Relationship Search in SAS Visual Investigator

SAS Visual Investigator has unparalleled search capabilities, allowing investigators to explore their data repository, uncover insights, and take timely actions. This post is part three of a series dedicated to SAS Visual Investigator search. In part one and two of this series, I wrote about facet filters, text search, synonym search, and phonetic search.

In this post, I will cover relationship search in SAS Visual Investigator, including configuration considerations and two detailed examples.

About Relationship Search

Relationship search allows the end users to leverage the relationships between objects to uncover actionable insights. In such a search, the user can define both the length of the relationship search and the degrees of separation between search objects. The search result is displayed as a network diagram.

Setting the degree of separation to one is equivalent to searching for direct relationships. When searching for direct relationships, the user can search for up to five objects or take four hops.

Select any image to see a larger version.
Mobile users: To view the images, select the "Full" version at the bottom of the page.

Alternatively, the user can perform a relationship search between two objects, up to a separation level of four. A higher degree of separation between the source object and the target object will lead to a wider search and naturally capture more objects. It’s worth noting that a potential disadvantage of a wide-ranging query is that it has a higher chance of capturing too many objects and hitting the upper limits of objects a search is allowed to return. When the upper threshold is exceeded, the search may be cancelled with a warning.

Note: both the maximum length of the search path and the maximum separation of objects are dependent upon system configuration. More on this in the Configuration section of this post.

For each object in the relationship search, the user is able to define a search query. In the following example, a search condition is defined on the first object type (auto policy), specifying that the auto policies returned must have an inception date later than January 1, 2022. Similarly, search queries can be defined for the other two nodes in this relationship search.

Last but not least, the user can use other search features such as advanced search and map search in conjunction with relationship search, allowing for the creation of truly powerful searches.

Configuration

As mentioned previously, the maximum number of objects allowed in a search path and the maximum degree of separation between source and target objects are configurable. These properties can be found under Properties > Desktop > Relationship Search in the SAS Visual Investigator Administrator UI (Manage Investigate and Search).

The maximum length of the search path can range from two object queries up to ten object queries. The maximum separation of objects can range from two levels up to four levels.

In the event that a relationship search results in too many objects, the user will receive a warning from SAS Visual Investigator. The most likely culprit of too many objects being returned is that the relationship search did not include any search queries that would cut down on the amount of related objects.

Though the recommendation is to refine the relationship search by imposing additional search parameters, there are also two options that can be modified within SAS Environment Manager to increase the search limit.

Within SAS Environment Manager (Manage Environment), go to Configuration, followed by Visual Investigator Search and Discovery service. The relevant properties are:

pathSearchEdgeExpansionLimit: The maximum number of new vertices that can be encountered by each edge search before a path search is cancelled. Set to 25000 by default.
pathSearchExpansionLimit: The maximum number of the new vertices that can be encountered by each vertex search before a path search is cancelled. Set to 10000 by default.

Examples

Now that I’ve talked about relationship search on a theoretical basis, let’s walk through two examples. In my demo environment, I’ve configured my SAS Visual Investigator for the use case of auto and home insurance fraud.

Example 1

In this first example, I want to use relationship search to bring back all the vehicles related to a particular automobile policy through their relationships with auto claims. In other words, the relationship search can be thought of as auto policy – auto claims – vehicles.

On the relationship search page, I've set the first object type as auto policy, followed by defining the search query as “policy_id:35432”. This means that only the auto policy with the Policy ID of 35432 will be returned. By extension, only objects related to this particular policy will be returned as part of the overall relationship search.

I've defined auto claim as the second object type. Here, I’ve used a wildcard (*) to fetch back all the auto claims related to our auto policy of interest. Alternatively, leaving the query blank would have the same effect.

For the third and last node, I’ve selected vehicle as the object type. I’ve once again used the wildcard to fetch back all related vehicles.

The returned results are displayed as a network, centering on the auto policy of interest (35432). This auto policy is linked to fourteen auto claims and through these auto claims, we are able to find all the related vehicles.

Example 2

In this second example, I will be using relationship search in combination with two other powerful search techniques: advanced search and map search.

In my relationship search, I’ve defined auto claim as the first object type. Because the auto claim object type has valid geographical data, map search is enabled. Via map search, I’ve defined a search area centered around London.

In addition to specifying a geographical area in my search, I’ve also used advanced search to define a range on the incident date of the claims. This unique combination of geographical search and date search essentially brings back all the auto claims that occurred within a certain time period and within a certain geographical area.

For the second node, I’ve defined alert as the object type. Using the wildcard (*) as the search query, I’m searching for all alerts related to those auto claims. To start off, I’ve set the level of separation as one.

Please see the search results, displayed in network view, below. In this case, I’m searching for direct relationships and only alerts directly linked to the relevant auto claims are brought back.

For my second search, I’ve increased the level of separation to two.

In the result below, six additional alerts are brought back, each one related to an object directly related to an auto claim that fits both the geographical and date requirements. By increasing the level of separation, we've effectively increased the scope of our search.

Summary

In this post, I covered relationship search from both an administrator point of view and an investigator point of view. This is the third post in a series I’m doing on search in SAS Visual Investigator.

Stay tuned for future topics!