Supporting Crisis Management via Detection of Sub-Events in Social Networks

Daniela Pohl*, Abdelhamid Bouchachia+, Hermann Hellwagner**Institute of Information Technology, Alpen-Adria-Universität Klagenfurt, Austria

{daniela,hellwagn@itec.uni-klu.ac.at}+Smart Technology Research Center, Bournemouth University, UK

{abouchachia@bournemouth.ac.uk}

ABSTRACTSocial networks provide the opportunity to gather and share knowledge about a situation of relevance. User-generated content is getting increasingly important during crisis management. It facilitates the collaboration with citizens or involved parties from the very beginning of the crisis. The information captured in the form of images, text or videos is a valuable source of identifying sub-events of a crisis. In this study, we use metadata of images and videos collected from Flickr and YouTube to extract crisis sub-events. We investigate the suitability of clustering techniques to detect sub-events. In particular two algorithms are evaluated on several data sets related to crisis situations. The results show the high potential of the proposed approach. In addition, we validate the idea of sub-event detection for our future research based on a survey conducted among practitioners. Their responses show the potential of using social media in combination with sub-event detection during emergency management.

Keywords: Crisis Management, Sub-Event Detection, Clustering, Information Retrieval

INTRODUCTIONIn crisis management a large number of different actors work together for handling the

crisis situation (Hiltz, van de Walle, & Turoff, 2010). This collaboration would not work without knowledge sharing between the involved parties. It is essential to gather and share information during a crisis to gain several perspectives for enabling clarification and stabilization of the situation. Hence, consulting social media platforms turns out to be an interesting instrument, not only for information sharing but also for communication and collaboration, as stated in (Yates &Paquette, 2011).

There exist two aspects where social media can support crisis management. First, social media is used to involve citizens. People use existing social network platforms because they are familiar with them for documenting (standard) situations. So, they can apply these platforms in any situation they are involved in. This aspect is especially of importance if it is not possible to be at the scene from the very beginning and/or when sudden new situations emerge. Social media platforms have a high value in crisis management, given that people increasingly use social media platforms to document the situation they are engaged in (Palen, 2008). Second, social media platforms can also be used as collaboration and documentation tools for first responders, enabling knowledge sharing and information gathering. For example, during emergency response of the Haiti earthquake, social network platforms were used for collaboration (Yates & Paquette,2011). Collaboration in this paper is restricted to the spreading of information about a crisis situation by different people and via different social media infrastructures. At the practical level,

different organizations may collaborate to make use of the information collected from people and to coordinate their actions to efficiently cope with the emergency.

Therefore, the data directly collected from response teams or any sensors in the field is an important source (Lachner & Hellwagner, 2008). Independently of the origin/purpose of the used social media platforms, such information is worth using for gaining an overview of the situation. Clearly, the amount of data collected (especially for a large scale crisis) is overwhelming. Data overload (especially for unstructured data, like e-mails) is one of the most challenging problems within crisis management (Turoff, Chumer, Walle, & Yao, 2004). To help the first responders to deal with the situation at hand, automatic processing/analysis of the collected data is valuable.

In this contribution, we describe a general framework for analyzing data collected from social networks for supporting crisis management. We use in particular Flickr and YouTube information to detect sub-events (i.e., special hotspots) related to a crisis situation.

Events are often described as a whole (e.g., concerts, festivals like in (Becker, Naaman,& Gravano, 2010), or soccer games), not considering the different aspects an event has. However, events can be segmented into sub-events, describing important facets of that event. Hence, sub-events show situations which are of particular importance.

The same is true for a crisis situation. Crisis situations contain different sub-events (or mini-crises (Yates & Paquette, 2011)) on which crisis management has to focus on; e.g., at different places a crisis has different consequences. Considering an earthquake, at one place some buildings may collapse, whereas in another place a fire may break out. These sub-events need special attention in crisis management to stabilize the situation, as sub-events describe dominant threats in a crisis.

Hence, we specify an event via time and location (Yang, et al., 1999) describing the parent context in which sub-events occur. Concluding, the event describes the crisis context, like the UK riots 2011, and sub-events define more refined parts, e.g., looting in Hackney London. Thus, detecting such sub-events as soon as possible helps in efficiently managing the situation. Sub-event detection aims at identifying potential and dominant threats of a crisis.

Collaboration with those people that have information from the very beginning is vital. Therefore, the broad acceptance of social media, also in crisis situations, in the public enables this collaboration and makes the application of sub-event detection a powerful tool in the context of automatic analysis.

We study clustering techniques for their appropriateness (i.e., possibility to identify known threats of an incident) in sub-event detection which is applied for analyzing data in existing social media platforms. Based on our previous work (Pohl, Bouchachia, & Hellwagner,2012), we evaluate two different clustering techniques: Self-Organizing Maps (SOM) and Agglomerative Clustering (AC). Additionally, we evaluate our idea of sub-event detection by conducting a survey among practitioners from various fields. The survey shows if we should keep up the idea of sub-event detection as a further research direction.

This paper is structured as follows. The next section gives an overview of related work. The following section, Exploration Framework, describes our general framework for exploring and analyzing data retrieved from social networks. In Sub-Event Detection the application of clustering techniques for sub-event detection is explored. In the section Comparison, two clustering techniques are compared. Within the section Survey: Study with Practitioners the

results and conclusion of the conducted survey are presented. The last section concludes the work and shows our future investigations.

