<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-social-network-analysis
description: >-
  Map relationships, influence networks, and communication patterns from social
  media data using graph analysis. Identify key nodes, communities, and
  information flow patterns across platforms.
domain: cybersecurity
subdomain: investigation-attribution
tags:
  - social-network-analysis
  - graph-analysis
  - networkx
  - gephi
  - osint
  - influence-mapping
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1593.001"]
---

# Conducting Social Network Analysis

## Overview

Social network analysis maps relationships between individuals, organizations,
and accounts to reveal hidden connections, influence patterns, and coordinated
behavior. Uses graph theory to identify key actors, communities, and
information propagation paths.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling |
| NetworkX | `pip install networkx` |
| Gephi | Desktop install from `gephi.org` |

## Key Concepts

### Graph Metrics

| Metric | What It Reveals |
|---|---|
| **Degree centrality** | Most connected nodes (hubs) |
| **Betweenness centrality** | Bridge nodes connecting communities |
| **Closeness centrality** | Nodes that can reach others fastest |
| **PageRank** | Most influential nodes |
| **Community detection** | Clusters of closely connected nodes |

### Data Collection Sources

| Platform | Data Type | Collection Method |
|---|---|---|
| Twitter/X | Followers, mentions, retweets | API, scraping |
| Telegram | Group members, message forwards | Export, API |
| Facebook | Friends, group members, reactions | Manual collection |
| LinkedIn | Connections, company affiliations | Manual collection |
| VKontakte | Friends, group members | API |

## Quick Reference

```bash
# Build network from contacts data
node agent.js build-graph --input contacts.json --output network.gexf

# Analyze network metrics
node agent.js analyze --graph network.gexf --metrics degree,betweenness,pagerank

# Detect communities
node agent.js communities --graph network.gexf --algorithm louvain

# Find shortest path between nodes
node agent.js path --graph network.gexf --source "user_a" --target "user_b"
```

## Workflow

```
1. COLLECT    — Gather relationship data from target platforms
2. NORMALIZE  — Standardize node and edge formats
3. BUILD      — Construct graph from normalized data
4. ANALYZE    — Calculate centrality metrics and PageRank
5. CLUSTER    — Run community detection algorithms
6. VISUALIZE  — Export to Gephi for interactive exploration
7. INTERPRET  — Identify key actors, bridges, and communities
8. DOCUMENT   — Report findings with graph evidence
```

## Detection

```yaml
title: Social Network Analysis Detection
id: 85481e4e-cf2b-4442-a16f-28555920d202
status: experimental
description: Detects suspicious activity related to conducting social network analysis techniques in investigation attribution context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1593.001
  - attack.command_and_control
falsepositives:
  - Threat intelligence enrichment services querying external APIs
```

## Verification

```bash
python3 -c "import networkx; print(f'NetworkX {networkx.__version__}')"
node agent.js --self-test
```

## References

- [NetworkX Documentation](https://networkx.org/documentation/stable/)
- [Gephi User Guide](https://gephi.org/users/)
- [Bellingcat Social Media Guide](https://www.bellingcat.com/resources/)
