Analysis 101: Time Series Analysis
08/08/07 14:36 Filed in: Analytical
Techniques
A time series analysis is a security analysis
technique that is used to examine the occurrence of
similar security incidents over time. In this case
time refers not only to time of day but also day of
the week and the day of the month. Longer-term
analysis can also include month and season.
By way of example let us imagine that during the past month there have been twelve Improvised Explosive Device attacks in the district where your organization is working. The attacks have occurred at ten separate locations. Victims have included soldiers, police officers, and civilians alike. The only apparent pattern seems to be that the attacks have all taken place on or near main roads. To make matters worse your country director wants to be briefed in four hours.
To aid your analysis we will make a quick Excel chart with the time of day on one axis and the incidents on the other. For each incident we put an X the the row that represents the time of day that the IED attack occurred. The chart should look something like this one.
Examining the chart we see that most of the incidents have occurred between 0600 and 0900. Of these half occurred between 0800 and 0900. We'll highlight these incidents in blue to remind us that they seem to be part of a grouping. There are also four incidents that don't fit the general pattern. We've marked these in red.
With the information you have now what assessment can be made? What would you advise the country director?
Lets take it one step further and make a new chart that plots the incidents against the day of the week.
At first glance there doesn’t seem to be much of a pattern here but on closer examination you'll notice that all of the ‘red’ events that were highlighted earlier fall on a Friday except for one that occurred early on Saturday morning. The remaining events all occurred on weekdays (Friday and Saturday are considered the weekend where you are working).
What does this new information suggest to you? What can you tell the country director? What recommendations can you make? What additional information do you need to seek out? What additional analysis can you do?
By way of example let us imagine that during the past month there have been twelve Improvised Explosive Device attacks in the district where your organization is working. The attacks have occurred at ten separate locations. Victims have included soldiers, police officers, and civilians alike. The only apparent pattern seems to be that the attacks have all taken place on or near main roads. To make matters worse your country director wants to be briefed in four hours.
To aid your analysis we will make a quick Excel chart with the time of day on one axis and the incidents on the other. For each incident we put an X the the row that represents the time of day that the IED attack occurred. The chart should look something like this one.
Examining the chart we see that most of the incidents have occurred between 0600 and 0900. Of these half occurred between 0800 and 0900. We'll highlight these incidents in blue to remind us that they seem to be part of a grouping. There are also four incidents that don't fit the general pattern. We've marked these in red.
With the information you have now what assessment can be made? What would you advise the country director?
Lets take it one step further and make a new chart that plots the incidents against the day of the week.
At first glance there doesn’t seem to be much of a pattern here but on closer examination you'll notice that all of the ‘red’ events that were highlighted earlier fall on a Friday except for one that occurred early on Saturday morning. The remaining events all occurred on weekdays (Friday and Saturday are considered the weekend where you are working).
What does this new information suggest to you? What can you tell the country director? What recommendations can you make? What additional information do you need to seek out? What additional analysis can you do?