Investigation Graph Operations

Overview#

Financial crime networks rarely look like networks on paper. Shell companies blur into one another, individuals appear under multiple names, and beneficial ownership chains loop back through intermediaries in ways that take an analyst days to untangle manually. The Graph Operations module gives investigators direct, hands-on control over the entity graph, so when a duplicate node needs merging or a misidentified entity needs splitting, it happens in seconds with a full audit trail and rollback option.

Purpose-built for financial crime investigators, fraud analysts, and intelligence teams, the module combines precise graph manipulation tools with annotation, bookmarking, and collaboration features that keep complex investigation graphs organised and shared across teams.

Key Features#

Node Merging and Entity Resolution: Consolidates duplicate or related entities into unified graph nodes with configurable merge strategies, relationship preservation, attribute aggregation, and complete audit trails with rollback capability.
Node Splitting and Entity Disaggregation: Separates erroneously combined entities with ML-assisted attribute partitioning and relationship routing, supporting individual-vs-organisation splits, multi-person household separation, and business subsidiary disaggregation.
Interactive Relationship Creation: Enables investigators to document suspected connections with 47 pre-defined relationship categories, evidence attachment, confidence scoring, temporal modelling, and hypothesis tracking.
Graph Bookmark Management: Preserves critical investigation states with complete graph state capture, hierarchical organisation, team sharing, and single-click restoration for investigation continuity.
Advanced Layout Algorithms: Force-directed, hierarchical, circular, grid, geographic, and temporal layout algorithms automatically position nodes for optimal comprehension across varying network structures.
Multi-Dimensional Filtering: Sophisticated filtering across 12 entity attribute dimensions and 8 relationship attribute dimensions with AND/OR/NOT logic, saved filter presets, and real-time graph updates.
Graph Annotation and Evidence Linking: Text annotations, visual highlights, evidence document attachments, risk flags, directional arrows, and shape overlays enable comprehensive case documentation directly on the graph.
Custom Node and Edge Styling: Attribute-based visual encoding through colour, size, shape, and iconography communicates entity risk, relationship strength, and custom classifications with conditional styling rules.
Graph View Persistence: Auto-saves custom layouts, node positions, filter configurations, and viewport states with version history, ensuring investigators maintain consistent analytical perspectives.
Real-Time Collaboration: Multi-user graph editing with conflict resolution and low-latency synchronisation supports concurrent investigation team work.

Use Cases#

Shell Company Network Mapping: Node merging consolidates duplicate entities, relationship creation documents beneficial ownership connections, and hierarchical layouts reveal corporate control structures across multiple jurisdictions.
Cryptocurrency Flow Analysis: Force-directed layouts reveal hub-and-spoke mixing patterns, node filtering isolates high-value flows, and edge styling highlights temporal transaction sequences for tracing illicit fund movements.
Trade-Based Money Laundering Investigation: Hierarchical layouts organise corporate structures, node splitting separates erroneously aggregated entities, and geographic layouts reveal jurisdiction shopping patterns in import/export networks.
Investigation Milestone Preservation: Graph bookmarks capture key investigation states for team review, management reporting, and audit trail documentation throughout multi-week case progression.
Peer Review and Training: Saved graph views with annotations serve as collaboration checkpoints for peer review sessions and training examples for new analysts.

Integration#

The Graph Operations module integrates with the investigation platform's entity resolution, case management, and evidence management systems. Graph manipulations update underlying entity records, relationship databases, and investigation timelines. The module supports export in GraphML, GEXF, JSON, CSV, and high-resolution image formats (PNG, SVG, PDF) for reporting and external analysis tools.

Open Standards#

GraphQL (June 2018 specification): All graph queries, mutations, and real-time subscriptions (node merging, splitting, relationship creation, bookmark management) are exposed through a typed GraphQL API with camelCase field conventions and permission-class enforcement on every resolver.
GEXF 1.3 (Graph Exchange XML Format): Investigation graphs are exportable in GEXF 1.3, the open format maintained by the GEXF Working Group, enabling import into tools such as Gephi and NetworkX with full node, edge, weight, and colour metadata preserved.
GraphML: Graph export also supports GraphML, the XML-based graph interchange format defined by the yFiles/GraphML working group, for compatibility with external analysis and visualisation platforms.
W3C PROV-DM (Provenance Data Model): Every entity merge and split operation produces a structured provenance record aligned with the W3C PROV-DM model, capturing source entities, target entities, actor, timestamp, confidence score, and reversibility flag.
W3C SCXML / BPMN 2.0 (OMG): The investigation lifecycle state machine that governs graph operation permissions and audit-bound transitions is implemented against the W3C State Chart XML (SCXML) specification and follows BPMN 2.0 process semantics.
ISO 8601: All operation timestamps (merge, split, relationship creation, layout, bookmark) are serialised as ISO 8601 date-time strings throughout the graph service and exported metadata.
ETSI TS 103 701: AI-assisted attribute partitioning during node splitting exposes model provenance metadata in compliance with the ETSI Trustworthy AI standard, storing model identifier and organisation context on every AI-generated analytical record.

Last Reviewed: 2026-02-05 Last Updated: 2026-04-14