Development of Crawling and Knowledge Graph Technologies for Tracking Organized Sexual Offenses on Social Media X

Abstract

The high accessibility and interconnectedness of social media platforms have led to their increasing exploitation as tools for criminal activity. A notable example of such digital sexual offenses is the “Nth Room” case, in which sexually exploitative content and illegal recordings were unlawfully distributed on platforms such as X, Telegram, and Discord. Despite amendments to legislations, including the Sexual Violence Punishment Act and Youth Protection Act, aimed at preventing the recurrence of incidents, these crimes continue to persist. Perpetrators employ tactics such as the repeated creation and deletion of accounts, which complicate efforts to track and apprehend them. Consequently, there is an urgent need to develop advanced cyber investigation technologies capable of effectively monitoring sexual crimes posted on social media. This study aimed to propose a novel cyber investigation technology designed to trace criminal organizations by collecting tweets related to sexual crimes from X, which is the most frequently used social media platform for such content in Korea, and subsequently constructing a knowledge graph. Slang terms commonly associated with sexual crimes on X were employed as search keywords to collect relevant tweets. The knowledge graph is then generated based on three key elements extracted from the tweets: hashtags, words, and URL/invite codes. This graph serves as a tool for tracking the criminal networks involved in the distribution of sexually exploitative content and unauthorized recordings. Furthermore, to enhance tracking efficiency, an optimization model was developed to generate knowledge graphs from various analytical perspectives. In this study, to evaluate the performance of the proposed technology, a dataset of 3387 tweets was collected using an X crawler. Knowledge graphs were generated and optimized through both single and combined analyses of the three key elements, demonstrating the effectiveness of the proposed technology in tracking criminal organizations engaged in sexual crimes.

1. Introduction

Social media platforms, such as X (formerly Twitter), Facebook, and Instagram, are widely used services where users can share information and opinions, thereby expanding their interpersonal networks. Although these platforms facilitate communication and information exchange among users with shared interests, thereby enhancing social connectivity, they are also vulnerable to exploitation for various criminal activities. Such activities include digital sex crimes, drug trafficking, personal information leaks, and dissemination of malicious software. Notably, digital sex crimes, in particular—such as the distribution of sexually exploitative content, illegal recordings, and advertisements for illegal prostitution—have persisted as a significant social issue since the “Nth Room” incident [1]. The “Nth Room” case serves as a prominent example of digital sex crime, where perpetrators used social media platforms like X to identify victims and subsequently lured them into using instant messaging services such as Telegram and Discord. In these instances, perpetrators coerced individuals into creating sexually exploitative content or illegally disseminating such content without consent. Despite the implementation of the “Nth Room Prevention Act,” which expanded the scope of penalties for online sex crime and required internet service providers to promptly remove sexually exploitative content and illegal recordings upon discovery, these crimes continue to persist. Criminals have developed methods to circumvent cyber investigation technologies, such as repeatedly creating and closing multiple accounts or exploiting legal loopholes to perpetuate the distribution of illicit content [2]. In particular, X, in comparison to other major social media platforms, has relatively lenient content regulations, resulting in a high prevalence of adult content—approximately 13% of all content posted on X falls into this category. This characteristic positions X as a significant platform for posts related to sexual crimes. Furthermore, X provides a conducive environment for the dissemination of digital sex crime content, such as illegal recordings, which can inflict considerable psychological and social harm on victims [3,4]. The incidence of online sex crimes has more than doubled in 2022 compared with previous years [5]. Previous studies have attempted to address the issue of digital sex crimes by collecting data through surface web and deep web crawling techniques. However, these approaches have limitations when applied to collecting digital sex crime data from social media platforms. Moreover, prior research has primarily analyzed trends in sex crimes rather than developing cyber investigation technologies to track actual criminal activities. In this study, we developed a crawling technique to collect sex crime data from X, a social media platform where such content is frequently posted. Additionally, we proposed a knowledge graph generation technique aimed at tracking criminal organizations based on the collected data. To collect relevant sex crime data, we used frequently used slang related to sex crimes on X as search keywords to identify relevant tweets. Additionally, we collected user information, such as account IDs, nicknames, and account creation dates. Subsequently, we performed a similarity analysis and knowledge modeling centered on three key elements from the tweets: text, hashtags, and URLs/invitation codes. This process facilitates the tracking of criminal activities and the creation of a knowledge graph that aids in identifying criminal organizations involved in sex crimes. To evaluate the performance of the proposed tracking method, we analyzed the collected tweets to identify criminal organizations and proposed optimization methods to enhance tracking efficiency based on the analysis results. By setting thresholds for individual elements among the three key elements of tweets, we tracked major criminal organizations from an optimized analytical perspective. Moreover, tracking performance can be further improved through the integration of multiple elements.