RELATED WORKMost of the research concerning social networks and crisis management concentrates on

analyzing micro-blogs, like Twitter, which is mainly used as broadcast medium (Hughes &Palen, 2009). Vieweg et al. (2012), for example, show the role of Twitter during two hazards: Red river floods and the Oklahoma grassfires in 2009. The authors extract different categories of tweets, ranging from warning messages to weather and evacuation information. The resulting categorization gives hints for automatic extraction methods.

Marcus et al. (2011) summarize events extracted from Twitter messages and visualize them for the user. The identification of events is based on finding peaks in the frequency of messages from the incoming stream. Petrović et al. (2010) focus on story detection for identifying events based on an incoming Twitter message stream. Mathioudakis and Koudas (2010) also describe a system for trend detection based on a Twitter stream. Becker et al. (2011) introduce a cluster and classification framework for the identification of events also through a Twitter stream.

Beside the textual information, the work in crisis management benefits from using visual information, like images or videos. The work of Bergstrand and Landgren (2009) show for example the importance of videos within crisis response. Liu et al. (2008) depict the importance and role of online photo sharing platforms, like Flickr, during a disaster. In this work, Flickr activities related to several disasters, e.g., London Bombings 2005 and Virginia Tech Shooting 2007, are studied. The work stresses the relevance of such platforms. Fontugne et al. (2011) exploit the behavior of users on Flicker to recognize disasters. Rattenbury et al. (2007) study the role of Flickr tags related to specific events. An algorithm is proposed which determines the relationship between tags from social media platforms and the corresponding real-word events.

Becker et al. (2012) investigate the identification of planned social events, e.g. concerts, via a query formulation problem. However, in crisis situations, it must be possible to handle unforeseen events, which cannot always be learned in advance.

Due to the importance of visual information in emergency management, we focus as a first step on social media data including videos, pictures and their associated annotations. As crises are no planned events with unique characteristics, we aim to use unsupervised approaches that do not need additional effort in labeling and preparing data.

EXPLORATION FRAMEWORKFor handling the data collected during crisis in an efficient way, we introduce a Media

Exploration Framework (MEF) (see Figure 1), which relieves users from performing a cumbersome manual browsing task. It helps in aggregating data collected from social media (or in the future directly from within the field) via sub-event detection in an offline and online manner.

Figure 1: Media Exploration Framework

The MEF analyses data from different social networks (currently Flickr and YouTube) related to a crisis. The data is collected from social media platforms through a collection mechanism based on common interfaces. The collection is performed via a simple keyword based search, c.f. interactive keyword search on Flickr. The keywords (e.g., UK riots 2011) are inputs inserted by the user. Keywords can be changed over time as the context and knowledge of a disaster could also change over time.

Through the collection mechanism different metadata fields (e.g., title, description, and tags) are retrieved from the items of the social media platforms. The resulting metadata from each image and video entry is used to perform a clustering-based sub-event detection algorithm. Currently, the user can also assign different weights to metadata fields, to support the clustering mechanism in attracting attention to more relevant fields.

The results of the clustering algorithm are subject to a prioritization mechanism in order to select the most important items based on the created clusters (e.g., based on the number of related items). For creating a user-friendly representation, the clusters get labels via a labeling mechanism (i.e., most frequent terms), which help to illustrate the related sub-events. The whole process results in a summary or situational report, describing and representing the most important sub-events to the user.

Currently, our framework supports after-the-fact analysis (offline or static analysis) of crisis-related data which is, for example, important for training toward similar occurrences in the future. In a next step, we aim at extending the framework to support just-in-time stream processing. This will facilitate real-time sub-event detection based on incoming information. The information sources are, up to now, Flickr and YouTube data, but will be extended to additional repositories, e.g., Twitter, information collected from professional first responders, or including news media archives.

SUB-EVENT DETECTIONFor sub-event detection, we analyze two different clustering approaches, namely Self-

Organizing Maps (SOM) (Larose, 2005) and Agglomerative Clustering (AC) (Duda, Hart, &Stork, 2001). In our experiments, for showing the existence of the described sub-events in crisis-related social media data, we use four data sets (see Table 1). The data sets contain data from significant crises that occurred during 2011. They are constructed via a pre-selection mechanism based on keywords to find the most relevant information from social media platforms (in our case Flickr and YouTube).

Table 1: Data sets for processing sub-event detection (Pohl, Bouchachia, & Hellwagner, 2012)

Name/Abbreviation Period Pictures / Videos

Mississippi Flood (MF) 04-19 May 2011 2039 / 442

Oslo Bombing (OB) 22 Jul. 2011 31 / 222

UK Riots (UK) 06-10 Aug. 2011 178 / 274

Hurricane Irene (HI) 20-29 Aug. 2011 455 / 700

The data sets represent illustrative data from different incidents in the year 2011. They reflect crises of different sizes, with different origins, and with a different number of related sub-events. The Oslo data set, as an example, contains two specific sub-events: the bomb explosion in Oslo and the shooting at the Utøya island. In comparison to other data sets, it has a lower number of sub-events. The Hurricane Irene and UK Riots data show impacts on several cities and states.

