Enhancing Investigative Pattern Detection via Inexact Matching and Graph Databases

• Published in: IEEE transactions on services computing Vol. 15; no. 5; pp. 2780 - 2794
• Main Authors: Muramudalige, Shashika R., Hung, Benjamin W. K., Jayasumana, Anura P., Ray, Indrakshi, Klausen, Jytte
• Format: Journal Article
• Language: English
• Published: Piscataway IEEE 01-09-2022; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Crime; Data mining; Datasets; graph databases; Graph matching; graph pattern matching; Graphs; inexact matching; investigative graph search; Knowledge representation; Libraries; Mental health; National security; Pattern matching; Social networking (online); Social networks; Task analysis; Terrorism
• ISSN: 1939-1374; 1939-1374; 2372-0204
• DOI: 10.1109/TSC.2021.3073145

Tracking individuals or groups based on their hidden and/or emergent behaviors is an indispensable task in homeland security, mental health evaluation, and consumer analytics. On-line and off-line communication patterns, behavior profiles and social relationships form complex dynamic evolving knowledge graphs. Investigative search involves capturing and mining such large-scale knowledge graphs for emergent profiles of interest. While graph databases facilitate efficient and scalable operations on complex heterogeneous graphs, dealing with incomplete, missing and/or inconsistent information and need for adaptive querying pose major challenges. We address these by proposing an inexact graph pattern matching method, which is implemented in a graph database with a scoring mechanism that helps identify hidden behavioral patterns. PINGS ( P rocedures for IN vestigative G raph S earch), a graph database library of procedures for investigative graph search is presented. Results presented demonstrate the capability of detecting individuals/groups meeting query criteria as well as the iterative query performance in graph databases. We evaluate our approach on three datasets: a synthetically generated radicalization dataset, a publicly available patient's ICU hospitalization stays dataset, and a crime dataset. These varied datasets demonstrate the wide-range applicability and the enhanced effectiveness of observing suspicious or latent trends in investigative domains.