AI-Powered Criminal Network Analysis System

1. Executive Snapshot

Summary

The AI-Powered Criminal Network Analysis System addresses a fundamental challenge faced by Indian Law Enforcement Agencies (LEAs) under the Ministry of Home Affairs (MHA) and National Crime Records Bureau (NCRB) [PS]. Modern criminal syndicates, human trafficking networks, illegal narcotics rings, and organized crime operations targeting women and vulnerable groups do not operate in isolated silos; they leverage distributed associates, financial intermediaries, burner phones, multi-jurisdictional locations, and coordinated event timelines [PS]. While vast quantities of data exist across First Information Reports (FIRs), Call Detail Records (CDRs), financial transactions, and surveillance reports, the data remains fragmented, unstructured, and siloed across state boundaries [PS]. This system ingests structured and unstructured multi-source criminal intelligence, utilizes Natural Language Processing (NLP) for Indian legal texts and entity extraction, constructs a unified Knowledge Graph, executes Graph Analytics (centrality and community detection) to identify key syndicates/influencers, and provides investigators with interactive spatial-temporal visual insights and actionable intelligence dossiers.

Metadata Table

2. Problem Deconstruction

The explicit problem statement provided in the source JSON is broken down into atomic, traceable requirements below.

• [REQ-1] Multi-Source Data Collection & Ingestion [PS]

  • Source Text: "Collect and process data from multiple sources... FIRs and police reports, Call Detail Records (CDRs), Financial transaction records, Surveillance reports, Social media intelligence, Criminal history databases, Intelligence agency reports." [PS]
  • Interpretation: The system must accept heterogeneous file formats (PDFs, CSVs, JSONs, scanned text) from both structured databases and unstructured investigative narrative text [INFERENCE].
  • Implementation Implication: Ingestion pipeline with OCR capability, multi-format parsers (for CDR Excel/CSV exports), and robust ETL jobs feeding into a staging data store [INFERENCE].
  • Confidence Tag: [PS]

• [REQ-2] Named Entity Extraction (NER) [PS]

  • Source Text: "Extract important entities such as people, locations, vehicles, phone numbers, and organizations." [PS]
  • Interpretation: Automated extraction of domain-specific entities from bilingual/multilingual Indian legal text (English/Hindi) and structured logs [INFERENCE].
  • Implementation Implication: Custom NLP pipeline combining Transformer models (e.g., spaCy, IndicBERT, GLiNER) fine-tuned on legal/police terminology (e.g., IPC/BNS section references, Indian names, vehicle registration formats like DL-01-AB-1234, phone numbers, locations) [INFERENCE].
  • Confidence Tag: [PS]

• [REQ-3] Relationship Mapping & Knowledge Graph Construction [PS]

  • Source Text: "Build relationship maps showing how different entities are connected... uncover hidden networks and relationships among individuals, organizations, locations, and events." [PS]
  • Interpretation: Convert extracted entities and explicit database linkages into a graph structure where nodes represent entities and edges represent weighted, directional relationships (e.g., CO_ACCUSED_IN, CALLED, TRANSFERRED_MONEY_TO, PRESENT_AT_LOCATION) [INFERENCE].
  • Implementation Implication: Property Graph Database (e.g., Neo4j or Memgraph) paired with an automated Entity Resolution / Deduplication engine to merge duplicate entities across disparate cases [INFERENCE].
  • Confidence Tag: [PS]

• [REQ-4] Key Influencer & Kingpin Identification [PS]

  • Source Text: "Identify key individuals who play influential roles within criminal networks." [PS]
  • Interpretation: Graph analytics algorithms must quantify node influence beyond raw call counts or arrest frequency, exposing shadow handlers, financial bottlenecks, and central coordinators [INFERENCE].
  • Implementation Implication: Graph centrality algorithms (Betweenness Centrality, Eigenvector Centrality, PageRank, Degree Centrality) and community detection (Louvain / Leiden algorithms) [RESEARCHED].
  • Confidence Tag: [PS]

• [REQ-5] Suspicious Pattern & Anomaly Detection [PS]

  • Source Text: "Detect suspicious patterns and unusual activities." [PS]
  • Interpretation: Automated detection of known criminal typologies such as burner phone rotations, location co-presence during crime timestamps, circular money transfers, and sudden burst communications [INFERENCE].
  • Implementation Implication: Rule-based pattern matchers combined with graph anomaly detection (e.g., cycle detection, temporal path analysis) and isolated cluster detection [INFERENCE].
  • Confidence Tag: [PS]

