Criminal network analysis can identify criminal leaders with 92% accuracy—a level of precision that manual investigation rarely achieves. But even with this mathematical precision, the volume of insights generated from criminal networks can overwhelm human analysts, leaving critical intelligence buried in complex data relationships.
The breakthrough comes when network analysis is combined with large language models for automatic report generation.
While algorithms can identify key players and organisational structures with unprecedented accuracy, manual examination of social networks remains “difficult, time-consuming, and arbitrary, making it more prone to error,” according to the FBI Law Enforcement Bulletin.
The challenge isn’t just discovering criminal relationships. It’s synthesising vast amounts of network intelligence into actionable reports that investigators can immediately use.
A two-phase technology solution
Knowledge graphs solve the first challenge by consolidating intelligence from multiple sources into a unified network structure. Every offender, crime, location, and time becomes a connected data point, revealing the complete landscape of criminal relationships.
Sophisticated algorithms then identify criminal communities, rank individual influence, and map operational structures with the precision that enabled police to collapse entire organisations through targeted arrests.
Large language models address the second challenge: transforming network intelligence into comprehensive analytical reports.
Even with mathematically precise network analysis, the resulting insights about group composition, temporal patterns, geographic territories, and operational hierarchies generate more information than human analysts can effectively process and synthesise.
LLMs analyse complex network insights across multiple dimensions simultaneously and generate professional intelligence reports that translate mathematical precision into practical guidance.
Case study: Chicago crime data
This article presents the results of our implementation study using real criminal data from the Chicago Police Department, publicly available through the City of Chicago’s data portal.
Our analysis utilised comprehensive crime records spanning over two decades (2001 to present) and detailed arrest data, along with geographic intelligence including police districts, beats, and community areas. This dataset mirrors the exact data structure and content that law enforcement agencies maintain in their daily operations, making our findings immediately applicable to existing police information systems.
Using authentic operational data rather than synthetic or academic datasets demonstrates that this framework performs effectively with the messy, incomplete, and complex information that characterises real criminal investigations.
The Chicago dataset includes over 7 million crime records and hundreds of thousands of arrest records, providing sufficient scale to validate the approach across different crime types, geographic areas, and temporal patterns.
Because the underlying data structure matches what police departments already collect, agencies can implement this framework without requiring new data collection processes or significant changes to existing information systems.
The integration framework
The framework operates through two distinct phases that transform raw criminal data into actionable intelligence reports.
The first is automated network analysis that identifies criminal groups and their structures. The second is AI-powered criminal network analysis synthesis that generates comprehensive operational assessments.
This two-phase approach ensures mathematical rigour in pattern detection, maintains clear explainability of the results, and delivers human-readable intelligence output that investigators can act on immediately.
Phase 1: Knowledge graph-powered criminal analysis
The first phase constructs and analyses the criminal network to identify organised groups and their internal structures.
The process begins by creating co-offending networks from arrest and investigation records. It connects individuals who have committed crimes together or within similar time frames and locations. This network projection reveals collaboration patterns that indicate organised criminal activity.
Community detection algorithms then automatically identify distinct criminal groups within the larger network, recognising clusters of offenders who demonstrate strong collaborative relationships and effectively mapping the boundaries of different criminal organisations.
Once groups are identified, network analysis techniques examine each organisation’s internal structure, revealing the roles different members play: leaders who coordinate activities, or bridges who connect subgroups.
This phase delivers precise intelligence about criminal organisations: who belongs to which group, how groups are structured internally, and which individuals hold positions of influence or operational importance. The mathematical analysis removes human bias and processes relationship patterns across datasets too large for manual criminal network analysis.
Phase 2: AI-powered intelligence synthesis
The second phase extracts detailed information about a selected criminal group and processes it through specialised AI agents that generate a comprehensive intelligence report.
For the group in question, the system compiles member demographics, criminal histories, network positions, offence patterns, and operational characteristics.
A LangGraph architecture coordinates multiple AI agents, each focused on specific analytical dimensions.
- The demographic analyst examines group composition, member backgrounds, and recruitment patterns.
- The temporal analyst tracks the evolution of criminal activity, identifying periods of increased operations or organisational changes.
- The geographic analyst maps territorial patterns, operational zones, and movement behaviours.
Each agent operates like a specialised detective unit, focusing expertise on a specific analytical domain. A final aggregator agent then synthesises findings from all specialists into a unified intelligence report, reconciling different analytical perspectives into a coherent whole.
Operational benefits
This structured approach provides several operational benefits.
The division of responsibilities between mathematical network analysis and AI-powered criminal network analysis synthesis ensures both analytical rigour and practical usability.
The specialised AI agents deliver more accurate insights than general-purpose analysis while maintaining explainable, focused reasoning grounded in specific data points.
The modular architecture allows law enforcement agencies to customise analysis depth and focus areas based on specific operational needs.
Most importantly, the framework produces consistent, reproducible intelligence that investigators can verify and build upon. Given identical input data, the system generates reports with stable analytical conclusions, consistent identification of key players, and reliable pattern recognition. Minor variations in phrasing or presentation do not affect the core intelligence insights.
This transforms criminal network analysis from an art dependent on individual expertise into a systematic capability that scales across different cases and jurisdictions.
About this series
This article is part of a series exploring how combining knowledge graphs and LLMs can speed up criminal network analysis:
- Article 1: Extracting meaningful relationships from raw data through knowledge graph construction
- Article 2: Applying graph data science algorithms to reveal criminal group structures and hierarchies
- Article 3: Deploying specialised AI agents to synthesise network insights into professional intelligence products
- Article 4: Lessons learned and next steps for advancing this approach
Knowledge Graphs and LLMs in Action
To read more about techniques that combine knowledge graphs and LLMs, read our book from Manning.
Read