For the experiments, we use metadata information of videos and pictures taken from the Flickr and YouTube platforms. We consider for each media item the title, the description and the tags associated with this item. We do not use data describing the time when a picture was taken or geo-referenced data, since this information is rarely available on the Flickr and YouTube platforms.

Our experiments with the social network data show that metadata fields are not of equal importance. Therefore, the suggested framework supports a weighting mechanism for those fields. The constraint for the weights α, β and ɣ is expressed in Equation Error: Reference sourcenot found. We tried different settings for performing our social media analysis (see section Comparison).

α title+βdescr+ɣ tags=1 (1)

For both event detection methods, an appropriate representation of the items (documents) that have to be clustered must be found and therefore a suitable Natural Language Processing (NLP) step is needed. We use term frequency-inverse document frequency (tf-idf) (Manning, Raghavan, & Schütze, 2008) for indexing the items collected. This results in a set of word-value pairs for each document, called word vector. Irrelevant words are removed using a

stopword list. For NLP we used mainly the WEKA (Hall, et al., 2009) framework with some additional extensions (see Figure 2) to build the word vectors.

Figure 2: From multimedia metadata to tf-idf vector space model

First, for NLP we integrated the Porter Stemmer (Porter, 1980) as it is one of the most common algorithms. Second, we performed an initial semantic analysis. During our previous work (Pohl, Bouchachia, & Hellwagner, 2012) we recognized the importance of a semantic analysis to handle similar words (like demo, demonstration) in creating a text representation for the clustering approach. Hence, we extended the pre-processing step by introducing an initial semantic analysis based on WordNet for the English language (Fellbaum, 1998). Similar or closely related concepts are grouped together and treated as one stem (e.g., car, automobile; riot, rioter).

In this processing step, we considered different relationships between nouns and verbs extracted from the metadata, such as synonyms and derivated-from using WordNet. For integrating them into our Java-based application, we used the JWNL Java API (JWNL (JavaWordNet Library), 2012).

A third extension deals with explicit weighting of the fields. As mentioned earlier, in addition to the tf-idf weighting method, we promote and denote the resulting weights by rescaling using α, β and ɣ. Such scaling allows controlling the contribution of the words depending on their positions in the document.

For event-detection, we analyze the data using two different approaches. Due to space limitation, we focus in the following on two data sets, namely UK Riots and Oslo Bombing. In the section Discussion, we also give insights into the other data sets. Words followed by * are written in their stem form. Bold words in cluster labels are related to a sub-event. The clusters are sorted based on their hit counts (the number of items/documents belonging to this cluster, it stands for an importance factor).

Self-Organizing Maps (SOM)

One clustering method for detecting events in social networks is based on SOM (Pohl,Bouchachia, & Hellwagner, 2012). SOM (see Figure 3) is a neural network dedicated to clustering (Larose, 2005). In SOM, input data is mapped onto a lower-dimensional map consisting of units around which clusters are built. Input vectors that are closely related in the input space are mapped to closer map units in the output space (map) and are therefore also closely related in the lower-dimensional map.

Figure 3: SOM with a 3x3 map (resulting in 9 cluster/map units)

For the input vector representation, we used the weight vectors generated during the NLP step, where weights are the tf-idf values of the words appearing in the documents. For performing the clustering, we take a normalized version of the word vectors.

Clusters are described by so called codebooks which are word vectors. They represent the prototypes of the documents' clusters. In the best case, each cluster represents one sub-event. For transforming the created clusters into a user-readable form, the clusters are labeled. Codebooks describing the clusters serve as labels. The first five words with the highest tf-idf in the codebooks are the corresponding labels of the clusters. Investigations of this method based on Flickr and YouTube data sets (see Table 1) show that the identification of sub-events is possible, by considering only textual information (Pohl, Bouchachia, & Hellwagner, 2012).

Based on our extended NLP step, we get the following results for Oslo and UK data sets (see Table 2 and Table 3). The tables show the composite label of each cluster. The bold words indicate the relation to specific sub-events. In this first experiment, all fields (title, description and tags) are of equal importance, i.e., {α=0.33, β=0.33, ɣ=0.33} (EQ).

Table 2: Oslo bombing 2011: SOM Results (EQ)

Clusters (#hits) Labels

Cluster 1 (134) terror*, attack*, killer, shoot*, camp

Cluster 2 (54) minist*, explos*, injur*, offic*, build*

Cluster 3 (33) Oslo, bomb, govern*, explos*, rock*

Cluster 4 (32) youth, camp, polic*, shoot*, peopl*

The resulting clusters show a distinction between the two events of the shooting at the Utøya island and the bombing in the center of Oslo. Clearly, most of the information covers the explosion in the center of Oslo, as this was in the area of a public and highly frequented city. The shooting in contrast was more isolated and due to the instant nature of the crisis there are no pictures/videos available directly from the attack; yet, there exist a few reports/news about the attack.

Table 3: UK riots 2011: SOM Results (EQ)

Clusters (#hits) Labels

Cluster 1 (149) riotpolic*, demo*, life, urban, polit*

Cluster 2 (135) england, birmingham, london, peopl*, uk

Cluster 3 (104) london, riot*, loot*, polic*, fire

Cluster 4 (40) london, england, loot*, riot*, Birmingham

Cluster 5 (19) loot*, london, fire, riot*, peopl*

Cluster 6 (5) riotpolic*, urban, salford, manchester, life

For the UK Riots data set, the clusters show the major hotspots (sub-events) of the crisis with some commonalities of the cities Birmingham, London and Manchester (see Table 3). There is also a cluster (Cluster 1) which contains common information about all affected cities. This can be seen by analyzing other labels, which contain Manchester, Salford etc. (not shown in the table). By increasing the number of clusters, it is possible to partition Cluster 1 into smaller segments. The SOM clustering method shows high potential for sub-event detection.