• [REQ-6] Visual & Analytical Investigator Dashboard [PS]

  • Source Text: "Assist investigators by providing visual and analytical insights... actionable intelligence for investigators." [PS]
  • Interpretation: Non-technical police officers and investigators must easily interact with network graphs, query connections, view timeline maps, filter by date/location/crime-type, and generate court-ready investigative summaries [INFERENCE].
  • Implementation Implication: Web-based frontend with interactive force-directed graph visualization (e.g., Cytoscape.js, Vis.js, or NVd3/D3.js), GIS mapping integration (Leaflet/MapLibre), and automated PDF intelligence report generation [INFERENCE].
  • Confidence Tag: [PS]

3. Stakeholders & User Needs

4. Requirements Traceability

5. Constraints & Environment Realities

• Connectivity & Bandwidth: Police stations in rural or tier-3 districts often suffer from unstable network bandwidth [KNOWN]. System must support local client caching, compressed payload transfer, and batch synchronization [INFERENCE].
• Hardware Availability: District police stations operate on mid-range workstations (e.g., Intel i5, 8GB-16GB RAM) without dedicated GPU acceleration [ASSUMPTION]. AI/ML inference must be optimized (quantized CPU execution or lightweight models like ONNX/spaCy) [INFERENCE].
• Language & Literacy: FIRs and police reports in India are frequently written in regional languages (Hindi, Marathi, Tamil, Bengali, etc.) mixed with English legal terms (e.g., "Hinglish" or local legal jargon) [KNOWN].
• Data Fragmentation: Data resides across distinct silos (CCTNS for FIRs, ICJS for court/prison records, telecom operator portals for CDRs in diverse Excel formats) [RESEARCHED].
• Legal & Evidentiary Standards: In India, digital evidence must comply with Bharatiya Sakshya Adhiniyam (BSA), 2023 (formerly Section 65B of Indian Evidence Act) [RESEARCHED]. All graph modifications, node merges, and AI predictions must maintain an immutable audit log [INFERENCE].

6. Research Questions

1. What are the standard column structures and variance in CDR/IPDR CSV files provided by major Indian telecom service providers (Airtel, Reliance Jio, Vi, BSNL)? [RESEARCHED]
2. How does the implementation of Bharatiya Nyaya Sanhita (BNS), 2023—specifically Section 111 (Organised Crime) and Section 61 (Criminal Conspiracy)—impact the definition of criminal network edges and legal evidence aggregation? [RESEARCHED]
3. What entity resolution algorithms are most resilient against deliberate alias spelling variations and incomplete name records in Indian police documentation? [RESEARCHED]
4. What graph database engine (Neo4j vs. Memgraph vs. NetworkX) provides optimal performance, low resource consumption, and easy deployment for a 4-6 student hackathon build? [INFERENCE]
5. How can simulated or synthetic crime networks be generated to demonstrate realistic kingpin isolation and community detection during the SIH presentation without violating non-disclosure or data privacy laws? [INFERENCE]

7. Data Requirements & Sources

8. Existing Solutions & Gap Analysis

9. Candidate Solution Approaches

Approach 1: Classical Rule-Based & Relational SQL Pipeline

• Mechanism: Import CDRs and structured database records into a PostgreSQL database. Execute SQL queries with JOIN operations and pre-defined threshold rules (e.g., "Find pairs with >10 calls in 3 days").
• Pros: Simple, fast setup; low memory footprint; no AI model training required; predictable output.
• Cons: Exponential performance degradation on multi-hop graph queries (e.g., 4-hop connection between suspect and kingpin); cannot process unstructured narrative text in FIRs without manual tagging.
• Feasibility: High for hackathon, but fails key problem requirements for AI NLP entity extraction and graph analytics.

Approach 2: Deep Learning Graph Neural Network (GNN) + Pure LLM Pipeline

• Mechanism: Use Large Language Models (LLMs) for all entity and relationship extraction from FIR text, coupled with Graph Neural Networks (GNNs) for link prediction and node classification.
• Pros: Handles complex semantic relationships; state-of-the-art predictive capability for missing links.
• Cons: Very high computational requirement (GPUs needed); black-box explainability (unacceptable for court evidence); high risk of hallucination in relationship extraction; difficult to implement fully within a hackathon timeframe.
• Feasibility: Low for hackathon; high operational risk for legal deployment.

