NETWORK Procedure

The goal of link prediction is to recover missing links—connections that are likely to exist between nodes but have not been recorded because of incomplete data. This example considers a network of 168 nodes and 219 links, where nodes represent individuals and links represent wiretap records. The data set is based on information from operation Oversize, an Italian criminal case against a mafia group that was involved in international drug trafficking, homicides, and robberies (Berlusconi et al. 2016). This network, an undirected graph G, is shown in Figure 243.

Figure 243: Wiretap Network G

The data that are created by the following DATA step provide the connections that were obtained through wiretapping:

data mylib.LinkSetInWR;
   input from $ to $ @@;
   datalines;
n8   n5     n9   n1     n9   n7     n10  n9     n11  n9     n17  n9
n19  n13    n20  n9     n21  n3     n21  n13    n21  n18    n24  n13
n24  n19    n26  n6     n26  n15    n26  n25    n27  n15    n27  n16
n27  n23    n27  n26    n28  n27    n29  n9     n30  n27    n31  n9
n32  n21    n33  n9     n33  n17    n34  n5     n34  n12    n34  n21
n35  n5     n35  n22    n36  n27    n36  n28    n37  n9     n38  n14
n39  n1     n39  n13    n39  n19    n39  n24    n40  n39    n41  n34
n41  n38    n42  n38    n43  n19    n43  n24    n43  n39    n43  n40
n45  n16    n45  n26    n45  n27    n45  n28    n45  n36    n46  n34
n47  n5     n48  n5     n48  n19    n48  n39    n48  n40    n48  n43
n49  n5     n49  n9     n49  n14    n49  n26    n49  n39    n50  n27
n50  n35    n50  n38    n50  n49    n52  n34    n53  n39    n53  n43
n54  n40    n55  n9     n56  n9     n57  n21    n58  n48    n59  n27
n60  n14    n61  n43    n63  n9     n63  n27    n63  n48    n63  n49
n64  n43    n65  n44    n66  n9     n67  n21    n69  n45    n70  n21
n71  n9     n71  n49    n72  n9     n73  n23    n74  n43    n75  n21
n76  n27    n77  n23    n77  n27    n77  n50    n77  n76    n78  n9
n80  n33    n82  n48    n84  n27    n84  n50    n86  n14    n87  n27
n88  n40    n89  n19    n89  n24    n90  n39    n92  n5     n92  n14
n93  n19    n94  n14    n95  n24    n96  n14    n97  n43    n98  n14
n100 n26    n100 n27    n101 n21    n102 n75    n103 n27    n104 n19
n105 n19    n106 n41    n108 n10    n109 n21    n110 n44    n111 n9
n112 n9     n113 n9     n114 n27    n115 n19    n117 n19    n117 n24
n118 n27    n118 n45    n119 n21    n120 n9     n121 n34    n122 n38
n124 n39    n124 n43    n125 n40    n126 n40    n127 n34    n128 n39
n129 n40    n129 n51    n131 n34    n132 n27    n133 n38    n134 n38
n135 n40    n136 n27    n137 n50    n138 n38    n139 n48    n140 n27
n140 n36    n140 n45    n140 n118   n141 n50    n142 n27    n143 n39
n144 n48    n145 n9     n146 n48    n146 n143   n147 n13    n147 n39
n147 n43    n147 n48    n148 n39    n149 n9     n149 n43    n150 n48
n151 n9     n152 n34    n152 n50    n153 n34    n155 n14    n155 n133
n156 n9     n157 n9     n158 n9     n158 n49    n158 n133   n159 n9
n160 n35    n160 n49    n160 n81    n160 n84    n160 n85    n161 n40
n161 n43    n161 n125   n162 n9     n163 n27    n164 n33    n165 n9
n166 n35    n167 n40    n168 n40    n169 n40    n171 n43    n172 n19
n173 n79    n174 n27    n175 n27    n176 n9     n177 n27    n178 n49
n180 n14    n181 n27    n182 n44
;

The persons of interest—the two main traffickers within the criminal network, n49 and n27; the drug dealer n13; n49’s brother and drug dealer, n50; and n118, the wife of a known drug dealer—are selected as a node subset to probe what other people in the network they are likely to be connected to.

The following statements define the nodes that are the sources of the new predicted links, with all other nodes as candidates:

data mylib.NodeSubSetIn;
   input node $ source;
   datalines;
n27  1
n49  1
n13  1
n50  1
n118 1
;

The following statements produce the output data table mylib.NodeSim, which contains the Jaccard similarity between the nodes in the input subset and all other nodes; higher similarity scores indicate a higher probability of connection.

proc network
   links            = mylib.LinkSetInWR
   nodesSubset      = mylib.NodeSubSetIn;
   nodeSimilarity
      outSimilarity = mylib.NodeSim;
run;

To select the best candidate links for investigators, the following steps determine five links that have the highest Jaccard coefficient for each of the nodes in the subset:

data NodeSim;
   set mylib.NodeSim;
run;
data LinkSetInWR;
   set mylib.LinkSetInWR;
run;

proc sql;
   create table PredictedLinks as
   select * from NodeSim
   where link=0 and source ne sink;
quit;
proc sort data=PredictedLinks;
   by source descending jaccard;
run;

data PredictedLinksTop5;
   retain count 0;
   set PredictedLinks;
   by source;
   if first.source then count=0;
   count=count+1;
   if count <= 5;
run;

Output 2.17.1 displays the output data table PredictedLinksTop5.

The predicted links are highlighted as bold and colored (by source node) in the illustration in Figure 244. Many of these predicted links have additional support from other sources of information, according to Berlusconi et al. (2016). For example, n49 and n48 lived in the same area and had key roles in the drug distribution; the husband of used to buy cocaine from n36; the link between n13 and n43 had been confirmed by further investigation; and so on.

Figure 244: Predicted Links