This paper is organized as follows: Section 2 reviews current research trends in social media crawling and the utilization of knowledge graphs. Section 3 describes the development of the proposed crawling technology for collecting sexual crime data from X and the techniques employed to generate knowledge graphs to track criminal networks. In Section 4, we apply the proposed technology to collect actual tweets related to sexual crimes and analyze the results of tracking criminal networks based on the generated knowledge graphs. Section 5 presents the development of a model aimed at enhancing the efficiency of tracking criminal networks on X, including an analysis of the model’s optimization results for practical applications in cyber investigations. Additionally, Section 6 evaluates the tracking results of criminal networks using the combined optimized models. Finally, Section 7 presents the conclusions of the study and suggests directions for future research.

2. Related Research

2.1. Cyber Investigation Research Based on Crime Crawling in Social Media

Crawling refers to the act of systematically collecting and analyzing publicly available data from websites or social media platforms. It is primarily used to gather and analyze information on political and social issues, such as presidential candidates and COVID-19, from social media. However, the high accessibility and anonymity by social media platforms also enable cybercriminals to post tweets related to criminal activities. This underscores the need for research into advanced crawling techniques specifically designed to detect and prevent crimes on social media.

Among the various types of crimes on social media, research on sexual crimes includes studies that have focused on collecting tweets containing keywords related to the sexual exploitation of minors on X. These studies employed machine learning algorithms, such as support vector machines (SVM) and naive Bayes, to identify tweets associated with minor sexual exploitation [6]. Another study involved collecting tweets containing obscene content on X, performing text analysis using term frequency-inverse document frequency (TF-IDF), and identifying tweets with obscene content through the application of SVM and naive Bayes algorithms [7].

In the context of drug-related crimes, research has been conducted to collect user accounts and tweets related to illegal drugs on X. This research identified drug-related accounts using n-gram-based preprocessing and a logistic regression (LR) model [8]. Additionally, another study focused on tweets containing drug prescription abuse on X, analyzing the diffusion patterns of these tweets through social network analysis and machine learning techniques [9].

Regarding financial fraud, studies have involved the collection of phishing data from various social media platforms, including X, Facebook, and Instagram. These studies employed social network analysis and machine learning techniques to detect phishing attacks [10]. Additional research focused on collecting tweets containing scam-related keywords on X and identifying scam tweets using text mining techniques [11]. Additionally, images such as credit card logos, ISIS logos, and Guy Fawkes masks were collected from X and Facebook, and crime-related images were identified through training with a convolutional neural network (CNN) [12].

Furthermore, research on crime-related crawling has addressed various other aspects. For instance, a previous study integrated weather data with sentiment analysis of positive and negative emotions collected from X to predict the likelihood of theft incidents [13]. Another study analyzed the fuzzy relationships between cyber-terror keywords collected from X to identify key community users [14]. Further research has focused on detecting early signs of organized human trafficking by collecting publicly available data from the web and social media using formal concept analysis and natural language processing (NLP) [15]. Additionally, previous studies have collected data related to scams, hacking, and cybercrimes on X, and they analyzed the primary tactics of these cybercrimes using techniques such as TF-IDF, multinomial naive Bayes (MNB), SVM, and K-nearest neighbors (KNN) [16]. Additionally, research has identified influential users by collecting data containing keywords related to illegal transactions, including human trafficking, drug trafficking, and arms trafficking in cyberspace, utilizing sentiment analysis and social network analysis [17].

To address the challenge of identifying organized criminal accounts rather than isolated posts, recent work has focused on fraudulent account detection in social media by integrating deep learning architectures with hyperparameter optimization. For example, some studies have proposed hybrid transformer-based models that combine temporal convolutional networks, generative adversarial network-based data augmentation, and autoencoder-based dimensionality reduction to handle high-dimensional and highly imbalanced behavioral data, while meta-heuristic optimizers are employed to tune key hyperparameters [18]. These approaches have achieved high ROC–AUC and F1-scores on benchmark datasets, demonstrating the potential for automated account-level detection that complements our graph-based organizational tracking approach.