Approach 3: Hybrid Knowledge Graph + Localized NLP Transformer + Deterministic Graph Analytics (RECOMMENDED)

• Mechanism:
  1. Ingestion & NLP Layer: Fast, lightweight Named Entity Recognition using spaCy / GLiNER fine-tuned on legal entities (Person, Vehicle, Location, Phone, Org) to convert unstructured FIR narrative text into structured entity-relation triples.
  2. Storage Layer: Native Property Graph Database (Neo4j or Memgraph) to store entities as nodes and interactions as directed weighted edges.
  3. Entity Resolution Engine: Deterministic + fuzzy matching (Jaro-Winkler + Soundex + strict phone/vehicle ID rules) to deduplicate entities across multi-source files.
  4. Graph Analytics Engine: Algorithmic network analysis (Betweenness Centrality for gatekeepers/kingpins, Louvain for community/gang detection, Co-location graph algorithms).
  5. Presentation Layer: Interactive Cytoscape.js web dashboard with timeline spatial filters and automated intelligence report generator.
• Pros: Highly explainable (algorithms are deterministic and mathematically auditable); moderate hardware requirements (runs smoothly on CPU/RAM); completely covers all PS requirements; highly feasible for a student team build.
• Cons: Requires clean entity extraction rules; graph schema design must be meticulously planned.
• Feasibility: Exceptional for both SIH Hackathon MVP and real-world LEA production deployment.

10. Recommended Approach & Why

Selection

Approach 3: Hybrid Knowledge Graph + Localized NLP Transformer + Deterministic Graph Analytics is selected.

Justification

1. Mathematical & Legal Auditability: In criminal justice, evidence submitted under the Bharatiya Sakshya Adhiniyam (BSA), 2023 must be deterministic and verifiable. Algorithmic centrality measures (Betweenness, Eigenvector) provide mathematically provable metrics for identifying network hubs, whereas pure black-box LLMs or GNNs cannot justify why an individual was flagged without risk of hallucination [INFERENCE].
2. Multi-Source Synergy: This approach seamlessly unifies unstructured text (FIR narratives), structured communication logs (CDRs), and tabular data (Bank transactions) into a single Neo4j/Memgraph property graph schema [INFERENCE].
3. Hackathon Feasibility: The architecture avoids heavy GPU dependencies during inference. spaCy/GLiNER models and Neo4j graph algorithms execute rapidly on standard developer hardware, allowing the 4-6 student team to demonstrate real-time graph rendering and interactive querying during the SIH finale [INFERENCE].
4. Rejection of Alternatives: Approach 1 was rejected because SQL relational databases cannot efficiently compute multi-hop graph traversals and cannot extract entities from unstructured FIR text. Approach 2 was rejected due to heavy GPU hardware requirements, black-box unexplainability in legal settings, and high implementation complexity within the hackathon timeline [INFERENCE].

11. Technical Architecture

Layered Architecture Diagram

+-----------------------------------------------------------------------------------+
|                            PRESENTATION / USER INTERFACE                          |
|  +------------------------+  +------------------------+  +---------------------+  |
|  | Interactive Graph UI   |  | Temporal-Spatial Map   |  | Case Dossier Export |  |
|  | (Cytoscape.js / React) |  | (Leaflet.js / GeoJSON) |  | (PDF Generator)     |  |
|  +------------------------+  +------------------------+  +---------------------+  |
+------------------------------------------+----------------------------------------+
                                           | REST APIs / WebSocket
+------------------------------------------v----------------------------------------+
|                                APPLICATION SERVER (FastAPI)                       |
|  +------------------------+  +------------------------+  +---------------------+  |
|  | Authentication & AuthZ |  | Query & Search Engine  |  | Intelligence Module |  |
|  | (JWT, RBAC - IO/SP/Admin)| | (Cypher Query Builder) |  | (Pattern Detector)  |  |
|  +------------------------+  +------------------------+  +---------------------+  |
+------------------------------------------+----------------------------------------+
                                           | Internal Calls
+------------------------------------------v----------------------------------------+
|                            ANALYTICS & AI CORE ENGINE                             |
|  +------------------------+  +------------------------+  +---------------------+  |
|  | NLP Entity Extractor   |  | Entity Resolution      |  | Graph Analytics     |  |
|  | (spaCy / GLiNER / OCR) |  | (Fuzzy & Exact Match)  |  | (Centrality/Louvain)|  |
|  +------------------------+  +------------------------+  +---------------------+  |
+------------------------------------------+----------------------------------------+
                                           | Database Connectors
+------------------------------------------v----------------------------------------+
|                                DATA & STORAGE LAYER                               |
|  +-----------------------------------+  +--------------------------------------+  |
|  | Property Graph Database           |  | Relational / Audit Database          |  |
|  | (Neo4j / Memgraph - Nodes & Edges)|  | (PostgreSQL - Users, Audit Logs, Raw)|  |
|  +-----------------------------------+  +--------------------------------------+  |
+-----------------------------------------------------------------------------------+