Agglomerative Clustering (AC)

Agglomerative Clustering is one form of hierarchical clustering, that merges in each step two similar clusters (Duda, Hart, & Stork, 2001). At the beginning, each object that has to be clustered is regarded as an individual cluster. In our case, an object is a word vector extracted from the metadata information related to a picture or video. At each step, the two most similar clusters are merged into a new cluster. It is possible to stop the clustering at a certain number of clusters. Otherwise, at the end only one cluster remains. The AC approach results in a hierarchical tree which can be visualized in the form of a dendrogram (see Figure 4). There exist several measures to merge clusters (center, complete-linkage, single-linkage, average, and ward-based measures) starting from single documents (Duda, Hart, & Stork, 2001) (Ward, 1963). We used the ward-based measure.

Figure 4: Dendrogram with five merging steps

To determine the optimal number of clusters, evaluation indices can be used. These indices describe how well separated and how compact the identified clusters are. Therefore, the inter-cluster and intra-cluster distances are very often considered. Very popular indices are: the Dunn index, the Davies-Bouldin index, and the Silhouette index (Theodoridis & Koutroumbas,2006) (Rousseeuw, 1987). These indices describe how well separated and how compact the identified clusters are (see section Indices).

The generated clusters of the AC approach highlight the crisis-related sub-events. Applying the approach to the Oslo data set (see Table 4), the two most important sub-events are extracted. The metadata fields are weighted with equal importance, i.e., {α=0.33, β=0.33, ɣ=0.33} (EQ).

Figure 5(a) illustrates the corresponding metrics calculated for the Oslo data set. Based on the metrics it can be seen that the appropriate number of clusters lies - for equal weights - at approx. seven.

Table 4: Oslo bombing 2011: Agglomerative Clustering Results (EQ)

# Clusters Step #hits Cluster Values

1 Cluster N 253 offic*, attack*, build*, govern*, minist*

2 Clusters n-1 158 offic*, build*, govern*, attack*, minist*

95 terror*, attack*, peopl*, explos*, build*

3 Clusters n-2 136 attack*, govern*, offic*, rock*, build*

95 terror*, attack*, peopl*, explos*, build*

22 report*, build*, polic*, shoot*, offic*

4 Clusters n-3 95 terror*, attack*, peopl*, explos*, build*

80 govern*, offic*, rock*, minist*, build*

22 build*, report*, polic*, shoot*, minist*

56 attack*, shoot*, camp*, polic*, car

The UK Riots data set shows a similar behavior when the AC algorithm is applied (see Table 5). It shows, like the SOM, the major hotspots from cities like London, Birmingham, and Manchester in the UK. At each aggregation step, the identified sub-events become more abstract/general. The final cluster (Cluster 1) shows which cities are affected by the riots.

COMPARISONFor the comparison of both methods, we extended the SOM implementation. After the

SOM is executed and the map is created, AC is performed based on the codebook vectors of SOM also with the similarity method ward. This results also in a dendrogram.

In the following, we call this approach Aggregated SOM. The comparison of both methods is performed on different levels:

1. Different weight settings.

2. Quality of clustering using different indices introduced in section Agglomerative Clustering (AC).

3. Correspondence between the results of AC and Aggregated SOM (using the Rand index (Gordon, 1999)).

Table 5: UK riots 2011: Agglomerative Clustering Results (EQ)

# Clusters Step #hits Cluster Values

1 Cluster n 452 london, salford, birmingham, burn*, peopl*

2 Clusters n-1 303 london, birmingham, burn*, peopl*, loot*

149 salford, riotpolic*, demo*, urban, life

3 Clusters n-2 152 london, peopl*, burn*, loot*, fire

151 birmingham, london, england, manchest*, fire

149 salford, riotpolic*, demo*, urban, life

4 Clusters n-3 152 london, peopl*, burn*, loot*, fire

149 salford, riotpolic*, demo*, urban, life

107 london, manchest*, england, loot, fire

44 birmingham, london, england fire, loot*

5 Clusters n-4 149 salford, riotpolic*, demo, urban, life

116 london, burn, fire, loot, enlgand

107 london, manchest*, england, loot*, fire

44 birmingham, london, england, fire, loot

36 peopl*, loot*, burn*, london, salford

Weights

We analyzed our data sets based on different weight settings. Here, it can be observed that the weight settings depend mainly on the nature of the crisis. In our case, long-lasting crises show a better performance for high weights for description and title. There, people have more time to collect information and to document it. In a sudden outbreak of a crisis, the used metadata is not of high maturity or in the worst case misleading due to the time pressure.

This can also be observed when comparing the results of the UK and Oslo data sets. Changing the weight settings for both data sets from equal importance to a setting {α=0.1; β=0.2; ɣ=0.7} (NOT_EQ) shows that the Oslo data set (representing a short-term and sudden event)

ends in more compact results (c.f. Table 2 and Table 7). Empirical analysis of the data sets highlights that the title is often an enumeration (Oslo_xx) and the description, if available, is sometimes only auxiliary. This proposed setting shows the degradation of concepts like "Oslo" and "shoot".