Building on traditional machine learning approaches, large language models (LLMs) have increasingly been employed to analyze unstructured data in security- and harm-related domains. Recent surveys have shown that LLMs can be integrated with static and dynamic analysis pipelines to support vulnerability detection, malware analysis, and hybrid reasoning over complex code-level representations [19]. More relevant to social media crime detection, LLM-based encoders combined with gradient-boosting classifiers have been applied to counseling and abuse-related text data, achieving competitive accuracy and F1-scores in the early detection of child abuse cases [20]. These advances suggest that future extensions of our knowledge graph framework could incorporate LLM-based text analysis to enhance the semantic understanding of criminal content patterns beyond keyword matching and structural analysis.

Although traditional research on crime-related crawling—including recent advances in LLM-based analysis and deep learning fraud detection—primarily emphasizes classifying collected data or accounts as criminal in nature, this study differentiates itself by developing techniques to identify and track criminal organizations through the analysis of relational patterns within the collected data.

2.2. Research on Knowledge Graph-Based Data Analysis

A knowledge graph is a visual representation that illustrates the relationships between entities or links in a knowledge base. Research involving knowledge graphs typically aims to construct these graphs to facilitate search and query functions, perform network analysis based on text mining, and perform detection and prediction tasks. For example, some studies have constructed knowledge graphs to support information retrieval and query processes. Notable examples include a study that developed a programming knowledge graph using educational data to assist students in programming education [21]. Another study developed a knowledge graph that integrates medical knowledge on public health to provide comprehensive public health information [22]. A previous study developed a research project knowledge graph using data on university researchers and their projects to create a query system for networks, organizations, keywords, and research interests [23]. Additionally, another study employed BibTex metadata to build a book recommendation knowledge graph, which led to the development of a system for recommending books to users based on authors and book types [24].

Some studies have focused on constructing knowledge graphs to perform text mining-based network analysis. For example, one study developed a knowledge graph that includes four biological components—genes, proteins, domains, and diseases—and employed degree centrality to identify influential domain nodes [25]. Another study constructed a knowledge graph to map mention relationships among X users and analyzed user influence through degree and closeness centrality measures [26].

Other studies have employed knowledge graphs for detection and prediction tasks. For example, one study used human trafficking data to calculate the similarity between image and text data, identify common entities, and detect human trafficking communities using a knowledge graph [27]. Another study constructed a knowledge graph from global terrorism data and employed machine learning techniques to predict terrorist attacks [28]. In the field of financial crime, research has employed knowledge graphs based on phone numbers, IDs, and bank account data to aid criminal investigations [29]. Similarly, a knowledge graph derived from call data record data, which included text and call information, was used to identify perpetrators of financial crimes [30]. Further research developed a knowledge graph using bank transaction data and analyzed key patterns of bank fraud using community detection algorithms [31]. Finally, a study gathered data with money laundering keywords from Tencent QQ, analyzed the behavioral patterns and community structures of malicious accounts through clustering, and detected these accounts using SVM, LR, and random forest models [32].

Beyond social media analytics, research on secure data management in large-scale IoT environments has explored blockchain-enabled architectures for trustworthy storage and sharing of sensitive information. Some studies have proposed decentralized storage layers that employ practical Byzantine fault tolerance–based consensus and reputation-driven mechanisms to guarantee data integrity, accountability, and controlled access without relying on a centralized auditor [33]. While these approaches primarily target IoT and cloud services, the principles of secure, auditable data storage are equally critical when managing evidential data extracted from criminal investigations on social media platforms. Our knowledge graph-based system similarly requires robust data integrity and privacy-preserving mechanisms to ensure that collected evidence remains tamper-proof and admissible for law enforcement purposes.

Traditionally, research on knowledge graphs has primarily focused on educational, social, and medical data rather than criminal data. In the field of criminal investigation, studies have primarily used surface web data or public datasets. Furthermore, studies involving social media data have mainly focused on analyzing crime patterns or identifying criminal accounts through data analysis for knowledge graph construction. While recent advances in LLMs, deep learning-based fraud detection, and secure data management provide valuable tools for processing criminal data, these approaches typically operate at the individual post or account level. In contrast, this study uniquely focuses on tracking criminal organizations through network-level analysis. We propose techniques for knowledge graph analysis and optimization that identify criminal organizations by analyzing tweets related to sexual crimes on social media platform X. By examining details from tweet authors and content elements, our approach reveals the structural connections between seemingly independent accounts and activities, enabling investigators to understand the organizational structure behind distributed criminal operations.

