Criminal Network Intelligence: A Graph Theory Approach to Pattern
Detection
Mrs. Sowmya T(Guide) Kumari. Sucharitha B
Assistant professor 1VE24CS166
Department of Mathematics Department of Computer Science
Sri Venkateshwara College of Engineering Sri Venkateshwara College of Engineering
Vidyanagar, Bangalore-562157 Vidyanagar, Bangalore-562157
Kumari. Sindhu K R Kumari. Ruchika S
1VE24CS160 1VE24CS139
Department of Computer Science Department of Computer Science
Sri Venkateshwara College of Engineering Sri Venkateshwara College of Engineering
Vidyanagar, Bangalore-562157 Vidyanagar, Bangalore-562157
Abstract enabling better intelligence and
intervention strategies.
This paper explores the application of graph
theory in analyzing criminal networks and Applications:
detecting crime patterns. By modeling
Several real-world applications underscore
individuals as nodes and their interactions
the utility of graph theory:
as edges, law enforcement agencies can
uncover hidden relationships, identify key In counter-terrorism, analyzing call records
suspects, and predict future criminal revealed a peripheral node that was the
activities. The study discusses actual mastermind.
methodologies, tools, case studies, and
future prospects in integrating graph-based In a drug trafficking investigation,
techniques with modern surveillance and centrality analysis exposed logistical
data analytics technologies. coordinators masked as low-level
operatives.
Keywords—Graph Theory, Criminal
Networks, Crime Pattern Detection, Social Graph Theory Fundamentals:
Network Analysis, Predictive Policing Graphs are mathematical structures used to
model pairwise relationships. In
Introduction
criminological contexts, a node represents a
The complexity of contemporary criminal person or entity, while an edge denotes a
organizations has rendered traditional relationship, such as communication or
investigative methods less effective in financial exchange.
uncovering intricate relationships and
hierarchies. Graph theory, a branch of Common analytical metrics include:
mathematics concerned with the study of Degree Centrality: Measures the number of
graphs, provides a robust framework for direct connections a node has. Higher
representing and analyzing these criminal values may indicate central figures.
structures. This paper highlights how nodes
(individuals or groups) and edges Betweenness Centrality: Identifies nodes
(relationships or interactions) can be used that act as bridges between clusters.
to map and monitor criminal activity,
1|Page
Closeness Centrality: Highlights nodes that Each lieutenant node has multiple member
can quickly interact with all others. nodes connected to it.
Community detection algorithms help in Member Nodes (Bottom Level – Blue):
finding clusters of closely connected
At the base level, these nodes signify
individuals, revealing operational cells
operatives or members tasked with
within criminal organizations.
executing specific roles. Members are
Modeling Criminal Networks connected only to their immediate
lieutenant, not to the leader directly,
Criminal networks can be modeled as
reflecting compartmentalization often used
graphs where the structure reflects roles and
in covert organizations.
hierarchies:
Structural Interpretation:
Figure 1: Graph Theory analyzing
criminal network graph The network structure resembles a tree
graph with a centralized hierarchy. Each
node’s significance can be interpreted using
graph theory metrics:
Degree Centrality: The leader holds the
highest connectivity, followed by
lieutenants.
Betweenness Centrality: Lieutenants are
pivotal in linking members to the top-level
node.
Image to be generated showing a Closeness Centrality: The leader can reach
network with one central node and all other nodes in fewer steps, enhancing
surrounding clusters, labelled as “Leader”, their influence across the network.
“Lieutenants”, “Members” Figure 2: Detiled criminal network
Leader Node (Top Level – Red):
The topmost node signifies the
organization’s leader—the central authority
directing operations. This individual
connects directly to all mid-level agents,
known as lieutenants, and plays a crucial
role in managing the flow of information
and orders.
Lieutenant Nodes (Middle Level –
Network Structure and Analysis:
Orange):
Centralized Yet Distributed:
These mid-tier nodes represent lieutenants,
who act as intermediaries between the While a few central hubs (red/orange
leader and the lower-tier operatives. They nodes) exist, many nodes are connected not
receive instructions from the leader and only to them but to each other, forming
delegate tasks to their assigned members.
