3.8 Link Analysis Applications

Associations of networks created via link analysis may be grouped into such categories as entity-to-entity, entity-to-event, or event-to-event. Entity-to-entity associations between individuals may include blood relative, spouse, employees, friend, acquaintance, neighbor, etc. Associations between individuals and an organization may include labels such as leader, owner, member, head, and employee. Association networks between an individual and a place may include place of birth, point of entry, residence, current location, country visited, and place of training. Entity-to-event association networks may include labels for bomber, victim, object, visits, meetings, enrollment, weapon, or place. For these events, the roles for any date and time are a factor. Event-to-event association networks include tying communications, such as phone calls, e-mails, physical meetings, or planning events, to each other.

Links, as well as nodes, may have attributes specific to the domain or relevant to the method of collection. For example, link attributes might indicate the certainty or strength of a relationship, the dollar value of a transaction, or the probability of an infection. Some linkage data may be simple, such as a meeting, or voluminous, such as phone calls, wire transfers, or e-mails, with a uniformity of node and link types and a great deal of regularity. On the other hand, data may be extremely rich and varied, though sparse, such as clandestine meetings common with law enforcement investigative data, with elements possessing many domain-specific attributes, as well as confidence and value, which can change over time.

The ability of link analysis to represent relationships and associations among objects of different types has proven crucial in assisting human investigators to comprehend complex webs of evidence and draw conclusions that are not apparent from any single piece of information. Link analysis often raises the following questions for a criminal investigator and intelligence analyst:

Which nodes are the main leaders of a network?
What are the underlying relationships in the network?
What are the relevant sub-networks in a large network?
Are there undetected links or hidden nodes in the data?
What level of aggregation best reveals the links in a network?
Which links can be severed to impede the operation of the network?

Fortunately, link analysis tools have the capability of answering these and other types of questions the investigative analysts may want to interrogate from the data. Many more applications exist for link analysis techniques in the areas of fraud prevention and criminal analysis, as we shall see in the following chapters.