Link Analysis
Definition
A graph-based analytical technique that maps entities (IP addresses, domains, accounts, phone numbers, wallets) as nodes and relationships (communications, ownership, transactions) as edges. Used to identify shared infrastructure, trace criminal networks, and follow financial flows.
- Structure
- Nodes for entities, edges for relationships
- Entity examples
- IP addresses, domains, accounts, phone numbers, wallets
- Use
- Identify shared infrastructure and trace networks
Common questions
What kind of shared infrastructure can link analysis reveal in a cybercrime case?+
It can surface a domain registered with the same email as several fraud sites, or a server IP hosting multiple phishing pages, connections easy to miss when each artifact is examined in isolation.
Why is link analysis well suited to financial and cryptocurrency tracing?+
Transactions and wallet addresses form a natural graph of transfers, so mapping them as nodes and edges exposes clustering and flow patterns, such as funds converging into a single exchange account, that a transaction list alone would not show clearly.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Hypothesis Testing
- In digital forensics, the practice of forming a specific, falsifiable proposition about what occurred (such as 'the attacker used account X to...
- NetFlow
- A network protocol (originally Cisco, now standardised as IPFIX under RFC 7011) that records metadata about IP traffic flows: source and destination...
- SIEM (Security Information and Event Management)
- A platform that aggregates log and event data from systems, networks, and applications across an environment, correlates events against detection rules, generates...
- Timeline Reconstruction
- The process of ordering digital events from multiple sources into a single chronological account. Requires normalising all timestamps to a common reference...