3. Design of a Sexual Crime Tweet Crawler and Knowledge Graph

In this section, we analyze the elements that can be collected from X to design a tweet crawler intended for generating a knowledge graph to track sexual crimes. We then proceed with modeling to create a knowledge graph using the designed crawler.

3.1. Design of the Sexual Crime Tweet Crawler

To track criminal organizations involved in sexual crimes on X, it is important to identify accounts and tweets associated with similar criminal activities by crawling X. In this study, we developed a crawler using the X API to collect user account information and tweet data, as depicted in Table 1.

Table 1. Crawling Elements for Tracking Criminal Organization on X.

Type	Element	Description
User Account	account ID	A user’s unique ID
	nickname	A user’s unique nickname
	creation date	A user’s twitter account creation date
	biography	Introduction to user’s accounts
Tweet	tweet ID	A unique ID of the tweet
	posting time	Tweet post date
	contents	Include hashtag, text, and URL/invitation code

The similarity between accounts can be evaluated by analyzing user account information, including ID, nickname, account creation date, and profile description. In addition, the similarity of criminal activities can be evaluated by analyzing tweet data. Among the elements crawled from X, the tweet content includes three key elements essential for tracking criminal organizations, as depicted in Table 2.

Table 2. Three Key Elements for Tracking Criminal Organizations.

Element	Description
Hashtag	Metadata tags included in tweets, written using the symbol “#”
Word	Objects that represent tweet text segments, separated into individual elements
URL/ Invitation code	HTTP addresses and instant messenger user accounts included in tweets

A hashtag is an element included in tweets to increase the visibility of content related to sexual crime to users. The word element consists of segments within a tweet, typically individual words or phrases, which are used for distributing sexually exploitative content or advertising illegal prostitution. URLs and invitation codes pertain to open chatroom addresses and user accounts on instant messaging services such as Telegram, Discord, Line, and KakaoTalk, which are used to attract users to these platforms.

In this study, the words, hashtags, and URLs/invitation codes included in tweets are defined as the three crucial elements for tracking criminal organizations involved in sexual crimes. The knowledge graph created in this research is structured around these elements to trace similar criminal activities.

3.2. Knowledge Graph Modeling for Tracking Sexual Crimes

To effectively employ user account information and tweet data collected from X to track criminal organizations involved in sexual crimes, it is essential to first accumulate and process the collected data as knowledge. Then, a knowledge graph must be created to systematically convey the analysis results, thereby enabling effective planning of tracking strategies.

A knowledge graph represents knowledge through vertices, which denote entities, and edges, which illustrate the connections between these entities. In this study, we created a knowledge graph by representing each crawling element from Table 1 as a vertex, thereby illustrating the connections between sexual crime-related accounts and tweets.

Table 3 presents the crawling elements represented as vertices in the knowledge graph for tracking criminal organizations involved in sexual crimes.

Table 3. Definition of the Five Types of Vertices in the Knowledge Graph for Tracking Criminal Organizations.

Vertex		Description
$V_{tweet}$		A tweet object containing sexual crime-related keywords $V_{tweet}$
$V_{user}$		User object who authored the $V_{tweet}$
$V_{type}$	$V_{hashtag}$	Hashtag object included in the $V_{tweet}$
	$V_{word}$	Word object included in the $V_{tweet}$
	$V_{url/code}$	URL and invitation code object included in the $V_{tweet}$

$V_{tweet}$ represents a tweet object posted by a user, which may involve activities such as the distribution of sexually exploitative content or the advertisement of illegal prostitution. $V_{user}$ represents the user object that authored tweets related to sexual crimes. $V_{type}$ is a shared object category for hashtags, words, and URLs/invitation codes included in tweets, which are further represented by $V_{hashtag}$, $V_{word}$, and $V_{url/code}$. $V_{hashtag}$ represents a vertex representing hashtags included in tweets that increase the exposure of sexual crime-related content. $V_{word}$ represents individual words in the tweets, which are segmented into units using a morphological analyzer, and $V_{url/code}$ signifies a vertex representing open chatroom addresses and account IDs, which are used to attract users to instant messaging platforms, such as Telegram, Discord, and KakaoTalk. Each vertex in the knowledge graph can have properties that provide specific information about the entity it represents. In this study, we defined the properties for the five vertices as listed in Table 4.