Data Flow Narrative

1. Ingestion: An investigator uploads an investigative file (a PDF of an FIR narrative, a CSV of a CDR call log, or a banking XLSX statement) via the React UI.
2. Processing & Extraction:
   • Structured files (CDRs/Bank logs) pass through specialized Pandas parsers that normalize column headers (A-Party, B-Party, Timestamps, Duration, Cell IDs) into standard JSON schema.
   • Unstructured text files (FIRs/Intelligence notes) are processed by Tika/OCR and fed into the fine-tuned spaCy/GLiNER NLP pipeline to extract entities (Person, Location, Vehicle, Phone, Organization) along with contextual relationship triples.
3. Entity Resolution: Extracted entities pass through the Entity Resolution Engine. If "Ramesh Kumar" (Phone: 9876543210) matches an existing node in the graph via phone number or fuzzy name + alias match, the engine links the incoming data to the existing Person node rather than creating a duplicate.
4. Graph Persistence: Resolved entities and relationships are written into the Neo4j/Memgraph Graph Database as nodes and directed edges with associated property metadata (timestamps, case IDs, source file hashes).
5. Analytics Execution: The backend triggers Graph Data Science (GDS) algorithms:
   • Betweenness & Eigenvector Centrality identifying potential network influencers.
   • Louvain Community Detection grouping connected clusters (syndicates/gangs).
   • Pattern algorithms flagging co-location or rapid communication spikes.
6. Visualization & Insights: The React frontend queries the backend via REST/WebSocket APIs, rendering the filtered sub-graph using Cytoscape.js and displaying temporal movement tracks on Leaflet.js. The investigator can click any node/edge to view supporting evidence or click "Generate Dossier" to export an auditable PDF report.

12. Technology Stack

13. AI/ML Justification

1. NLP Named Entity Recognition (NER) Component

• Purpose: Automatically identify domain entities (Person, Location, Vehicle, Phone Number, Organization, Law Section) from unstructured narrative text in FIRs and intelligence notes.
• Model Type: Token classification model using spaCy / GLiNER (Generalist Lightweight NER transformer).
• Input: Unstructured legal narrative text (English / Hindi / Transliterated).
• Output: JSON array of extracted entities with character offsets and confidence scores.
• Data Required: Annotated sample of 200+ Indian police FIR sentences containing local names, locations, vehicle numbers, and statutory sections.
• Why AI is Preferable: Regular expressions (regex) fail on unstructured human narrative text, variable Indian name spellings, complex sentence syntax, and ambiguous context (e.g., distinguishing a victim's name from an accused's name).
• Evaluation: Precision, Recall, and F1-score on a held-out test set of FIR narratives.
• Failure Mode: Misclassification of entity type (e.g., labeling a location as a person's name).
• Human Oversight: The investigator UI highlights extracted entities in the text viewer, allowing the officer to manually correct, add, or un-tag entities before saving to the knowledge graph.

2. Graph Analytics & Key Influencer Identification Component

• Purpose: Calculate mathematical influence scores across the network to identify hidden kingpins, gatekeepers, and syndicate sub-groups.
• Model / Algorithm Type: Graph Algorithmic Centrality (Betweenness Centrality, Eigenvector Centrality) and Louvain Community Detection (Modularity Optimization).
• Input: Directed property graph (Nodes and Edges with weights).
• Output: Node centrality scores (0.0 to 1.0), community cluster assignments (Group IDs), and ranked influencer lists.
• Data Required: Graph topology constructed from merged case data.
• Why AI/Graph Analytics is Preferable: Manual visual inspection of a graph exceeding 30 nodes is impossible for humans to identify non-obvious bridge nodes connecting isolated sub-networks.
• Evaluation: Verification against ground-truth benchmark criminal graphs (e.g., synthetic syndicate test cases with known simulated leaders).
• Failure Mode: Over-estimating the importance of a peripheral node with high raw call volume (e.g., a customer care helpline or food delivery number).
• Human Oversight: Raw centrality scores are presented alongside contextual edge metadata (e.g., call duration, case severity), enabling the investigator to filter out benign high-degree nodes.

