; β=0.2; ɣ=0.7} (NOT_EQ)

we compare three clusters of the Aggregated SOM and four clusters of the AC. Based on the

indices, these numbers are the most appropriate numbers of clusters (see Figure 5(b) and Figure

5(c)). The corresponding (corrected) Rand index shows that 56% of the documents are assigned

to the same clusters in both methods. So, both methods agree on 56% of the data assignments.

(a) Oslo (EQ: α =0.33, β=0.33, ɣ =0.33), AC

(b) Oslo (NOT_EQ: α=0.10, β =0.20, ɣ =0.70), AC

(c) Oslo (NOT_EQ: α =0.10, β =0.20, ɣ =0.70), Agg. SOM

Figure 5: Indices (Dunn index: Dunn; Davies-Bouldin index: DB, Silhouette index: S) for the

Oslo Bombing 2011.

Page 13: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

Comparing the clusters of the UK and Oslo data sets shows also different results (see

Table 7 and Table 8). The difference between the two similar "explos" and "eksplosjon" concepts

results from the fact that for this event different language entries in the social networks exist (as

later can be seen in Table 7). Our NLP parser recognizes only similarities on full English words.

"Jazeera" refers to the appropriate news channel, which shows posts of news concerning the

crisis.

Table 7: Oslo bombing 2011: Comparison of Clusters (NOT_EQ)

Clusters (#hits) Labels

Agg. SOM Clust. 1 (153) noruega, eksplosjon, terror*, kill*, attack*, (shoot*)

Clust. 2 (54) govern*, oslo, explos*, bomb*, jazeera

Clust. 3 (46) injur*, car, report*, peopl*, polic*

Agg. Clust. Clust. 1 (159) attack*, terror*, eksplosjon, build*, shoot*

Clust. 2 (56) offic*, govern*, jazeera, rock*, minist*

Clust. 3 (31) report*, build*, polic*, shoot*, peopl*

Clust. 4 (7) noruega*, attack*, terror*, explos*, peopl*

Table 8: UK riots 2011: Comparison of Clusters (NOT_EQ)

Clusters (#hits) Labels

Agg. SOM Clust. 1 (296) london, loot*, riot*, fire, polic*

Clust. 2 (113) riotpolic*, demo*, brydonclos*, enforce*, life

Clust. 3 (36) riotpolic*, demo*, urban, life, polit*

Clust. 4 (7) salford, precint, loot*, riot*, uk

Agg. Clust. Clust. 1 (241) london, fire, loot*, polic*, manchest*

Clust. 2 (113) salford, brydonclos, enforce, precint, toubl*

Clust. 3 (62) london, loot, fire, polic*, street

Clust. 4 (36) salford, riotpolic, demo, urban, life

The number of clusters that are compared is extracted from the indices. The comparison

illustrates also a different semantic underlying the created clusters.

The SOM algorithm adapts its codebooks representing the clusters whenever a new data

item is handled. The winning codebook (nearest to the current data point) is changed/moved near

to this data point; the loosing codebooks are moved away from it. The clustering created by

SOM is hence an abstract representation of the most common data points. With the AC

algorithm, similar cluster/data points are aggregated immediately to one cluster. The AC is

Page 14: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

therefore more prone to changes in the data. It recognizes one cluster related to the Oslo shooting

with a small margin. These data points are overruled in the SOM approach by more frequent data

sets - also with other labels - as they are more representative for the whole data. Increasing the

number of clusters for SOM also shows clusters related with the shooting. Due to the nature of

the crisis, there are only few data points available directly from the shooting.

AC requires comparing each input vector with all other vectors, hence the high time

complexity; SOM compares the input against the prototypes (codebooks) only.

Discussion

Both algorithms show promising results for event-detection based on clustering. It is

possible to identify the most common sub-events based on textual descriptions of image and

video data collected from social media platforms. SOM works more efficiently than AC and is

less sensitive to outliers in the data.

Analysis of the UK Riots data shows the most important sub-events by identifying cities

that are affected by the riots. For the Oslo data set, also the most important two hotspots are

identified: the shooting and the bombing in the center of Oslo. Beside the UK Riots and Oslo

bombing data sets we also analyzed the Mississippi and the Hurricane Irene data for sub-events.

Our findings are described only briefly due to space limitations in the following.

Due to the large-scale nature of these crises, a higher initial number of clusters for SOM

are needed. We used 20 clusters with equal weighting of the metadata fields. The application of

the SOM and AC to the Hurricane Irene data set shows also clusters concerning sub-events, like

New York, East Coast, North Carolina, Islands and power problems. As this is a huge crisis

covering many states in the USA, we also tested the effect of increasing the number of words.

We used 30 words instead of 20. Then, we additionally get concepts like New Jersey, Virginia,

Bahamas and more specific Long Island.