As to the UK Riots data set, it can be seen that important concepts like Birmingham are missing (see Table 6), due to the fact that these get overruled by standard tags (like UK, police, etc.) for describing the situation. During the UK riots, people had more time to annotate multimedia files with information. Therefore, information from title and description is important too. The results from the UK data set with {α=0.1; β=0.2; ɣ=0.7} (NOT_EQ) show that the concept Birmingham is missing for both methods (see Table 6 compared to Table 3 and Table 5).

The selection of the significant words/weights for representing the multimedia documents is important for both methods, as this has a high influence on the quality of the resulting clusters.

Table 6: UK riots 2011: Aggregated SOM and AC (NOT_EQ)

Clusters (#hits) Labels

Cluster_AC (452)london, salford, loot*, fire, manchest*, street, anarchi*, polit*, precinct, trouble, urban, life, riotpolic*, violenc*, demo*, brydonclos, enforc*, polic*, uk, riot*

Cluster_Agg_SOM (452)

riotpolic*, demo*, urban, life, polit*, salford, anarchi*, brydonclos, enforec*, precinct*, troubl*, manchest*, street, violenc*, uk, polic*, fire, riot*, loot*, london

Indices

Indices describe the quality of a clustering result based on the assignment of documents to clusters. We use three popular indices: Dunn, Davies-Bouldin, and Silhouette index. The Dunn index identifies very compact clusters, as it maximizes the inter-cluster distances and minimizes the intra-cluster distances. The larger the index, the more well-defined clusters exist. The Davies-Bouldin index also considers the inter- and intra-cluster distance. In contrast to the Dunn index, the Davies-Bouldin index must be minimized to yield the best number of clusters. In the case of the Silhouette index, for each object, the membership grade to each cluster is calculated. The Silhouette metric represents how closely related the objects in clusters are. The highest value of the metric corresponds to the optimal number of clusters.

The performance of an index depends on the characteristics (e.g., sharp or overlapping) of the resulting clusters. As it is difficult for high-dimensional real-world data to judge about the characteristics, it is best to have a look at different metrics. We use the indices to find the number of clusters offering the best cluster quality for a specific setting. The metrics do not always agree exactly on the same number of clusters, but they give a good hint for potential intervals of cluster numbers. Figure 5(b) and Figure 5(c) show the results for the Aggregated SOM and AC using the Oslo data set with uneven weight settings. For AC 3 or 4 clusters are appropriate and for the Aggregated SOM exactly 3 clusters seem to be optimal.

Result Comparison

We also compare the assignment of documents to the clusters by both methods based on a common number of clusters. For example, for the settings {α=0.1; β=0.2; ɣ=0.7} (NOT_EQ) we compare three clusters of the Aggregated SOM and four clusters of the AC. Based on the indices, these numbers are the most appropriate numbers of clusters (see Figure 5(b) and Figure5(c)). The corresponding (corrected) Rand index shows that 56% of the documents are assigned to the same clusters in both methods. So, both methods agree on 56% of the data assignments.

(a) Oslo (EQ: α =0.33, β=0.33, ɣ =0.33), AC

(b) Oslo (NOT_EQ: α=0.10, β =0.20, ɣ =0.70), AC

(c) Oslo (NOT_EQ: α =0.10, β =0.20, ɣ =0.70), Agg. SOM

Figure 5: Indices (Dunn index: Dunn; Davies-Bouldin index: DB, Silhouette index: S) for the Oslo Bombing 2011.

Comparing the clusters of the UK and Oslo data sets shows also different results (see Table 7 and Table 8). The difference between the two similar "explos" and "eksplosjon" concepts results from the fact that for this event different language entries in the social networks exist (as later can be seen in Table 7). Our NLP parser recognizes only similarities on full English words. "Jazeera" refers to the appropriate news channel, which shows posts of news concerning the crisis.

Table 7: Oslo bombing 2011: Comparison of Clusters (NOT_EQ)

Clusters (#hits) Labels

Agg. SOM Clust. 1 (153) noruega, eksplosjon, terror*, kill*, attack*, (shoot*)

Clust. 2 (54) govern*, oslo, explos*, bomb*, jazeera

Clust. 3 (46) injur*, car, report*, peopl*, polic*

Agg. Clust. Clust. 1 (159) attack*, terror*, eksplosjon, build*, shoot*

Clust. 2 (56) offic*, govern*, jazeera, rock*, minist*

Clust. 3 (31) report*, build*, polic*, shoot*, peopl*

Clust. 4 (7) noruega*, attack*, terror*, explos*, peopl*

Table 8: UK riots 2011: Comparison of Clusters (NOT_EQ)

Clusters (#hits) Labels

Agg. SOM Clust. 1 (296) london, loot*, riot*, fire, polic*

Clust. 2 (113) riotpolic*, demo*, brydonclos*, enforce*, life

Clust. 3 (36) riotpolic*, demo*, urban, life, polit*

Clust. 4 (7) salford, precint, loot*, riot*, uk

Agg. Clust. Clust. 1 (241) london, fire, loot*, polic*, manchest*

Clust. 2 (113) salford, brydonclos, enforce, precint, toubl*

Clust. 3 (62) london, loot, fire, polic*, street

Clust. 4 (36) salford, riotpolic, demo, urban, life

The number of clusters that are compared is extracted from the indices. The comparison illustrates also a different semantic underlying the created clusters.