Table 4. Property Definitions by Vertex Type in the Knowledge Graph for Tracking Criminal Organizations.

Vertex	Property	Description
$V_{user}$	$P_{user\_ID}$	The “account ID” attribute of $V_{user}$
	$P_{user\_nick}$	The “nickname” attribute of $V_{user}$
	$P_{user\_creation}$	The “creation date” attribute of $V_{user}$
	$P_{user\_bio}$	The “biography” attribute of $V_{user}$
$V_{tweet}$	$P_{tweet\_ID}$	The “tweet ID” attribute of $V_{tweet}$
	$P_{tweet\_time}$	The “posting time” attribute of $V_{tweet}$
	$P_{tweet\_content}$	The “contents” attribute of $V_{tweet}$
$V_{type}$	$P_{type\_keyword}$	The unique keyword attributes of $V_{hashtag}, V_{word}$, and $V_{url/code}$

To illustrate the relationships between the five vertices in the knowledge graph used for tracking sexual crimes, this study defines two types of edges, as outlined in Table 5.

Table 5. Definition of the Two Types of Edges in the Knowledge Graph for Tracking Criminal Organizations.

Edge	Relation		Description
	Source	Target
$E_{post}$	$V_{user}$	$V_{tweet}$	“User” posts a “tweet”
$E_{include}$	$V_{tweet}$	$V_{type}$	“Tweet” includes “hashtags,” “words,” “URLs/invitation codes”

The mathematical formula for depicting the knowledge graph, designed to track criminal organizations involved in sexual crimes using the previously defined vertices and edges, is presented in Equation (1).

Equation (1). Definition of the Knowledge Graph G for Tracking Criminal Organizations.

$$\begin{array}{l}G=(\mathrm{V}, \mathrm{E})\\ V=\{V_{\mathit{tweet}}, V_{\mathit{type}}, V_{\mathit{user}}\}\\ E=\{E_{\mathit{include}}, E_{\mathit{posted}}\}\\ V_{\mathit{tweet}}=\{v_{{\mathit{tweet}}_1}, v_{{\mathit{tweet}}_2}, v_{{\mathit{tweet}}_3}, \dots , v_{{\mathit{tweet}}_i}\}\mathrm{ where} 1\le i\le \left|V_{\mathit{tweet}}\right|\\ V_{\mathit{type}}=\{v_{{\mathit{type}}_1}, v_{{\mathit{type}}_2}, v_{{\mathit{type}}_3}, \dots , v_{{\mathit{type}}_j}\}\mathrm{ where }1\le j\le \left|V_{\mathit{type}}\right|\\ V_{\mathit{user}}=\{v_{{\mathit{user}}_1},v_{{\mathit{user}}_2},v_{{\mathit{user}}_3},\dots ,v_{{\mathit{user}}_k}\}\mathrm{ where }1\le k\le \left|V_{\mathit{user}}\right|\\ E_{\mathit{include}}=\bigcup _{n=1}^i{E}_{{\mathit{include}}_n}\\ E_{{\mathit{include}}_i}=\{(v_{{\mathit{tweet}}_i},v_{{\mathit{type}}_j})\mid v_{{\mathit{tweet}}_i}\in V_{\mathit{tweet}},v_{{\mathit{type}}_j}\in V_{\mathit{type}} \mathrm{where } v_{{\mathit{type}}_j}\mathrm{ is\; included\; in }\\ v_{{\mathit{tweet}}_i}\}\\ E_{\mathit{posted}}=\{e_{{\mathit{posted}}_1},e_{{\mathit{posted}}_2},e_{{\mathit{posted}}_3},\dots ,e_{{\mathit{posted}}_i}\}\\ e_{{\mathit{posted}}_i}=(v_{{\mathit{tweet}}_i},v_{{\mathit{user}}_k})\mathrm{ where }{v}_{{\mathit{tweet}}_i}\in V_{\mathit{tweet}},v_{{\mathit{user}}_k}\in V_{\mathit{user}}\end{array}$$

(1)

Given that the knowledge graph for tracking criminal organizations involved in sexual crimes is based on tweets collected using sexual crime-related slang as search keywords on X, it must contain at least one $V_{tweet}$ and the corresponding $V_{user}$ who posted it. Additionally, as each collected tweet includes at least one of the search keywords—whether in the form of a hashtag, word, URL, or invitation code—the knowledge graph must contain at least one $V_{hashtag}$, $V_{word}$, or $V_{url/code}$. To illustrate the process of generating the knowledge graph, Table 6 presents Group A, which comprises two words and one URL or invitation code centered around $V_{tweet}$, and Group B, which comprises two words and one hashtag centered around $V_{tweet}$.