For the Mississippi Flood the results are similar. For one of our tests, we used 20 clusters

with equal weighting and 20 words. The results of SOM and AC show information about

Louisiana, Mississippi, Baton Rouge, Berwick, New Orleans, Vicksburg, Memphis and the

flooding via the Morganza Spillway/Atchafalaya Basin. With 30 words additional concepts are

found, like engin* and corp*, which refer to the U.S. Army Corps of Engineers, Greenville or

overflow.

The most important influencing factors for the results of the methods are the selection of

suitable representations for clustering, i.e., word vectors (selecting the significant words) for the

image and video items. In addition, to control the word selection it is possible to manipulate the

weight settings of the metadata fields. This gives the degree of freedom to steer clustering based

on the characteristics of the data.

The results and findings give a good insight into the handling of such data sets. These

experiences are used for developing the next sub-event detection steps. We use these

experiments to develop a stream processing algorithm for handling crisis-related data just-in-

time in the next step. We plan to introduce an online clustering algorithm for sub-event detection

which works on streaming data. So, arriving data has to be interlinked and synchronized from

different social media platforms for the analysis process. In addition, one important aspect is to

Page 15: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

identify outdated, new or revitalized sub-events on-the-fly, i.e., introduce a sort of remember-

and-forget mechanism.

SURVEY: STUDY WITH PRACTITIONERS

For tightening further steps in our development and research process of the Media

Exploration Framework (MEF) we conducted a survey. The goal of the survey was to give us

important insights into practitioners’ attitudes to (social) multimedia and their thoughts on an

aggregation process driven by sub-event detection as described in this paper. Hence, we

emphasize that this was a qualitative survey and not performed for quantitative purposes.

In summary, the survey should give us an indication if we are on a right way with our

research. The idea of the created questionnaire was, thus, to get a broad picture of what potential

end-users (practitioners) think about (i) the introduction of social media into the emergency

management process and (ii) the idea of sub-event detection for such a support.

Consequently, we contacted practitioners from different agencies of various European

countries. This resulted in 16 answers received from practitioners from police forces, fire

departments, paramedics, and non-governmental organizations (NGOs). The agencies are located

in Germany, Norway, UK, Austria, Ireland, and Belgium.

The whole questionnaire was sent out as a text document that comprises eight pages with

a total of fifteen questions to be filled in. Due to the wide range of the questions, we focus in this

paper only on a smaller set thereof that have a direct influence on current and future development

steps. We discuss the questions based on topics related to social media and sub-event detection.

In general, we wanted to know if social media could give the practitioners some benefits

in performing their tasks since social networks could be seen as a possibility to involve the

public in emergency management processes. Therefore we formulated the following question:

Do you think there is a benefit of using social networks in emergency management? Where do

you see any potential, for example in decision making?

Benefit - (14 participants; with multiple answers)

o Collecting/filtering/monitoring information (with correcting actions) - (9

participants)

o Informing/sharing information with public - (7 participants)

o For decision making (but not as single source of information) - (3

participants)

o Social network for emergency agencies - (1 participant)

o Social media needs to be involved somehow - (1 participant)

No benefit - (2 participants)

o No concrete statement, no clear benefits known

The answers show that the interviewed practitioners also think that there could be a

benefit in using social media during emergency management.

Page 16: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

In the questionnaire, we also describe the idea behind sub-events and the detection

process. For identifying the usefulness of the sub-event concept based on multimedia

information gathered from Flickr and YouTube (or later from first responders), we asked the

following question: Do you think that ''event detection'', i.e., the assignment of multimedia files

to specific events would help [...]? (Examples for ''events'': in one location during a bomb

explosion a bridge collapses (first event) and in another location some buildings get destroyed

(second event). [...]). Do you think such a pre-selection based on events is useful?

Useful - (12 participants)

Can be used as navigation tool through the gathered multimedia data; useful for

the upper management (not in-field); can be used to provide timeline of sub-event

occurrence; useable as background information for reconstruction, reporting,

decision making, back verification, and gaining initial information (e.g., also

before arriving at the scene).

Not useful - (3 participants)

Response management is no exact science; focus on live information during

response is relevant; not on tactical level/lower management.

Not sure - (1 participant)

No answer - (1 participant)

This indicates that the participants see some benefits, under the assumption that there is a

tool that can aggregate and treat such data in a meaningful way to prevent information overload.

We also posed one question to know where such a detection tool could be applied. The

question was: Do you think such software for analyzing the situation finds its application in a)

aftermath analysis after the disaster for analyzing and/or b) on-the-fly (continuous, automatic)

analysis during a disaster?[...]. The following answers were given:

After-math (13 participants)

On-the-fly (11 participants)

Not needed at all (1 participant)

Abstain (1 participant)

The answers show a slightly higher indication of offline methods, as also described in

this paper. But there is also a need for online methods to analyze social media on-the-fly.