The SOM algorithm adapts its codebooks representing the clusters whenever a new data item is handled. The winning codebook (nearest to the current data point) is changed/moved near to this data point; the loosing codebooks are moved away from it. The clustering created by SOM is hence an abstract representation of the most common data points. With the AC algorithm, similar cluster/data points are aggregated immediately to one cluster. The AC is

therefore more prone to changes in the data. It recognizes one cluster related to the Oslo shooting with a small margin. These data points are overruled in the SOM approach by more frequent data sets - also with other labels - as they are more representative for the whole data. Increasing the number of clusters for SOM also shows clusters related with the shooting. Due to the nature of the crisis, there are only few data points available directly from the shooting.

AC requires comparing each input vector with all other vectors, hence the high time complexity; SOM compares the input against the prototypes (codebooks) only.

Discussion

Both algorithms show promising results for event-detection based on clustering. It is possible to identify the most common sub-events based on textual descriptions of image and video data collected from social media platforms. SOM works more efficiently than AC and is less sensitive to outliers in the data.

Analysis of the UK Riots data shows the most important sub-events by identifying cities that are affected by the riots. For the Oslo data set, also the most important two hotspots are identified: the shooting and the bombing in the center of Oslo. Beside the UK Riots and Oslo bombing data sets we also analyzed the Mississippi and the Hurricane Irene data for sub-events. Our findings are described only briefly due to space limitations in the following.

Due to the large-scale nature of these crises, a higher initial number of clusters for SOM are needed. We used 20 clusters with equal weighting of the metadata fields. The application of the SOM and AC to the Hurricane Irene data set shows also clusters concerning sub-events, like New York, East Coast, North Carolina, Islands and power problems. As this is a huge crisis covering many states in the USA, we also tested the effect of increasing the number of words. We used 30 words instead of 20. Then, we additionally get concepts like New Jersey, Virginia, Bahamas and more specific Long Island.

For the Mississippi Flood the results are similar. For one of our tests, we used 20 clusters with equal weighting and 20 words. The results of SOM and AC show information about Louisiana, Mississippi, Baton Rouge, Berwick, New Orleans, Vicksburg, Memphis and the flooding via the Morganza Spillway/Atchafalaya Basin. With 30 words additional concepts are found, like engin* and corp*, which refer to the U.S. Army Corps of Engineers, Greenville or overflow.

The most important influencing factors for the results of the methods are the selection of suitable representations for clustering, i.e., word vectors (selecting the significant words) for the image and video items. In addition, to control the word selection it is possible to manipulate the weight settings of the metadata fields. This gives the degree of freedom to steer clustering based on the characteristics of the data.

The results and findings give a good insight into the handling of such data sets. These experiences are used for developing the next sub-event detection steps. We use these experiments to develop a stream processing algorithm for handling crisis-related data just-in-time in the next step. We plan to introduce an online clustering algorithm for sub-event detection which works on streaming data. So, arriving data has to be interlinked and synchronized from different social media platforms for the analysis process. In addition, one important aspect is to

identify outdated, new or revitalized sub-events on-the-fly, i.e., introduce a sort of remember-and-forget mechanism.

SURVEY: STUDY WITH PRACTITIONERSFor tightening further steps in our development and research process of the Media

Exploration Framework (MEF) we conducted a survey. The goal of the survey was to give us important insights into practitioners’ attitudes to (social) multimedia and their thoughts on an aggregation process driven by sub-event detection as described in this paper. Hence, we emphasize that this was a qualitative survey and not performed for quantitative purposes.

In summary, the survey should give us an indication if we are on a right way with our research. The idea of the created questionnaire was, thus, to get a broad picture of what potential end-users (practitioners) think about (i) the introduction of social media into the emergency management process and (ii) the idea of sub-event detection for such a support.

Consequently, we contacted practitioners from different agencies of various European countries. This resulted in 16 answers received from practitioners from police forces, fire departments, paramedics, and non-governmental organizations (NGOs). The agencies are located in Germany, Norway, UK, Austria, Ireland, and Belgium.

The whole questionnaire was sent out as a text document that comprises eight pages with a total of fifteen questions to be filled in. Due to the wide range of the questions, we focus in this paper only on a smaller set thereof that have a direct influence on current and future development steps. We discuss the questions based on topics related to social media and sub-event detection.

In general, we wanted to know if social media could give the practitioners some benefits in performing their tasks since social networks could be seen as a possibility to involve the public in emergency management processes. Therefore we formulated the following question: Do you think there is a benefit of using social networks in emergency management? Where do you see any potential, for example in decision making?

Benefit - (14 participants; with multiple answers)

o Collecting/filtering/monitoring information (with correcting actions) - (9 participants)

o Informing/sharing information with public - (7 participants)

o For decision making (but not as single source of information) - (3 participants)

o Social network for emergency agencies - (1 participant)

o Social media needs to be involved somehow - (1 participant)

No benefit - (2 participants)

o No concrete statement, no clear benefits known

The answers show that the interviewed practitioners also think that there could be a benefit in using social media during emergency management.

