Network Analysis (Link Analysis)
Definition
A method that models entities (people, companies, accounts, addresses) as nodes and connections between them (shared attributes, transactions, ownership) as edges, then searches the resulting graph for anomalous structures such as dense clusters, hub nodes with unusually high connectivity, or chains linking otherwise unrelated parties.
- Also called
- Link analysis
- Nodes
- People, companies, accounts, addresses
- Edges
- Shared attributes, transactions, ownership
- Detects
- Dense clusters, hub nodes, unusual chains
Common questions
What does network analysis surface that a spreadsheet review misses?+
Collusion rings, shell-company layering, and shared control across accounts that look unrelated when transactions are reviewed row by row rather than as a connected graph.
Is a highly connected node always suspicious?+
No. Legitimate hubs, such as a payroll processor or a common vendor, are also highly connected, so hub status is a lead for further checking rather than proof of wrongdoing on its own.
Related terms
- Anomaly Scoring
- A numeric score assigned to each entity or transaction based on how different it is from the expected population, derived from multiple...
- Explainability
- The degree to which a model's output can be explained in terms of its inputs and logic. Logistic regression and decision trees...
- Isolation Forest
- An unsupervised machine-learning model for anomaly detection. It builds random decision trees and scores each record by the average depth required to...
- Logistic Regression (Supervised Fraud Model)
- A classification model trained on historically labelled transactions (fraud vs. legitimate) to estimate the probability that a new transaction is fraudulent. Requires...
- Timeline Reconstruction
- The process of ordering digital events from multiple sources into a single chronological account. Requires normalising all timestamps to a common reference...