We also were interested where such a tool could be applicable. Therefore, the following

question was given: Who could or should perform such a (social) media monitoring task? And

where (in-field/on-scene, command center, etc.) can this be performed?

Away from field (14 participants)

o Responsible persons of the communication team, analysis specialist (3

participants)

o Upper emergency management - strategic and tactical (4 participants)

Page 17: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

o Control center (i.e., including redirection of important information) (7

participants)

o Emergency services (1 participant)

o Specific coordinating areas (e.g., away from the scene on city or county

level) (2 participants)

In-field (2 participants)

o ''Back-office with possibilities to hand it over as in-field task'' (1

participant)

o For very specific in-scene operation/information (1 participant)

Abstain (1 participant)

The answers of the participants show the applicability of such a tool during emergency

management, most frequently in the control room.

In conclusion, the evaluation shows the tendency that there is a benefit in using social

media in emergency management. For the interviewed persons, it facilitates the involvement of

the public (also bystanders) especially when it is not possible to be on site from the very

beginning and it gives the possibility to introduce multimedia information, too.

The interviewed persons also see a benefit of using social media analysis on-the-fly

during a crisis, which we therefore want to examine next in our work. Indeed, there are

additionally studies needed to quantitatively validate the tendency of the present survey. In

addition, there is also a need to evaluate the usefulness of the results with potential end-users,

which has not been among the goals of this survey.

CONCLUSION

The evaluation of clustering algorithms shows a promising source for detecting sub-

events. These sub-events need special attention in crisis management, as they indicate specific

hotspots that need to be handled immediately. For sub-event detection, we used the metadata of

multimedia items (title, description, and tags). We proposed a simple NLP step for optimizing

the feature/word selection and we introduced a weighting mechanism for adjusting the

importance of the used metadata fields. Our experiments show that the importance of the fields

depends on the nature of the crisis.

Both methods for sub-event detection (SOM and AC) identify the most important sub-

events based on the data sets. The application to UK riots data identifies the cities that were

affected by the riots.

A survey conducted among practitioners from different European countries shows the

practical applicability of such a detection tool during emergency management. It shows that there

could be benefits when introducing social media, also due to the fact that the involvement of the

public/bystanders is in general desired by practitioners. There is also the need to have the

possibility to introduce such information on-the-fly during the emergency.

Therefore, in the future, we will investigate sub-event detection from the social media

data in real time. We also intend to further investigate static analysis (especially for aftermath

Page 18: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

crisis analysis) as the practitioners mentioned it as a useful application. Additionally, we want to

focus on the representation of sub-event detection results in a user-friendly manner.

ACKNOWLEDGMENT

The research leading to these results has received funding from the European Union Seventh

Framework Programme (FP7/2007-2013) under grant agreement n°261817 and was partly

performed in the Lakeside Labs research cluster at Alpen-Adria-Universität Klagenfurt. We

would like to thank all practitioners for their help, time, and valuable comments. Particular

thanks go to our colleagues (Lisa Wood, Ove Njå and Eivind L. Rake) of the BRIDGE project

who helped us to get and stay in contact with the practitioners.

REFERENCES

JWNL (Java WordNet Library). (2012, February). Retrieved from

http://sourceforge.net/projects/jwordnet/

Becker, H., Iter, D., Naaman, M., & Gravano, L. (2012). Identifying Content for Planned Events

Across Social Media Sites. Proceedings of the fifth ACM international conference on

Web search and data mining (S. 533-542). Seattle, USA: ACM.

Becker, H., Naaman, M., & Gravano, L. (2010). Learning Similarity Metrics for Event

Identification in Social Media. Proceedings of the third ACM international conference on

Web search and data mining (S. 291-300). NY, USA: ACM.

Becker, H., Naaman, M., & Gravano, L. (2011). Beyond Trending Topics : Real-World Event

Identification on Twitter. Proc. of the Fifth Inter. AAAI Conf. on Weblogs and Social

Media (S. 438-441). New York: AAAI.

Bergstrand, F., & Landgren, J. (2009). Information Sharing Using Live Video in Emergency

Response Work. Proceedings of the 6th International Conference on Information Systems

for Crisis Response and Management.

Duda, P., Hart, E., & Stork, D. (2001). Pattern Classification. New York: Wiley.

Fellbaum, C. (1998). WordNet: An Electronic Lexical Database. Cambridge: MIT Press.

Fontugne, R., Cho, K., Won, Y., & Fukuda, K. (2011). Disasters seen through Flickr Cameras.

Proceedings of the Special Workshop on Internet and Disasters (S. 1-10). New York,

NY, USA: ACM.

Gordon, A. D. (1999). Classification. Chapman and Hall.