In the questionnaire, we also describe the idea behind sub-events and the detection process. For identifying the usefulness of the sub-event concept based on multimedia information gathered from Flickr and YouTube (or later from first responders), we asked the following question: Do you think that ''event detection'', i.e., the assignment of multimedia files to specific events would help [...]? (Examples for ''events'': in one location during a bomb explosion a bridge collapses (first event) and in another location some buildings get destroyed (second event). [...]). Do you think such a pre-selection based on events is useful?

Useful - (12 participants)

Can be used as navigation tool through the gathered multimedia data; useful for the upper management (not in-field); can be used to provide timeline of sub-event occurrence; useable as background information for reconstruction, reporting, decision making, back verification, and gaining initial information (e.g., also before arriving at the scene).

Not useful - (3 participants)

Response management is no exact science; focus on live information during response is relevant; not on tactical level/lower management.

Not sure - (1 participant)

No answer - (1 participant)

This indicates that the participants see some benefits, under the assumption that there is a tool that can aggregate and treat such data in a meaningful way to prevent information overload.

We also posed one question to know where such a detection tool could be applied. The question was: Do you think such software for analyzing the situation finds its application in a) aftermath analysis after the disaster for analyzing and/or b) on-the-fly (continuous, automatic) analysis during a disaster?[...]. The following answers were given:

After-math (13 participants)

On-the-fly (11 participants)

Not needed at all (1 participant)

Abstain (1 participant)

The answers show a slightly higher indication of offline methods, as also described in this paper. But there is also a need for online methods to analyze social media on-the-fly.

We also were interested where such a tool could be applicable. Therefore, the following question was given: Who could or should perform such a (social) media monitoring task? And where (in-field/on-scene, command center, etc.) can this be performed?

Away from field (14 participants)

o Responsible persons of the communication team, analysis specialist (3 participants)

o Upper emergency management - strategic and tactical (4 participants)

o Control center (i.e., including redirection of important information) (7 participants)

o Emergency services (1 participant)

o Specific coordinating areas (e.g., away from the scene on city or county level) (2 participants)

In-field (2 participants)

o ''Back-office with possibilities to hand it over as in-field task'' (1 participant)

o For very specific in-scene operation/information (1 participant)

Abstain (1 participant)

The answers of the participants show the applicability of such a tool during emergency management, most frequently in the control room.

In conclusion, the evaluation shows the tendency that there is a benefit in using social media in emergency management. For the interviewed persons, it facilitates the involvement of the public (also bystanders) especially when it is not possible to be on site from the very beginning and it gives the possibility to introduce multimedia information, too.

The interviewed persons also see a benefit of using social media analysis on-the-fly during a crisis, which we therefore want to examine next in our work. Indeed, there are additionally studies needed to quantitatively validate the tendency of the present survey. In addition, there is also a need to evaluate the usefulness of the results with potential end-users, which has not been among the goals of this survey.

CONCLUSIONThe evaluation of clustering algorithms shows a promising source for detecting sub-

events. These sub-events need special attention in crisis management, as they indicate specific hotspots that need to be handled immediately. For sub-event detection, we used the metadata of multimedia items (title, description, and tags). We proposed a simple NLP step for optimizing the feature/word selection and we introduced a weighting mechanism for adjusting the importance of the used metadata fields. Our experiments show that the importance of the fields depends on the nature of the crisis.

Both methods for sub-event detection (SOM and AC) identify the most important sub-events based on the data sets. The application to UK riots data identifies the cities that were affected by the riots.

A survey conducted among practitioners from different European countries shows the practical applicability of such a detection tool during emergency management. It shows that there could be benefits when introducing social media, also due to the fact that the involvement of the public/bystanders is in general desired by practitioners. There is also the need to have the possibility to introduce such information on-the-fly during the emergency.

Therefore, in the future, we will investigate sub-event detection from the social media data in real time. We also intend to further investigate static analysis (especially for aftermath

crisis analysis) as the practitioners mentioned it as a useful application. Additionally, we want to focus on the representation of sub-event detection results in a user-friendly manner.

ACKNOWLEDGMENT

The research leading to these results has received funding from the European Union Seventh Framework Programme (FP7/2007-2013) under grant agreement n°261817 and was partly performed in the Lakeside Labs research cluster at Alpen-Adria-Universität Klagenfurt. We would like to thank all practitioners for their help, time, and valuable comments. Particular thanks go to our colleagues (Lisa Wood, Ove Njå and Eivind L. Rake) of the BRIDGE project who helped us to get and stay in contact with the practitioners.

REFERENCES

JWNL (Java WordNet Library). (2012, February). Retrieved from http://sourceforge.net/projects/jwordnet/

Becker, H., Iter, D., Naaman, M., & Gravano, L. (2012). Identifying Content for Planned Events Across Social Media Sites. Proceedings of the fifth ACM international conference on Web search and data mining (S. 533-542). Seattle, USA: ACM.

Becker, H., Naaman, M., & Gravano, L. (2010). Learning Similarity Metrics for Event Identification in Social Media. Proceedings of the third ACM international conference on Web search and data mining (S. 291-300). NY, USA: ACM.

