An Introduction to Graph Theory for OSINT

### Demystifying Graph Theory for Security Analysts At 00:00, security executive Andrew Hay introduces graph theory concepts tailored for cybersecurity and OSINT practitioners without requiring advanced mathematical training. Drawing from his experience leading data science and research teams at OpenDNS, Hay emphasizes that graph theory provides an intuitive, high-leverage framework for making sense of complex threat data.

### Nodes, Vertices, and Relational Edges At 02:00 and 06:00, Hay breaks down fundamental graph components: vertices (nodes) representing discrete entities—such as domain names, IP addresses, email handles, or cryptographic hashes—and edges representing the relationships connecting them (e.g., DNS resolution, WHOIS registration, or network traffic). He contrasts directed and undirected graphs, showing how edge orientation reflects data flow and communication hierarchy.

### Graph Centrality and Choke Point Identification At 09:00 and 15:00, the presentation explores graph centrality metrics that help investigators prioritize intelligence assets. Hay explains degree centrality (measuring total direct connections), betweenness centrality (identifying bridge nodes that control data flow between distinct clusters), and closeness centrality, illustrating how these metrics pinpoint threat actor infrastructure hubs and single points of failure.

### Open-Source Graph Tooling and Workflow Integration At 18:00 and 24:00, Hay reviews accessible graph analysis tools, highlighting Gephi, Graphviz, Maltego transforms, Neo4j, and Python NetworkX. He demonstrates how analysts can convert flat CSV datasets, network flow logs, and OSINT dumps into interactive graph databases to reveal non-obvious clusters and shared infrastructure.

### Intelligence Hygiene and Avoiding Graph Poisoning Concluding between 33:01 and 34:01, Hay delivers a crucial warning regarding threat intelligence hygiene. Because graph algorithms amplify connections, analysts must critically evaluate crowd-sourced feeds and automated transforms. Feeding unverified honeypot alerts or contaminated public lists into graph models can generate misleading clusters, reinforcing the necessity of human verification during OSINT investigations.

(AI summary — Gemini Flash)