Social Network Analysis

Social network analysis (SNA) treats people as nodes and their interactions (replies, mentions, follows, trades) as edges, then uses graph theory to answer social questions. Who matters? Which groups exist? How does an idea or a behaviour travel? My supervisor suggested it in the first meeting of my dissertation, and I wrote “look into what SNA is” on my to-do list. It ended up being one of the most useful things I learnt.

The core measures

Question	Measure
Who’s connected to the most people?	Degree centrality
Who sits on the paths between groups (the brokers)?	Betweenness centrality
Who’s connected to other important people?	Eigenvector centrality / PageRank
How tightly knit is someone’s neighbourhood?	Clustering coefficient: how many of your contacts know each other
Which groups exist?	Community detection

Finding communities: the Louvain method

Louvain (Blondel et al., 2008) is the workhorse for community detection. It greedily optimises modularity (how much denser the connections inside communities are than you’d expect by chance) in two repeating steps:

1. Move each node into whichever neighbouring community most improves modularity.
2. Collapse each community into a single node and repeat on the smaller graph.

It’s fast enough for millions of nodes and gives a hierarchy of communities at different scales.

Bipartite graphs are another useful trick: users on one side, forums or products on the other. They show which communities share members, which is the raw material for a question like “do people move from one community to another?”

SNA in cybercrime research

The papers I read for Pathways into Cybercrime combined SNA with text analysis:

• A study of underground marketplaces on a Chinese-language forum platform built topic-based social networks, used Louvain to find communities, then scored and classified key members. Influential sellers tended to have young accounts and many posts, consistent with people rotating identities to avoid detection.
• Datta and Adar (2019) built networks of conflict between subreddits (one community “attacking” another), and used clustering coefficients to characterise them.
• Research on Anonymous’ presence on Twitter (ICWSM, 2020) used centrality measures to map how influence was distributed in a leaderless group.

The pattern across all of them: topic models tell you what’s being said; networks tell you who’s saying it to whom. You want both. Topic modelling is covered in Topic Modelling with LDA.

The trade-offs

• The edges you choose are the analysis. A reply network and a co-membership network of the same forum tell different stories.
• Deleted and banned accounts leave holes, especially in exactly the communities researchers care about.
• Ethics: centrality scores single out individuals. Publish patterns, not people (Mining Reddit for Research).

Where it took me

Years later I led the build of a network graph library for telecoms networks. Different nodes (routers, not people), same toolkit: centrality for importance, clustering and grouping for readability, aggregation of parallel edges, and a renderer that copes with thousands of nodes (Graph Visualisation Libraries, Building a Graph Component Library). Graph thinking is one of the most portable skills I have.

Sources

• Blondel, V. et al. (2008). Fast unfolding of communities in large networks. Journal of Statistical Mechanics.
• Datta, S. and Adar, E. (2019). Extracting inter-community conflicts in Reddit. ICWSM.
• Behind the Mask: A Computational Study of Anonymous’ Presence on Twitter (2020). ICWSM.
• Exploring the online underground marketplaces through topic-based social network and clustering (journal article).