Becker, H., Naaman, M., & Gravano, L. (2011). Beyond Trending Topics : Real-World Event Identification on Twitter. Proc. of the Fifth Inter. AAAI Conf. on Weblogs and Social Media (S. 438-441). New York: AAAI.

Bergstrand, F., & Landgren, J. (2009). Information Sharing Using Live Video in Emergency Response Work. Proceedings of the 6th International Conference on Information Systems for Crisis Response and Management.

Duda, P., Hart, E., & Stork, D. (2001). Pattern Classification. New York: Wiley.

Fellbaum, C. (1998). WordNet: An Electronic Lexical Database. Cambridge: MIT Press.

Fontugne, R., Cho, K., Won, Y., & Fukuda, K. (2011). Disasters seen through Flickr Cameras. Proceedings of the Special Workshop on Internet and Disasters (S. 1-10). New York, NY, USA: ACM.

Gordon, A. D. (1999). Classification. Chapman and Hall.

Hall, M., Frank, E., Holmes, G., Pfahringer, B., Reutemann, P., & Witten, I. H. (2009). The WEKA Data Mining Software: An Update. SIGKDD Exploration.

Hiltz, S. R., van de Walle, B., & Turoff, M. (2010). The Domain of Emergency Management Information. In B. van de Walle, M. Truoff, & S. R. Hiltz, Information Systems for Emergency Management (S. 3-19).

Hughes, A. L., & Palen, L. (2009). Twitter Adoption and Use in Mass Convergence and Emergency Events. ISCRAM Conference.

Lachner, J., & Hellwagner, H. (2008). Information and Communication Systems for Mobile Emergency Response. In W. Aalst, J. Mylopoulos, N. M. Sadeh, M. J. Shaw, C. Szyperski, R. Kaschek, . . . G. Fliedl, Information Systems and e-Business Technologies (S. 213-224). Heidelberg: Springer Berlin.

Larose, D. T. (2005). Discovering Knowledge in Data: An Introduction to Data Mining. Hoboken, New Jersey: John Wiley & Sons, Inc.

Liu, S., Palen, L., Sutton, J., & Hughes, A. (2008). In Search of the Bigger Picture: The Emergent Role of On-Line Photo-Sharing in Times of Disaster. Proceedings of the Information Systems for Crisis Response and Management Conference.

Manning, C. D., Raghavan, P., & Schütze, H. (2008). Introduction to Information Retrieval. Cambridge University Press.

Marcus, A., Bernstein, M. S., Badar, O., Karger, D. R., Madden, S., & Miller, R. C. (2011). Twitinfo: Aggregating and Visualizing Microblogs for Event Exploration. Proceedings of the 2011 annual conference on Human factors in computing system (S. 227-236). Vancouver: ACM.

Mathioudakis, M., & Koudas, N. (2010). TwitterMonitor: Trend Detection over the Twitter Stream. Proceedings of the 2010 international conference on Management of data (S. 1155-1158). Indianapolis, USA: ACM.

Palen, L. (2008). Online Social Media in Crisis Events. EDUCAUSE Quarterly (EQ), 76-78.

Petrović, S., Osborne, M., & Lavrenko, V. (2010). Streaming First Story Detection with Application to Twitter. The 2010 Annual Conference of the North American Chapter of the Association for Computational Linguistics (S. 181-189). Stroudsburg, USA: Association for Computational Linguistics.

Pohl, D., Bouchachia, A., & Hellwagner, H. (2012). Automatic Sub-Event Detection in Emergency Management Using Social Media. In First Inter. Workshop on Social Web for Disaster Management (SWDM), In conjunction with WWW'12. Lyon, France: ACM.

Porter, M. F. (1980). An Algorithm for Suffix Stripping. Program: Electronic Library and Information, 130-137.

Rattenbury, T., Good, N., & Naaman, M. (2007). Towards Automatic Extraction of Event and Place Semantics from Flickr Tags. Proceedings of the 30th annual international ACM SIGIR conference on Research and development in information retrieval (S. 103-110). Amsterdam, The Netherlands: ACM.

Rousseeuw, P. J. (1987). Silhouettes: A Graphical Aid to the Interpretation and Validation of Cluster Analysis. Journal on Comput. and Appl. Math., 53-65.

Theodoridis, S., & Koutroumbas, K. (2006). Pattern Recognition. Elsevier/Academic Press.

Turoff, M., Chumer, M., Walle, B. v., & Yao, X. (2004). The Design of a Dynamic Emergency Response Management Information System (DERMIS). The Journal of Information Technology Theory and Application (JITTA), 1-35.

Vieweg, S., Hughes, A. L., Starbird, K., & Palen, L. (2012). Microblogging During Two Natural Hazards Events: What Twitter May Contribute to Situational Awareness. Proceedings of the 28th International Conference on Human Factors (S. 1079-1088). Atlanta, USA: ACM.

Ward, J. H. (1963). Hierarchical Grouping to Optimize an Objective Function. Journal of the American Statistical Association, 236-244.

Yang, Y., Carbonell, J. G., Brown, R. D., Pierce, T., Archibald, B. T., & Liu, X. (1999). Learning Approaches for Detecting and Tracking News Events . IEEE Intelligent Systems, S. 32-43.

Yates, D., & Paquette, S. (2011). Emergency Knowledge Management and Social Media Technologies: A Case Study of the 2010 Haitian Earthquake. International Journal of Information Management, 6-13.