Table 6. Example of Sexual Crime Tweet Data.

Vertex	Property
	Name	Value
		A	B
$V_{tweet}$	$P_{tweet\_content}$	1900 pieces of Porn Material	There are a lot of Composite photo of Porn
$V_{user}$	$P_{user\_ID}$	mk4****1	kks7*****7
$V_{hashtag}$	$P_{hashtag\_keyword}$	Telegram	Discord
		Porn	-
$V_{word}$	$P_{word\_keyword}$	Material	Porn
		Porn	Compositephoto
$V_{url/code}$	$P_{url/code\_keyword}$	https://t.me/+0_J************0 [Accessed on 15 October 2024]	-

* Parts of the domain or identifier are anonymized to protect sensitive information.

The $V_{user}$ who posted the $V_{tweet}$ establishes an $E_{post}$ relationship with the $V_{tweet}$, while the hashtags, words, URLs, and invitation codes contained in the tweet create an $E_{include}$ relationship between $V_{tweet}$ and $V_{hashtag}$, $V_{word}$, or $V_{url/code}$. The knowledge graph generated based on Table 6 is illustrated in Figure 1.

Figure 1. Example of modeling a knowledge graph for sexual crime. * Parts of the domain or identifier are anonymized to protect sensitive information.

When expressed as a knowledge graph as defined in this paper, the result is given in Equation (2).

Equation (2). Definition of the Knowledge Graph G for Figure 1.

$$\begin{array}{l}{V}_{\mathit{tweet}}=\{v_{{\mathit{tweet}}_1}, v_{{\mathit{tweet}}_2}\}\\ V_{\mathit{user}}=\{v_{{\mathit{user}}_1}, v_{{\mathit{user}}_2}\}\\ V_{\mathit{type}}=\{v_{{\mathit{hashtag}}_1}, v_{{\mathit{hashtag}}_2}, v_{{\mathit{hashtag}}_3}, v_{{\mathit{word}}_1}, v_{{\mathit{word}}_2}, v_{{\mathit{word}}_3}, v_{\mathit{url}/{\mathit{code}}_1}\}\\ \begin{array}{cc}\hfill E_{{\mathit{include}}_1}=& \{(v_{{\mathit{tweet}}_1}, v_{{\mathit{hashtag}}_1}), (v_{{\mathit{tweet}}_1}, v_{{\mathit{hashtag}}_2}), (v_{{\mathit{tweet}}_1}, v_{{\mathit{word}}_1}), \hfill \\ \hfill & (v_{{\mathit{tweet}}_1}, v_{{\mathit{word}}_2}), (v_{{\mathit{tweet}}_1}, v_{\mathit{url}/{\mathit{code}}_1})\}\hfill \end{array}\\ E_{{\mathit{include}}_2}=\{(v_{{\mathit{tweet}}_2}, v_{{\mathit{hashtag}}_3}), (v_{{\mathit{tweet}}_2}, v_{{\mathit{word}}_2}), (v_{{\mathit{tweet}}_2}, v_{{\mathit{word}}_3})\}\\ E_{\mathit{posted}}=\{(v_{{\mathit{tweet}}_1}, v_{{\mathit{user}}_1}), (v_{{\mathit{tweet}}_2}, v_{{\mathit{user}}_2})\}\end{array}$$

(2)

4. Crawling of Sexual Crime Tweets and Knowledge Graph Generation

In this section, we use the tweet crawler and criminal organization tracking graph designed in Section 3 to gather actual tweets. These tweets are then stored and processed within a Neo4j-based graph database management system to generate a knowledge graph to track sexual crimes. Neo4j, with its data model comprising nodes, relationships, and properties, provides functionalities that enable efficient storage and querying of complex relational data. These capabilities are especially useful for analyzing social network data, such as Twitter, and monitoring user behavioral patterns related to sexual crimes [34].

4.1. Crawling Sexual Crime Tweets

To gather tweets related to the distribution of sexually exploitative content, advertisements for prostitution, and other sexual crimes, it is imperative to choose various slang terms as search keywords.

