Cybercrime is relatively invisible, but its extent should not be underestimated. Billions of euros a year are lost to telephone fraud alone - in which a virus secretly calls an expensive number from a telephone or computer - according to PhD candidate Bram Cappers. “And it is often unclear who should foot the bill: the customer or the telecom provider?”

In any event it is vital to providers that they have the ability to track down suspicious patterns in their network as quickly as possible. But that is not easy, as Cappers explains: “If you comb a system of this kind automatically for anomalous behavior, the result will very often be a false alarm.” To make a really good estimate, he believes, human expertise is always needed. “But compared to a computer, of course, people are incredibly slow.” So humans and machines should consolidate their strengths.

Human talent

The art lies in representing the data packets, in which a network's activity is recorded, in such a way that optimum use can be made of the human talent for pattern recognition. Cappers reaches for his laptop and shows a huge Excel table: “Each row represents a data packet; its characteristics may fill hundreds of columns.” It is anything but manageable, but with a little knowledge of the system order can be created from the chaos.

“Suppose we want to track down fraudulent telephone conversations. Well, of course, we know something about  how this type of conversation tends to proceed: an initiation is made by one number to another, the telephone rings, next an acceptance comes back, and at the end there's a closure signal.”

While working on his PhD he developed software, named Eventpad, in which all these actions are represented by colored blocks. “Each row is a telephone conversation and every action has a different color; you can see that far from all the conversations follow a logical pattern. This tells us that something is going on there.”

Article continues below illustration.

Patient flows

Eventpad is not only a useful tool for tracking down telephone fraud, it is also well suited to applying similar analysis to patient flows in hospital - as a test Cappers was given access to the patient data held by a radiology department in order to seek out irregularities. “Here, too, there's a customary order of actions, such as intake, diagnosis, treatment plan, and so on, which you can easily visualize in Eventpad.”

And that's not all. Using Eventpad, Cappers managed to solve the IEEE Visual Analytics Science and Technology Challenge 2017 in under two hours - a performance worthy of first place. “That involved searching for smuggling routes in a nature reserve by referring to traffic data - in other words, another completely different application. Eventpad has a wide range of uses.”

The tool's versatility may prove to be a pitfall now that Cappers has launched a startup, AnalyzeData, with among others his brother Dennis and fellow PhD candidate Josh Mengerink, to launch Eventpad commercially. “To start with, we'll certainly need to limit ourselves in terms of the applications. We'll probably focus initially on telephony and on forensic analysis - trawling confiscated computers for incriminating material.”

They've already made a promising start: this year they won the ICT.OPEN Best Demo Award and the prize for the Best Executive Summary in the European Venture Program.