2|Page
clusters. This indicates semi-autonomous Often a red flag in behavioral profiling —
units or cells within the network. could be either innocuous actors or
undercover members.
This decentralization increases robustness
— even if a central figure is removed, the Group 2 (Orange Circles):
network can potentially rewire or reroute.
Concentrated in the lower-left quadrant.
Clustering and Communities:
High clustering suggests individuals act
Several smaller orange nodes are arranged closely together.
around central leaders, suggesting
Possible indicator of a tight-knit cell or
organized cells or subgroups.
team operating locally.
These subgroups may specialize in specific
Group 4 (Dark Blue Triangles):
criminal tasks (e.g., logistics, enforcement,
or finance) and report to central figures. Positioned in the lower-right quadrant,
close together.
Peripheral Nodes:
May indicate a focused operational group
Nodes on the outer edges, particularly
or foot soldiers carrying out field tasks.
smaller and less connected ones, may
represent low-level operatives or new Their similarity suggests training, routine
recruits. behavior, or role standardization.
These individuals are often isolated from Group 5 (Light Blue Squares):
the broader structure to minimize risk
exposure. Spread diagonally across the middle of the
graph.
Regular dispersion hints at evenly
Figure 3: Gephi visualization dashboard distributed responsibilities — such as
analyzing a criminal network logistical operations or communication
relays.
Figure 4: Conceptual illustration of
Graph Neural Network applied to crime
analysis
Group 1 (White Diamonds):
Sparsely placed with little pattern.
These points may signify
individuals whose behavior doesn’t Comparison of Network Analysis Tools
fit predefined clusters. provides a comparative evaluation of four
network analysis tools: Gephi, NetworkX,
Neo4j, and Python Analytics, across three
key performance dimensions:
3|Page
Visualization, Centrality Analysis, and Conclusion
Monitoring.
Graph theory has proven to be an
Categories and Colour Coding: indispensable tool for understanding and
dismantling criminal networks. By
Visualization (Orange), Centrality Analysis
enabling deeper insight into relational
(Light Blue), Monitoring (Dark Blue). Each
structures and facilitating predictive
tool is rated on a scale from 0 to 5 for each
analytics, it empowers law enforcement
category.
with data-driven strategies. Responsible
Gephi: application and continued research are
essential to maximize its societal benefits.
Gephi scores the highest in visualization,
indicating it's highly effective for References
graphically representing networks. It’s
[1] S. Wasserman and K. Faust, Social
known for an intuitive interface and
Network Analysis: Methods and
interactive visuals. Moderate capability in
Applications, Cambridge University Press,
computing centrality measures like
1994.
betweenness or closeness centrality.
[2] M. Newman, Networks: An
Strong monitoring tools, possibly for
Introduction, Oxford University Press,
dynamic graphs or real-time data changes.
2010.
NetworkX:
[3] L. C. Freeman, “A set of measures of
Provides decent visual representation, centrality based on betweenness,”
although not as advanced as Gephi. Highest Sociometry, vol. 40, no. 1, pp. 35–41, 1977.
score in this category, showcasing strength
[4] M. Girvan and M. E. J. Newman,
in algorithmic analysis (e.g., PageRank,
“Community structure in social and
eigenvector centrality). Slightly lower
biological networks,” Proc. Natl. Acad. Sci.
performance in monitoring, possibly due to
USA, vol. 99, no. 12, pp. 7821–7826, 2002.
static graph processing capabilities.
Neo4j:
Basic built-in visualization features; better
for database management and query.
Adequate for graph algorithms, but less
extensive than NetworkX. Comparable
performance in monitoring, likely due to its
real-time query capabilities.
Python Analytics:
No dedicated visualization; relies on
external libraries (e.g., Matplotlib, Plotly).
Decent analytical capabilities, assuming
usage with libraries like Pandas and
NetworkX. Similar to Neo4j; limited unless
extended with specific packages.
4|Page
