Enhancing monitoring of suspicious activities with AI-based and big data fusion

Designing the big data infrastructure

The proposed system topology in this scholarly article, as depicted in Fig. 2, is driven by the VMware ESX server (Desai et al., 2013), serving as a virtual machine server. It includes a Web server, an Airflow server and a database server, all functioning on an Ubuntu server (LaCroix, 2018). These elements collaborate utilizing Apache Airflow (Harenslak & De Ruiter, 2021) as a data pipeline for the extract-transform-load (ETL) process, which involves extracting data from the API and transferring it to the database server for processing by the web server. While the system stores data as Big Data in the database for presentation on the web application, the careful selection of a suitable database server holds significant importance.

This research utilizes Apache Hive (Bansal, Chawla & Kurle, 2019) as the server of databases. Figure 3 illustrates the essential components of the Apache Hive and Apache Hadoop architecture, which include the Metastore responsible for storing partition metadata to facilitate data verification across the entire group. Metadata and relational databases are used to store the data to ensure replication tracking and provide backups in case of data loss. The driver component oversees and monitors the progress of operations, accepting commands and storing generated metadata during the execution of HiveQL commands. After the MapReduce process is finished, the driver collects the data and initiates queries to obtain the results. The compiler then converts the command and the executor sends the HiveQL command to the MapReduce executor, enabling data processing. The Optimizer Executor communicates with Apache Hive to schedule instructions for execution in the future. Lastly, the UI, CLI and Thrift servers provide users with the capability to manage Hive through various means, such as the user interface (UI), command line (CLI), or Thrift.

Training the model for suspicious activities

Importing data from a data warehouse, which contains access databases that record the positions of humans, vehicles and items, are required for training the model. A feature-extracting approach is used to transform these datasets into feature vectors and experts assign labels such as “suspicious” and “normal” (Table 1).

The data is separated into three sets: training, validation and testing. Figure 4 depicts the training processes used in this investigation. Data pipelines are used in the system to train automated models that extract data from many sources, analyze it and store it in a database. Apache Airflow is used to build a Python-based (Shein, 2015) data pipeline with job sequencing and scheduling. In this study, five pipelines are employed to train the automated model every day at midnight, as shown in Fig. 5.

Classification of suspicious activities

Figure 6 depicts a schematic showing the classification of suspicious people, vehicles and objects. The feature extraction procedure, like the feature extraction approach used during training begins with the entrance and exit data of individuals, cars and items.

The newly collected data is then loaded into a machine-learning classifier that employs the pre-trained suspicion model. This study employs five processes to obtain categorization results at midnight each day (Fig. 7). The grouping results are recorded in a stored procedure table and then shown on the web interface.

Web application UI design

The online suspect-detecting method for monitoring agency security is developed based on the requirements gathered from the Thailand Ministry of Defense, allowing authorized users to access and review suspicious data through the web application. This includes the role of reporters responsible for recording the transit of cars, items and persons inside the department. Laptops, tablets and handheld devices could all access the system.

The system’s use case diagram, depicted in Fig. 8, showcases its division into two main groups: regular users and administrators. Before to accessing the system, users are required to log in. General users are granted access to statistics concerning objects, individuals and vehicles, presented in the form of charts, statistical tables and maps. Moreover, data can be downloaded in Excel format. The system provides filtering options based on location, time and object, vehicle, or person types. On the other hand, administrators possess the same viewing capabilities as regular users, but they also enjoy additional privileges, including the ability to add, edit, or delete regular user accounts.

Performance evaluation of suspicious identification

We conducted experiments in this study to evaluate the performance of two dissimilar systems, MySQL and Apache Hive, in managing massive data for suspicious detection purposes. To conduct the experiment, we created a virtual machine using ESXI vSphere that ran the Ubuntu Server 20.04 OS and had 4 GB of memory. Hadoop 3.3.1  (Holmes, 2014) and MySQL 5.7 (Widenius, Axmark & Arno, 2002) were used as software. The data for the experiment varied from 10,000 to 5,000,000 records and was received in CSV format from the online Excel BI dataset (Excel BI Analytics, 2023). The experiment’s major purpose was to assess the processing speed and power of different technologies when dealing with massive amounts of data.