Where AI Should NOT Be Used

• Legal Case Verdicts or Guilt Determination: The system must NEVER auto-generate conclusions of guilt or recommend arrests [INFERENCE].
• Entity Deduplication Overrides: High-confidence merging of two distinct individuals (e.g., merging two people with the same name) must NOT occur automatically without human confirmation if phone/Aadhaar/PAN IDs are absent [INFERENCE].

14. Data Architecture & Offline/Low-Network Design

Graph Data Schema (Nodes & Edges)

[Person Node]
  - id: UUID
  - name: String
  - aliases: Array[String]
  - phone_numbers: Array[String]
  - aadhaar_hash: String
  - risk_score: Float

[Phone Node]
  - msisdn: String (Primary Key)
  - operator: String
  - imei_history: Array[String]

[Location Node]
  - id: UUID
  - address: String
  - latitude: Float
  - longitude: Float
  - cell_id: String

[Vehicle Node]
  - registration_no: String (Primary Key)
  - model: String
  - owner_name: String

[Event / FIR Node]
  - fir_number: String
  - police_station: String
  - date_registered: Date
  - bns_sections: Array[String]

-- RELATIONSHIPS (EDGES) --
(Person)-[:CO_ACCUSED_IN {case_id, role}]->(Event)
(Person)-[:USES_PHONE {since_date}]->(Phone)
(Phone)-[:CALLED {call_count, total_duration, last_timestamp}]->(Phone)
(Phone)-[:LOCATED_AT {timestamp}]->(Location)
(Person)-[:OWNS_VEHICLE]->(Vehicle)
(Person)-[:TRANSFERRED_FUNDS {amount, txn_id, timestamp}]->(Person)

Offline & Synchronization Strategy

• Local Caching: The React frontend uses IndexedDB (via LocalForage) to store recently queried network sub-graphs and map tiles locally.
• Bandwidth Reduction: Network queries return optimized JSON payloads containing only delta node/edge updates rather than full graph re-downloads.
• Air-Gapped / Local Deployment Mode: The entire stack (FastAPI, Neo4j, spaCy, React build) can run locally inside a single Docker container environment on a standalone police station workstation without requiring internet access [INFERENCE].

15. Security, Privacy & Governance

• Personal & Location Data Protection: System handles highly sensitive Personally Identifiable Information (PII) and location traces. All stored PII (Aadhaar numbers, PAN, phone numbers) must be encrypted at rest using AES-256 [INFERENCE].
• Role-Based Access Control (RBAC):
  • Investigating Officer (IO): Read/Write access restricted strictly to assigned cases and authorized district queries [INFERENCE].
  • Superintendent of Police (SP) / CID Analyst: Multi-district cross-case query access [INFERENCE].
  • System Administrator: User management and system logging only (no access to case evidence) [INFERENCE].
• Chain of Custody & Audit Logging: Every document ingestion, entity creation, manual node merge, search query, and report export is written to an append-only, immutable audit table in PostgreSQL containing user_id, timestamp, action, ip_address, and digital_signature_hash [INFERENCE].
• Compliance with Indian Laws:
  • System architecture respects the Digital Personal Data Protection (DPDP) Act, 2023 exemptions granted for lawful criminal investigations and national security [RESEARCHED].
  • Electronic evidence outputs provide metadata tracking (hash values) to assist officers in certifying evidence under Section 63 of Bharatiya Sakshya Adhiniyam (BSA), 2023 [RESEARCHED].

