Every dataset hides a web of relationships. Network analysis makes those relationships visible — and actionable. I map connections, detect communities, identify bottlenecks, and surface insights that row-by-row analysis will never find.
Discuss a project Back to portfolioNetwork analysis studies the relationships between entities — not just the entities themselves. It answers questions that conventional analysis cannot reach.
Every network is a graph: entities become nodes, relationships become edges. The mathematics of graphs reveals structure invisible in any spreadsheet.
Algorithms identify natural groupings within complex networks — revealing which entities belong together, and which connections bridge different communities.
Degree, betweenness, eigenvector centrality — measuring which nodes matter most, which connections control information flow, and where vulnerabilities lie.
A real applied study tracking the structural evolution of a criminal trafficking network across 11 phases of a law enforcement investigation. Goal: identify key nodes, trace how the network reorganised after disruption, and determine the most effective intervention points.
The network consists of 110 individuals — players n1–n82 in trafficking roles, n83–n110 in support roles. The investigation initially targeted the leader, D.S. Wiretapped correspondence between 23 selected members was encoded into adjacency matrices, one per phase, and loaded into NetworkX graphs for temporal analysis.
Three centrality measures — Degree, Betweenness, and Eigenvector — were computed per player per phase. Mean centrality across all phases revealed who was structurally important throughout the investigation, and who rose or fell in influence after each disruption event.
The first law enforcement seizure forced the organisation to abandon existing routes and pivot to cocaine imports from Colombia via the United States. Edge count dropped from 56 to 48 — broken connections made visible.
A new sub-network centred on n12 crystallised in Phase 5 to facilitate the new import operation. All three centrality metrics — degree, betweenness, eigenvector — confirmed n12's rapid rise in structural importance.
Temporal centrality tracking identified which players were structurally critical at each phase. This methodology applies directly to high-dimensional network security and any domain where disrupting a network — not just monitoring it — is the goal.
The first seizure in Phase 4 was the pivotal event. Traffickers were forced to abandon existing routes and reorient cocaine imports from Colombia, transiting through New York. The two diagrams below show 23 selected members before and after this structural shift — and the emergence of a new hub.
Node n1 acts as the primary hub. Node n12 has minimal connections — barely active in the network at this stage.
Node n12 has emerged as a dominant hub, controlling the Colombia–New York cocaine import route and connecting multiple sub-networks.
The first law enforcement seizure happened in Phase 4. This forced the trafficking organisation to reorient entirely — pivoting to cocaine imports from Colombia, transiting through New York. The immediate structural effect is visible: edges dropped from 56 (Phase 3) to 48, representing broken connections as routes were abandoned and contacts cut.
The direct structural response to the Phase 4 seizure was the emergence of a new sub-network in Phase 5, centred on node n12 and its connections. This sub-network was built specifically to facilitate the new Colombia import operation. What was a peripheral node became the operational backbone of the reorganised network.
This inference is directly supported by the temporal evolution of all three centrality metrics. Across Degree, Betweenness, and Eigenvector centrality, n12 shows a measurable and statistically significant rise in influence from Phase 4 to Phase 5 — making it identifiable as the key intervention target in the reorganised network.
| Phase | Nodes | Edges |
|---|---|---|
| Phase 1 | 15 | 18 |
| Phase 2 | 24 | 28 |
| Phase 3 | 33 | 56 |
| Phase 4 seizure | 33 | 48 |
| Phase 5 | 32 | 39 |
| Phase 6 | 27 | 47 |
| Phase 7 | 36 | 49 |
| Phase 8 | 42 | 58 |
| Phase 9 | 34 | 44 |
| Phase 10 | 42 | 50 |
| Phase 11 | 41 | 50 |
The edge count drop in Phase 4 (56 → 48) and partial recovery in Phase 6 (47) reflect the network's disruption and subsequent reorganisation around the new Colombia route. Phase 8 marks the peak expansion: 42 nodes and 58 edges — the largest the network reached during the investigation.
The investigators got their answers. The city got a little safer. The network got a little shorter. IntelXData got a 4.85 — which, statistically speaking, is as close to perfect as humans tend to agree on anything.
A structured process from raw relational data to actionable network intelligence.
The instruments behind the analysis.