What is link analysis?
Link analysis, sometimes referred to as association analysis or network analysis, is an investigative technique used to identify, explore and understand the relationships between people, organisations, assets, locations and events.
Rather than analysing records in isolation, link analysis examines how these entities are connected. This makes it particularly valuable for analysts working in law enforcement, national security, defence, and financial crime, where understanding relationships and context helps build the connected intelligence picture needed to support operational decision-making.
Although link analysis is now closely associated with graph technology, it is not defined by the software used to perform it. It is an analytical technique that forms part of a wider investigative workflow. Graph technology simply provides an efficient and intuitive way to model, explore, and understand complex relationships.
Link analysis vs intelligence analysis
Link analysis and intelligence analysis are closely related, but they are not the same thing.
Intelligence analysis is the broader discipline of collecting, evaluating and interpreting information to produce intelligence that supports decision-making. It encompasses a wide range of analytical techniques, data integration, geospatial analysis, temporal analysis, the application of analytical algorithms, and link analysis.
In other words, intelligence analysis answers the question “what does the available information tell us?”
Link analysis helps answer the question “how are these people, organisations, assets, and events connected?”
For many investigations, understanding those connections is the key to understanding the wider picture.
Why link analysis matters
Very few intelligence investigations revolve around isolated individuals.
Organised crime groups communicate through trusted associates. Terrorist cells rely on facilitators and infrastructure. Money laundering schemes hide ownership through layers of companies and intermediaries. Tax evasion often involves complex corporate structures spanning multiple jurisdictions.
Viewed individually, these records may appear entirely unrelated. But viewed together, they often reveal patterns that would otherwise remain hidden.
A single company director may also control multiple businesses. A vehicle may appear in several unrelated investigations. A telephone number might connect suspects operating in different regions. A shared address or financial transaction may reveal a previously unknown relationship between two criminal groups.
Link analysis allows analysts to discover these relationships and understand how they contribute to the broader investigation.
How analysts perform link analysis
Link analysis most commonly happens during the analysis stage of the intelligence lifecycle, although in practice, analysts often move back and forth between collection, processing, and analysis as new information emerges.
Investigations may begin with broad exploratory analysis across an entire dataset to identify unusual patterns, communities, or high-risk entities for further exploration. This is common in areas such as transaction monitoring and proactive intelligence development.
But, more commonly, analysts begin their link analysis by searching for a known person, organisation, account or event and gradually expanding outwards to explore connected entities. As they go, they test hypotheses and follow new lines of enquiry as they emerge.
A typical link analysis process might involve:
- identifying the people, organisations or assets directly connected to a subject
- exploring indirect or multi-hop relationships
- comparing connections across multiple investigations
- testing investigative hypotheses
- identifying central actors or shared infrastructure
- validating findings against supporting evidence
As new information becomes available, analysts continually refine their understanding, following promising lines of enquiry while ruling out others.
Common techniques used alongside link analysis
Link analysis is most powerful when combined with other analytical techniques.
Temporal analysis
Understanding when events occurred often provides as much context as understanding how they are connected. Time visualisations help analysts reconstruct investigations, identify coordinated activity and understand the sequence of events leading up to an incident.
Geospatial analysis
Maps help analysts understand where activity occurred, identify hotspots, trace movement and examine how locations relate to one another.
Combining graph, time, and geospatial visualisation often provides a much richer understanding than any single view alone.
Entity resolution
One of the biggest challenges in link analysis is ensuring that analysts are exploring relationships between real-world entities rather than duplicate records.
In practice, the same individual, organisation or asset often appears multiple times across different systems under different names or identifiers.
Entity resolution helps analysts determine which records refer to the same underlying entity while preserving the original source records. Without it, networks become fragmented, important relationships remain hidden and investigative findings can be misleading.
Graph algorithms
Modern link analysis platforms can automatically calculate graph (or network) metrics that help analysts identify unusually connected entities, and bridge nodes between otherwise separate groups and individuals who appear central to a network.
These measures can help prioritise investigative effort, but they should always be interpreted alongside operational context and analyst judgement rather than treated as definitive evidence.
Learn more about graph algorithms
Provenance and data lineage
Every relationship shown during link analysis should be traceable back to the underlying evidence.
Analysts need to understand not only that two entities are connected, but why they are believed to be connected, where the information originated, when it was collected and how reliable it is.
Good link analysis platforms preserve this context throughout the investigative process, allowing analysts to move seamlessly from high-level network exploration back to the original records that support each conclusion.
Where is link analysis used?
Although the underlying technique remains the same, link analysis is applied across a wide range of investigative environments.
Law enforcement
Police and criminal intelligence teams use link analysis for use cases including investigating organised crime, understanding communication patterns and connecting intelligence gathered across multiple investigations.
Graph-based exploration helps analysts uncover hidden relationships that may not be apparent when records are viewed individually.
Learn more about intelligence analysis for law enforcement
National security and defence
National security organisations use link analysis to understand hostile networks, monitor extremist activity, investigate foreign influence and analyse complex relationships across intelligence collected from multiple sources.
Understanding how people, organisations, infrastructure and events relate is often central to assessing evolving threats.
Learn more about intelligence analysis for national security
Financial crime and financial authorities
Financial investigators use link analysis to understand beneficial ownership, identify money laundering networks, investigate sanctions evasion and uncover complex corporate structures designed to conceal financial crime.
Relationships between companies, directors, accounts, transactions and assets frequently provide the evidence needed to understand how illicit funds move through financial systems.
Learn more about intelligence analysis for financial authorities
Link analysis software
Link analysis has traditionally been performed using specialist visual analysis tools. Today, modern intelligence platforms combine link analysis with data integration, graph databases, geospatial analysis, timeline visualisation and collaborative investigation workflows.
The most effective platforms allow analysts to move seamlessly between searching, exploring and documenting intelligence without switching between disconnected applications.
GraphAware Hume is designed specifically for this style of investigative work. Built on graph technology, it enables analysts to perform interactive link analysis across connected datasets, while combining graph visualisation with maps, timelines, document views and collaborative workspaces.
Rather than simply producing network diagrams, GraphAware Hume supports the broader investigative workflow, helping analysts move from fragmented information to evidence-based intelligence products.
Frequently asked questions
What is link analysis?
Link analysis is the process of identifying and exploring relationships between people, organisations, assets, locations and events to support investigations and intelligence analysis.
Why is link analysis important?
Many investigations depend on understanding relationships rather than individual records. Link analysis helps analysts discover hidden connections, test investigative hypotheses and understand complex networks that would be difficult to interpret using traditional reports or spreadsheets alone.
Is link analysis the same as intelligence analysis?
No. Intelligence analysis is the broader discipline of producing intelligence from available information. Link analysis is one analytical technique used within that process to understand relationships between entities.
Does link analysis require a graph database?
No. Link analysis is an analytical technique, not a technology. However, graph databases are particularly well suited to link analysis because they are designed to model and traverse relationships efficiently. This allows analysts to explore deeper, more complex networks interactively, following multi-hop connections that would be difficult or computationally expensive to analyse using traditional data models.