16. MVP Scope (Hackathon Build)

MUST BUILD (In Scope for SIH Demo)

• Multi-Source File Ingestion: Drag-and-drop web uploader accepting CDR CSV files (Airtel/Jio format) and FIR text files (English/Hindi).
• NLP Entity Extractor: Pre-trained/fine-tuned NER extracting Person names, Phone numbers, Locations, Vehicles, and BNS legal sections from text.
• Entity Resolution Engine: Deduplication matching identical phone numbers and fuzzy matching suspect names across multiple uploaded files.
• Neo4j Property Graph Store: Storing extracted entities, calls, co-accused links, and location co-presence.
• Graph Analytics Execution: Real-time calculation of Betweenness Centrality (identifying key influencers) and Louvain Community Detection (grouping gangs/clusters).
• Interactive Cytoscape.js UI: Dynamic visual node graph with node sizing based on centrality, click-to-expand connections, filtering by node type, and timeline slider.
• Automated PDF Intelligence Dossier: One-click generation of a summary PDF containing network metrics, key suspect profiles, and evidence connection logs.

SHOULD BUILD (If Time Permits)

• Spatial GIS Heatmap: Leaflet.js map displaying cell tower movements and location co-presence of suspects.
• Basic Financial Log Ingestion: CSV parser for mock bank transaction logs showing money flow edges.

DO NOT BUILD DURING HACKATHON (Out of Scope / Production Only)

• Direct live API integration with CCTNS / ICJS production national databases (requires government VPN certificates and restricted approvals) [RESEARCHED].
• Real-time automated CCTV facial recognition streams [INFERENCE].
• Full multi-lingual speech-to-text processing of wiretap audio recordings [INFERENCE].

17. Live Demo Simulation Plan

To present a compelling, technically rigorous live demonstration during the SIH evaluation without violating data privacy or requiring classified live feeds, the team will implement a transparent Real-Data Flow Simulation Strategy:

1. Simulated Multi-Source Investigation Case ("Operation Syndicate Track"):
   • Dataset 1: 3 uploaded FIR narrative text documents involving an organized extortion and human trafficking syndicate operating across 2 districts.
   • Dataset 2: 2 telecom CDR CSV files (1,500 rows matching standard Airtel/Jio formats) containing call logs between 12 suspects, burner numbers, and cell tower coordinates.
   • Dataset 3: 1 financial transaction CSV log showing money transfers across 5 accounts.
2. Live Execution Walkthrough:
   • Step 1: Upload raw, unlinked FIR text and CDR CSV files live on stage.
   • Step 2: Show the AI processing queue extracting entities and executing entity resolution in real time.
   • Step 3: Render the newly formed Knowledge Graph. Show how separate cases instantly merge into a single network topology.
   • Step 4: Click "Run Network Analysis" to trigger Louvain Community Detection and Betweenness Centrality. Watch the UI highlight the "Shadow Kingpin" node—a suspect who appears only 2 times in call logs but holds the highest betweenness score bridging two criminal cells.
   • Step 5: Adjust the Temporal Timeline Slider to demonstrate how the network expanded month-by-month.
   • Step 6: Click "Export Intelligence Dossier" to download the auto-generated PDF case report.
3. Transparency Notice: Explicitly state to judges: "Data displayed uses realistic, synthetic schemas modeled after standard CCTNS and Indian telecom CDR formats. The ingestion, entity extraction, graph analytics algorithms, and rendering engines are running 100% live on our local instance." [INFERENCE]

18. Implementation Roadmap

The team has a strict final deadline of 30 September 2026 [PS].

+-----------------------------------------------------------------------------------+
| PHASE 1: Architecture & Data Pipeline Setup (Days 1 - 5)                          |
| - Finalize Graph Schema (Neo4j) & Relational Audit Schema (PostgreSQL).           |
| - Build synthetic CDR generator & curate sample FIR text dataset.                 |
| - Set up FastAPI backend repo & React + Cytoscape.js boilerplate.                 |
+-----------------------------------------------------------------------------------+
                                         |
                                         v
+-----------------------------------------------------------------------------------+
| PHASE 2: Core Ingestion, NLP & Graph Storage (Days 6 - 12)                        |
| - Implement CSV parser for Airtel/Jio/Vi CDR formats.                             |
| - Train/Fine-tune spaCy/GLiNER model on Indian police FIR entity extraction.      |
| - Build Entity Resolution engine (exact phone match + Jaro-Winkler name match).   |
| - Wire ingestion pipeline to persist nodes & edges into Neo4j database.           |
+-----------------------------------------------------------------------------------+
                                         |
                                         v
+-----------------------------------------------------------------------------------+
| PHASE 3: Graph Analytics, UI Visualizer & Features (Days 13 - 19)                 |
| - Implement NetworkX / Neo4j GDS algorithms (Betweenness, Eigenvector, Louvain).  |
| - Build Cytoscape.js interactive graph UI (node selection, filtering, layouts).   |
| - Build Leaflet.js temporal-spatial map view & timeline range slider.             |
| - Implement ReportLab PDF case dossier generator.                                 |
+-----------------------------------------------------------------------------------+
                                         |
                                         v
+-----------------------------------------------------------------------------------+
| PHASE 4: Hardening, Testing & SIH Demo Preparation (Days 20 - 25)                 |
| - Execute end-to-end integration tests & false positive edge case validation.      |
| - Containerize application with Docker for seamless off-grid presentation.        |
| - Rehearse 10-minute live demo script and prepare judging Q&A presentation deck.  |
| - Final submission before 30 September 2026.                                      |
+-----------------------------------------------------------------------------------+