Hall, M., Frank, E., Holmes, G., Pfahringer, B., Reutemann, P., & Witten, I. H. (2009). The

WEKA Data Mining Software: An Update. SIGKDD Exploration.

Page 19: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

Hiltz, S. R., van de Walle, B., & Turoff, M. (2010). The Domain of Emergency Management

Information. In B. van de Walle, M. Truoff, & S. R. Hiltz, Information Systems for

Emergency Management (S. 3-19).

Hughes, A. L., & Palen, L. (2009). Twitter Adoption and Use in Mass Convergence and

Emergency Events. ISCRAM Conference.

Lachner, J., & Hellwagner, H. (2008). Information and Communication Systems for Mobile

Emergency Response. In W. Aalst, J. Mylopoulos, N. M. Sadeh, M. J. Shaw, C.

Szyperski, R. Kaschek, . . . G. Fliedl, Information Systems and e-Business Technologies

(S. 213-224). Heidelberg: Springer Berlin.

Larose, D. T. (2005). Discovering Knowledge in Data: An Introduction to Data Mining.

Hoboken, New Jersey: John Wiley & Sons, Inc.

Liu, S., Palen, L., Sutton, J., & Hughes, A. (2008). In Search of the Bigger Picture: The

Emergent Role of On-Line Photo-Sharing in Times of Disaster. Proceedings of the

Information Systems for Crisis Response and Management Conference.

Manning, C. D., Raghavan, P., & Schütze, H. (2008). Introduction to Information Retrieval.

Cambridge University Press.

Marcus, A., Bernstein, M. S., Badar, O., Karger, D. R., Madden, S., & Miller, R. C. (2011).

Twitinfo: Aggregating and Visualizing Microblogs for Event Exploration. Proceedings of

the 2011 annual conference on Human factors in computing system (S. 227-236).

Vancouver: ACM.

Mathioudakis, M., & Koudas, N. (2010). TwitterMonitor: Trend Detection over the Twitter

Stream. Proceedings of the 2010 international conference on Management of data (S.

1155-1158). Indianapolis, USA: ACM.

Palen, L. (2008). Online Social Media in Crisis Events. EDUCAUSE Quarterly (EQ), 76-78.

Petrović, S., Osborne, M., & Lavrenko, V. (2010). Streaming First Story Detection with

Application to Twitter. The 2010 Annual Conference of the North American Chapter of

the Association for Computational Linguistics (S. 181-189). Stroudsburg, USA:

Association for Computational Linguistics.

Pohl, D., Bouchachia, A., & Hellwagner, H. (2012). Automatic Sub-Event Detection in

Emergency Management Using Social Media. In First Inter. Workshop on Social Web for

Disaster Management (SWDM), In conjunction with WWW'12. Lyon, France: ACM.

Porter, M. F. (1980). An Algorithm for Suffix Stripping. Program: Electronic Library and

Information, 130-137.

Page 20: Supporting Crisis Management via Detection of Sub-Events ...pdfs.semanticscholar.org/8e44/ecdbceadac3e471207c5c5cdf454e3a2e952.pdfSocial media platforms have a high value in crisis

Rattenbury, T., Good, N., & Naaman, M. (2007). Towards Automatic Extraction of Event and

Place Semantics from Flickr Tags. Proceedings of the 30th annual international ACM

SIGIR conference on Research and development in information retrieval (S. 103-110).

Amsterdam, The Netherlands: ACM.

Rousseeuw, P. J. (1987). Silhouettes: A Graphical Aid to the Interpretation and Validation of

Cluster Analysis. Journal on Comput. and Appl. Math., 53-65.

Theodoridis, S., & Koutroumbas, K. (2006). Pattern Recognition. Elsevier/Academic Press.

Turoff, M., Chumer, M., Walle, B. v., & Yao, X. (2004). The Design of a Dynamic Emergency

Response Management Information System (DERMIS). The Journal of Information

Technology Theory and Application (JITTA), 1-35.

Vieweg, S., Hughes, A. L., Starbird, K., & Palen, L. (2012). Microblogging During Two Natural

Hazards Events: What Twitter May Contribute to Situational Awareness. Proceedings of

the 28th International Conference on Human Factors (S. 1079-1088). Atlanta, USA:

ACM.

Ward, J. H. (1963). Hierarchical Grouping to Optimize an Objective Function. Journal of the

American Statistical Association, 236-244.

Yang, Y., Carbonell, J. G., Brown, R. D., Pierce, T., Archibald, B. T., & Liu, X. (1999).

Learning Approaches for Detecting and Tracking News Events . IEEE Intelligent

Systems, S. 32-43.

Yates, D., & Paquette, S. (2011). Emergency Knowledge Management and Social Media

Technologies: A Case Study of the 2010 Haitian Earthquake. International Journal of

Information Management, 6-13.