Hypergraph Analysis

Overview#

Standard graph analysis treats every relationship as a connection between exactly two entities. That works well for bilateral links, but operational intelligence rarely reduces to pairs. A person, a vehicle, a location, and a communications device that all appear at the same event share a joint relationship that cannot be fully expressed as a collection of pairwise edges. The moment you decompose the event into pairs, you lose the information that all four were co-present simultaneously.

Hypergraph Analysis uses HyperNetX to model these n-ary co-occurrences directly. Each qualifying investigation event becomes a hyperedge whose members are every entity that participated. Analysts can then measure how central each entity is across joint events, find groups of entities that are strongly connected through shared hyperedges, and detect communities that pairwise graph metrics would not reveal. This gives intelligence teams a structurally accurate picture of multi-party relationships and surfaces coordination patterns that bilateral link analysis misses.

Last Reviewed: 2026-04-14 Last Updated: 2026-04-14

Key Features#

Hyperedge Construction from Timeline Events: Every investigation event with two or more participants is modelled as a hyperedge. The participant entity IDs form the hyperedge members. This preserves the joint nature of multi-party co-occurrences rather than reducing them to pairwise links.
s-Centrality Scoring: s-centrality measures a node's importance considering only hyperedges of size at least s. A high s-centrality score means the entity appears repeatedly in large joint events, indicating a coordination or hub role that simple degree centrality would undercount.
s-Connected Components: Two entities are s-connected if they are linked through a sequence of hyperedges each of size at least s. Finding s-connected components reveals tightly coordinated groups operating through shared large-scale events.
Community Detection via Clique Expansion: The hypergraph is projected to a weighted clique graph and Louvain modularity optimisation detects communities. Each community corresponds to a cluster of entities with dense shared hyperedge membership, surfacing coordination cells or operational sub-groups.
Bipartite Viewer with Centrality Sizing: The the hypergraph viewer renders entities in the left column and events in the right column. Entity node size reflects s-centrality score. Event node size reflects participant count. Colour coding by event type aids rapid orientation. Clicking an event node shows all its member entities.
HITL Review for Centrality Jumps: When an entity's s-centrality score increases by more than 0.3 between consecutive analyses, a Human-in-the-Loop review request is created automatically. This catches sudden escalation in an entity's coordination role and routes it to an analyst before it is acted upon.

Use Cases#

Multi-Party Meeting Detection: Identify groups of entities who repeatedly co-appear at the same events, revealing coordination networks that bilateral link analysis would fragment.
Hub Entity Identification: Use s-centrality to find entities that consistently participate in large joint events, indicating a central organisational or logistics role.
Cell Structure Analysis: Find s-connected components to delineate operationally isolated sub-groups that rarely interact outside their own cluster.
Temporal Escalation Monitoring: Track s-centrality over time to detect when a previously peripheral entity suddenly moves to the centre of multi-party activity.
Community Briefing: Present hypercommunities to analysts as structured groups for targeted collection tasking or further investigation scoping.

Integration#

Graph Intelligence: Hypergraph analysis complements pairwise graph traversal and centrality metrics in the graph intelligence module.
HITL Approval Workflow: Centrality jump alerts are routed through the HITL approval service for analyst review and action.
Investigation Timeline: Timeline events and participant data from the investigation domain are the primary data source for hyperedge construction.
GraphRAG Communities: Hypercommunity detection results can inform GraphRAG community summaries with richer structural evidence.
Common Operational Picture: Entity centrality scores and community assignments can be overlaid on the operational picture for contextual awareness.

Open Standards#

OASIS STIX 2.1: Structured Threat Information Expression defines a standard vocabulary for describing threat actors, relationships, and events, providing a common entity and relationship model for investigation data fed into hyperedge construction.
W3C PROV-DM: The Provenance Data Model defines how to record the origin and lineage of derived data, supporting traceable attribution of centrality scores and community assignments back to their source investigation events.
W3C OWL 2 (Web Ontology Language): Provides a formal vocabulary for defining entity types and their relationships, underpinning the ontology used to classify participants and event types within the hypergraph.
JSON-LD 1.1: A lightweight linked-data format that serialises entity and event records with unambiguous identifiers, enabling hypergraph exports to be interpreted by external analysis tools without schema negotiation.
ISO 8601: Defines internationally recognised date and time representations used to timestamp investigation timeline events and to order consecutive analysis runs when tracking centrality changes over time.
GraphML: An XML-based file format for exchanging graph and hypergraph structures between tools, allowing hyperedge data to be exported to third-party visualisation or analysis environments.