19. Testing & Validation Plan

• Functional Testing: Verify that CDR parsers correctly parse all standard telecom column variations without throwing runtime errors; ensure node insertion and Cypher queries return correct multi-hop neighbors.
• NLP Model Evaluation: Test entity extraction on 50 un-annotated sample FIR sentences. Target F1-Score: > 0.85 for Person, Phone, Location, and Vehicle entities.
• False Positive & Entity Resolution Testing: Run tests with intentionally confusing names (e.g., "Suresh Kumar" vs "Suresh Sharma", "Vijay" vs "Vijay Alias Kaalia"). Verify that the Entity Resolution Engine does NOT merge distinct people without matching phone/ID attributes.
• Graph Analytics Validation: Verify Louvain community detection and centrality outputs against ground-truth network graphs (e.g., Krackhardt kite graph benchmark) to ensure mathematical accuracy.
• Performance Testing: Benchmark graph rendering speed on Cytoscape.js with 1,000 nodes and 5,000 edges on an 8GB RAM CPU machine. Target rendering time: < 2.5 seconds.
• Offline Testing: Disconnect all internet interfaces and verify that local Docker deployment, graph querying, spatial map rendering (using offline cached tiles), and PDF dossier generation function without error.

20. Risk Register

21. Cost & Scalability

Hackathon Prototype

• Hardware Cost: ₹0 (built on students' existing laptops/workstations).
• Software & Licensing: ₹0 (100% open-source stack: React, FastAPI, Python spaCy, Neo4j Community Edition / Memgraph, PostgreSQL, Leaflet.js).
• Hosting / Deployment: ₹0 (Local Docker container execution on local judging hardware).

Production Deployment (State / National LEA Scale)

• Infrastructure: On-premise Government Data Centre (SDC / MeghRaj Cloud) dedicated server cluster (32-core CPUs, 128GB RAM, NVMe storage) [INFERENCE].
• Enterprise Graph DB Licensing: Neo4j Enterprise Edition or Memgraph Enterprise (if clustered high availability and enterprise RBAC are required) [INFERENCE].
• Scalability Path: Graph partitioning across state jurisdictions (e.g., state-level nodes with cross-state bridge edges replicated to central NCRB nodes) allowing horizontal scaling across millions of entities [INFERENCE].

22. Differentiation

23. Future Scope

1. Multilingual Voice Recording Integration: Adding automatic speech-to-text transcription (using models like Whisper fine-tuned on Indian accents/languages) to transcribe wiretapped call audio and automatically extract graph triples [INFERENCE].
2. Predictive Crime Linkage: Implementing Graph Convolutional Networks (GCNs) to predict unobserved relationships or forecast future target locations of organized syndicates [INFERENCE].
3. Cross-Agency Secure Data Federation: Utilizing privacy-preserving Federated Learning and zero-knowledge graph queries to allow inter-state police agencies to query matching cross-border entities without exposing un-charged target data [INFERENCE].

24. Assumptions & Open Items Log

Consolidated Assumptions [ASSUMPTION]

• The hackathon evaluation environment will run on standard consumer-grade laptops (Intel i5/i7, 8-16GB RAM) without requiring external dedicated GPUs.
• Synthetic datasets created by the team accurately mirror real-world Indian telecom CDR fields and NCRB CCTNS FIR narrative text structures.
• Open-source NLP frameworks (spaCy / GLiNER) can achieve sufficient F1-accuracy (>0.85) on domain-specific Indian legal and entity extraction tasks after light fine-tuning.