The experimental results revealed that the performance varied between MySQL and Apache Hive. MySQL demonstrated better suitability for programs requiring immediate data retrieval and smaller storage capacities. On the other hand, Hive showed better efficiency in handling larger datasets. Specifically, in terms of speed, MySQL outperformed Hive in simple queries. However, as the dataset size increased beyond 100,000 records, MySQL’s performance became unresponsive. This limitation indicates that MySQL may not be the optimal choice for processing extremely large datasets. Overall, Hive exhibited better scalability and performed well in handling big data as shown in Table 2.

Furthermore, we conducted experiments to identify the most suitable machine learning algorithm for building the suspicious identification model. The model’s training data comprised of extraction of features data recorded in CSV format, comprising object, person and vehicle datasets as shown in Table 3. Figure 9 to Figure 11 depict the process of dataset acquisition.

We utilized popular machine learning algorithms, including artificial neural networks (ANN) (Yegnanarayana, 2009), support vector machines (SVM) (Steinwart & Christmann, 2008), K-nearest neighbor (k-NN) (Larose & Larose, 2014), decision tree (Myles et al., 2004) and naive Bayes (Webb, Keogh & Miikkulainen, 2010), implemented using Scikit-learn in Python (Pedregosa et al., 2011). The performance of each algorithm was evaluated based on classification accuracy and prediction speed.

Table 4 summarizes the results of the algorithm’s performance, calculated as the mean outcome of 10 training rounds. Among the algorithms tested, the decision tree has the best classification accuracy (98.867%) and the fastest prediction speed (0.005 ms per sample). These findings indicate that the decision tree algorithm is well-suited for the suspicious activity identification task, offering both high accuracy and efficient prediction capabilities.

Web application utilization

To provide a user-friendly interface for accessing and analyzing the suspicious identification data, we developed a web application using NuxtJS (Nuxt2, 2023), MySQL and the Python pipeline on a Windows Server 2008 (Microsoft, 2023). Users can access the web application through http://datascience.mfu.ac.th/datafusion. The application offers various features to visualize and explore the collected data.

The web application’s homepage displays historical graphs for the specified time, which is set by default to the previous 7 days. These graphs provide insights into suspect statuses, object types, vehicle types and person types, enabling users to easily grasp the overall trends and patterns. Figures 12 and 13 illustrate the visual representation of these statistical charts. Additionally, the map page, as shown in Fig. 14, displays the geographical distribution and status of suspected objects, vehicles and individuals. Different colors are used to represent varying levels of suspicion, enabling users to quickly identify areas of concern. The map presents data from the previous 7 days, allowing for temporal analysis of suspicious activities.

Users can utilize the search field to filter data based on location, period and suspicious status, facilitating targeted exploration of the dataset. Furthermore, the web application enables users to download the data in Excel format, providing them with the flexibility to conduct further analysis or integrate it into their own systems as shown in Fig. 15. Overall, the web application provides an intuitive and interactive interface for users to explore and understand the suspicious identification data collected. It enhances accessibility, enabling users to gain valuable insights and make informed decisions based on the presented information.

Summary and implications

The experimental results highlight the importance of choosing the appropriate technology for processing big data in the context of suspicious identification. MySQL proves to be efficient for applications needing immediate data retrieval and limited storage capacity, whereas Hive has superior scalability for handling bigger volumes. Moreover, the decision tree algorithm emerges as the most suitable machine learning algorithm, offering high classification accuracy and fast prediction speed for the suspicious identification task.

The developed web application complements the data processing and analysis, providing users with a user-friendly interface to access, visualize and explore the collected suspicious identification data. It facilitates effective decision-making and enhances the overall security monitoring capabilities of the agency. These findings and the implemented system have implications for enhancing agency security monitoring, enabling timely detection of suspicious activities and improving the efficiency of threat prevention efforts. The integration of big data processing, machine learning algorithms and web application interfaces contribute to the advancement of security systems and has the potential to be applied in real-world scenarios, ensuring public safety and national security.