Combine knowledge graphs and large language models to speed up criminal network analysis

The breakthrough comes when network analysis combines with large language models for automatic report generation. While algorithms can identify key players and organizational structures with unprecedented accuracy, manual examination of social networks remains “difficult, time consuming, and arbitrary, making it more prone to error,” according to the FBI Law Enforcement Bulletin. The challenge isn’t just discovering criminal relationships—it’s synthesizing vast amounts of network intelligence into actionable reports that investigators can immediately use.

A two-phase technology solution

Knowledge graphs solve the first challenge by consolidating intelligence from multiple sources into a unified network structure. Every offender, crime, location, and time becomes a connected data point, revealing the complete landscape of criminal relationships. Sophisticated algorithms then identify criminal communities, rank individual influence, and map operational structures with the precision that enabled police to collapse entire organizations through targeted arrests.

Large language models (LLMs) address the second challenge—transforming network intelligence into comprehensive analytical reports. Even with mathematically precise network analysis, the resulting insights about group composition, temporal patterns, geographic territories, and operational hierarchies generate more information than human analysts can effectively process and synthesize. LLMs excel at analyzing these complex network insights across multiple dimensions simultaneously, producing professional intelligence reports that translate mathematical precision into tactical guidance.

Case study: Chicago crime data

This article presents the results of our implementation study using real criminal data from the Chicago Police Department, publicly available through the City of Chicago’s data portal. Our analysis utilized comprehensive crime records spanning over two decades (2001-present) and detailed arrest data, along with geographic intelligence including police districts, beats, and community areas. This dataset mirrors the exact data structure and content that law enforcement agencies maintain in their daily operations, making our findings immediately applicable to existing police information systems.

The use of authentic operational data—rather than synthetic or academic datasets—demonstrates that this technology framework performs effectively with the messy, incomplete, and complex information that characterizes real criminal investigations. The Chicago dataset includes over 7 million crime records and hundreds of thousands of arrest records, providing sufficient scale to validate the approach across different crime types, geographic areas, and temporal patterns.

Because the underlying data structure matches what police departments already collect—incident reports, arrest records, geographic codes, and temporal information—agencies can implement this framework without requiring new data collection processes or significant changes to existing information systems.

The integration framework

The framework operates through two distinct phases that transform raw criminal data into actionable intelligence reports:

1. automated network analysis that identifies criminal groups and their structures,
2. followed by AI-powered synthesis that generates comprehensive operational assessments.

This two-phase approach ensures mathematical rigor in pattern detection, not guesswork, while maintaining clear explainability of the results, and delivering human-readable intelligence output that investigators can immediately act upon.

Phase 1: KG-powered criminal analysis

The first phase constructs and analyzes the criminal network to identify organized groups and their internal structures.

The process begins by creating co-offending networks from arrest and investigation records. It connects individuals who have committed crimes together or within similar timeframes and locations. This network projection reveals collaboration patterns that indicate organized criminal activity.

Community detection algorithms then automatically identify distinct criminal groups within the larger network. These algorithms recognize clusters of offenders who demonstrate strong collaborative relationships, effectively mapping the boundaries of different criminal organizations. Once groups are identified, network analysis techniques examine each organization’s internal structure, revealing the roles different members play: leaders who coordinate activities or bridges who connect subgroups.

This phase delivers precise intelligence about criminal organizations: who belongs to which group, how groups are structured internally, and which individuals hold positions of influence or operational importance. The mathematical analysis removes human bias and processes relationship patterns across datasets too large for manual analysis.

Phase 2: AI-powered intelligence synthesis

The second phase extracts detailed information about a selected criminal group and processes it through specialized AI agents that generate a comprehensive intelligence report. For the group requested, the system compiles member demographics, criminal histories, network positions, offense patterns, and operational characteristics.

A LangGraph architecture coordinates multiple AI agents, each focused on specific analytical dimensions.

• The demographic analyst examines group composition, member backgrounds, and recruitment patterns.
• The temporal analyst tracks the evolution of criminal activity, identifying periods of increased operations or organizational changes.
• The geographic analyst maps territorial patterns, operational zones, and movement behaviors.

Each agent, using specific prompts that instructs LLMs properly, operates like a specialized detective unit, focusing expertise on their specific analytical domain. A final aggregator agent synthesizes findings from all specialists into a unified intelligence report. This agent reconciles different analytical perspectives in a compelling report.

Operational benefits

This structured approach provides several operational benefits. The division of responsibilities between mathematical network analysis and AI-powered synthesis ensures both analytical rigor and practical usability. The specialized AI agents deliver more accurate insights than general-purpose analysis while maintaining explainable and focused reasoning based on specific data points. The modular architecture allows law enforcement agencies to customize analysis depth and focus areas based on specific operational needs.

Most importantly, the framework produces consistent, reproducible intelligence that investigators can verify and build upon. By reproducible, we mean that given identical input data, the system generates reports with stable analytical conclusions, consistent identification of key players, and reliable pattern recognition—while minor variations in phrasing or presentation do not affect the core intelligence insights. This transforms criminal network analysis from an art dependent on individual expertise into a systematic capability that scales across different cases and jurisdictions.

If you would like to read more about techniques that combine knowledge graphs and LLMs, read our book from Manning.

If you would like to know more about Hume, the graph-powered link analysis software we used for our study, visit our website.

If you’d like to explore the ideas shared in this article in more depth, we’d be delighted to connect in person. Visit us at the AIPIO Intelligence Conference 2025 in Australia and discover how GraphAware is transforming intelligence analysis with cutting-edge graph technology. Arrange a meeting here.