Back to Details

link-analysis-graphing

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Link Analysis & Graphing

链接分析与图谱构建

Once selectors multiply, a graph makes hidden connections obvious. Model the investigation as entities (nodes) and relationships (edges).
当选择器数量增多时，图谱能让隐藏的关联一目了然。将调查建模为实体（节点）和关系（边）。

Model

模型

  • Nodes — each selector/entity: person, username, email, phone, domain, IP, wallet, company, address, device.
  • Edges — the relationship and its evidence: 
    owns
    , 
    registered
    , 
    posted-from
    , 
    employed-by
    , 
    same-photo-as
    , 
    transacted-with
    . Label edges with source and confidence.
  • 节点 —— 每个选择器/实体：人员、用户名、邮箱、电话、域名、IP、钱包、公司、地址、设备。
  • 边 —— 关系及其证据：
    owns
    、
    registered
    、
    posted-from
    、
    employed-by
    、
    same-photo-as
    、
    transacted-with
    。为边标注来源和可信度。

Tools

工具

  • Maltego — the standard; transforms auto-pivot from a node (e.g., domain → subdomains → IPs → certs). Community edition for light use.
  • Graph DBs / viz — Neo4j, Gephi, or Obsidian's graph for a manual approach.
  • Spreadsheet fallback — an entity table + a relationship table (source, target, type, evidence) is enough for most cases and exports to any tool.
  • Maltego —— 行业标准工具；可从节点自动关联拓展（例如：域名 → 子域名 → IP → 证书）。轻量使用可选择社区版。
  • 图数据库/可视化工具 —— Neo4j、Gephi，或Obsidian的图谱功能，适用于手动构建场景。
  • 备选方案：电子表格 —— 一张实体表 + 一张关系表（来源、目标、类型、证据）足以应对大多数情况，且可导出至任意工具。

Method

方法

  1. Log every selector as a node the moment you find it, with its source.
  2. Draw an edge for each confirmed relationship; keep unconfirmed ones dashed.
  3. Look for high-degree nodes (a reused email or photo linking many accounts) — these are the strongest attribution pivots.
  4. Look for bridges connecting otherwise separate clusters — often the key finding (the link between two personas).
  5. Let gaps in the graph drive the next pivot.
  1. 找到每个选择器时立即将其作为节点记录，并标注来源。
  2. 为每个已确认的关系绘制边；未确认的关系用虚线表示。
  3. 寻找高连通度节点（例如关联多个账户的重复邮箱或照片）—— 这些是最有力的归因关联点。
  4. 寻找桥接节点——连接原本独立集群的节点，通常是关键发现（例如两个角色之间的关联）。
  5. 利用图谱中的空白区域指导下一步的关联拓展。

Payoff

成效

The graph both guides the investigation and becomes the entity map in 
osint-report
. Keep confidence on every edge so the picture stays honest.
图谱既能引导调查进程，也会成为
osint-report
中的实体图谱。为每条边标注可信度，确保图谱信息真实可靠。