Consolidated Validation Items [NEEDS VALIDATION]

• Exact REST API authentication protocols and schema formats utilized by production CCTNS / ICJS systems for potential future integration.
• State-specific CDR export variations from smaller regional telecom providers or MVNOs in remote union territories.
• Formal MHA guidelines regarding deployment of containerized graph database instances on air-gapped district police station local servers.

Final Decision Summary

• Recommended Solution: Hybrid Knowledge Graph + Localized NLP Transformer + Deterministic Graph Analytics (Approach 3).
• Recommended Stack: React.js, Cytoscape.js, Leaflet.js, Python FastAPI, spaCy/GLiNER, Neo4j / Memgraph, PostgreSQL, ReportLab.
• Why This Approach Wins: It uniquely combines unstructured text entity extraction (FIRs) with structured log analysis (CDRs), providing mathematically explainable key influencer identification (centrality algorithms) in an interactive, air-gapped capable UI tailored to Indian LEA workflows.
• Biggest Dependency: Curating high-quality, realistic synthetic FIR narratives and CDR CSV files for training the NLP extractor and demonstrating multi-source graph merging during the live demo.
• Biggest Risk: Performance bottlenecks or UI cluttering when rendering large multi-hop graphs with over 1,000 entities. (Mitigated by default filtering and dynamic sub-graph loading).
• Biggest Technical Challenge: Building a robust Entity Resolution Engine that accurately deduplicates suspect aliases across disparate case files without introducing false-positive merges.
• First 5 Actions for Team:
  1. Define the Neo4j Graph Schema (Node types, Edge types, Property keys).
  2. Write a Python script to generate synthetic multi-source crime data (CDRs, FIR text, Bank logs) with a hidden criminal syndicate structure.
  3. Set up the FastAPI backend and initialize the Neo4j database connection.
  4. Train/fine-tune a spaCy / GLiNER pipeline on sample Indian police FIR text for entity extraction.
  5. Build the React + Cytoscape.js frontend workspace to render dynamic graph nodes and edges.
• Validation Before Coding: Test Neo4j Cypher query execution speed for Betweenness Centrality on a 2,000-node mock graph to confirm response times under 500ms on local CPU hardware.
• Buildability Score: 92/100 (Highly achievable within the build window by a skilled 4-6 student team using open-source tools).
• Confidence Level: High ([INFERENCE] supported by [PS], [KNOWN], and [RESEARCHED] evidence).

Research Sources

1. Crime and Criminal Tracking Network & Systems (CCTNS) / ICJS - Ministry of Home Affairs
   URL: https://digitalpolice.gov.in/DigitalPolice/AboutUs
   Source Type: Official Government Portal [1.1]
   Supported Claim: CCTNS inter-links 17,000+ police stations nationwide; ICJS integrates Police, Courts, Prisons, Forensics, and Prosecution.
   Reliability: Official Government Source.

2. New Features in CCTNS / ICJS & Women Safety Division - MHA
   URL: https://www.mha.gov.in/en/divisionofmha/women-safety-division/cctns
   Source Type: Official Government Documentation [1.2]
   Supported Claim: Women Safety Division oversees CCTNS/ICJS analytics, criminal link analysis modules, and national database repositories.
   Reliability: Official Government Source.

3. India Launches AI Database To Track Organised Crime (OCND) - MHA / NIA
   URL: https://openthemagazine.com/india/digital-dragnet-inside-indias-first-national-organised-crime-database
   Source Type: Reputable News / Defense Coverage [3.6]
   Supported Claim: In December 2025, MHA/NIA launched the Organised Crime Network Database (OCND) to connect cross-border criminal records using AI.
   Reliability: High.

4. Bharatiya Nyaya Sanhita (BNS), 2023 & New Criminal Laws Framework - Ministry of Home Affairs
   URL: https://www.mha.gov.in/sites/default/files/250883_english_01042024.pdf
   Source Type: Official Legislative Gazette [4.1]
   Supported Claim: BNS Section 111 defines Organised Crime; BNSS and BSA (2023) govern digital evidence, e-FIRs, and forensic requirements replacing IPC/CrPC/Evidence Act.
   Reliability: Official Government Gazette.

5. Graph Databases for Crime-Fighting & Network Analysis
   URL: https://memgraph.com/blog/graph-databases-crime-fighting-memgraph-criminal-networks
   Source Type: Official Technology Documentation [3.8]
   Supported Claim: Property graph databases, centrality algorithms, and Louvain community detection effectively uncover hidden links in criminal and intelligence networks.
   Reliability: High.