In this study, six representative slang terms commonly used on X for distributing sexually exploitative material were selected: “kw1”, “kw2”, “kw3”, and “kw4” in Appendix A which are associated with the distribution of such content, and “kw5” and “kw6”, which are used to attract users to instant messaging platforms such as Telegram for the dissemination of sexually exploitative material. Tweets were collected from 13 August to 17 August 2023, using these six terms, resulting in a total of 3387 tweets, as detailed in Table 7.

Table 7. Number of Crawling Elements Collected by Search Keywords.

Keyword	Tweet	User	Hashtag	Word	URL/Code
kw1	946	558	7734	8509	468
kw2	918	504	5897	2621	104
kw3	904	734	5065	6928	270
kw4	378	68	956	2755	94
kw5	201	64	1856	1279	166
kw6	40	23	170	305	28
Total	3387	1957	21,678	22,397	1130

All collected data consisted of publicly posted tweets accessible through X’s standard API without authentication requirements. To protect user privacy, all account identifiers (IDs, nicknames) presented in this manuscript are partially masked using asterisks (e.g., ‘k*****6′). No direct messages, private account content, or personal identifiable information (PII) beyond public usernames were accessed. Tweet content containing URLs and invitation codes was analyzed solely for structural patterns rather than individual victim identification.

Data collection was conducted in accordance with X’s Developer Agreement and Policy, which permits academic research use of publicly available data. The study focuses on criminal actor behavior patterns rather than content distribution or victim identification, aligning with platform policies prohibiting abuse while allowing legitimate research. Collection was limited to the aforementioned 5-day window to minimize data retention and focused exclusively on accounts actively promoting illegal content through public advertising behavior.

As some users posted multiple tweets, the number of distinct users is lower than the total number of tweets. Additionally, the similarity in the number of hashtags and words included in the tweets indicates that tweet authors often include hashtags to maximize their visibility. Many tweets are composed entirely of hashtags. URLs and invitation codes, which are employed to attract users to instant messaging services, appear less frequently in tweets—typically appearing 0–2 times per tweet—resulting in a lower overall count compared to hashtags and words.

Table 8 displays the top 10 most frequently occurring hashtags, words, and URLs/invitation codes found in the collected tweets.

Table 8. Top 10 Most Frequent Hashtags, Words, URLs/Invitation Codes.

Rank	Hashtag		Word		URL/Code
	Keyword	Frequency	Keyword	Frequency	Keyword	Frequency
1	kw7	1203	kw3	501	k***8	177
2	kw2	983	kw1	479	http://t.me/y********9 [Accessed on 15 October 2024]	98
3	kw1	682	kw14	467	k****9	63
4	kw3	548	kw15	446	s****0	36
5	kw8	524	kw8	399	q***1	28
6	kw9	478	kw16	246	1****n	24
7	kw10	438	kw17	235	y****5	22
8	kw11	425	kw18	216	k*****6	21
9	kw12	392	kw18	216	b*****7	20
10	kw13	355	kw20	172	6******0	18

* Parts of the domain or identifier are anonymized to protect sensitive information.

Among the hashtags, terms such as “kw7”, “kw9”, and “kw10” were frequently found in tweets related to sexual crimes, even though they were not part of the original search keywords. This suggests that additional key terms for identifying sexual crime tweets can be discovered via crawling. Regarding words, terms such as “kw3”, “kw1”, “kw14”, and “kw8”, which are related to sexual crimes, appeared frequently, along with terms such as “kw15”, “kw20”, and “kw19”, which are associated with instant messaging services. The collected tweets also included account and website address information used to attract users to instant messaging services. Among the top 10 entries, 9 were LINE accounts and 1 was Telegram’s open chatroom address.

By examining the hashtags, words, and URLs/invitation codes found in the collected tweets, it is possible to identify user accounts suspected of belonging to the same criminal organization. In this study, we created a knowledge graph to track criminal organizations involved in sexual crimes on X using this data.

4.2. Generation and Analysis of a Knowledge Graph for Tracking Sexual Crimes

In this study, we created a knowledge graph focused on $V_{type}$ objects, which encompass hashtags, words, and URLs/invitation codes, as defined in Section 3. This knowledge graph is utilized to cluster tweets and identify criminal organizations involved in sexual crimes.

4.2.1. Clustering Tweets Based on $V_{hashtag}$

The knowledge graph created around $V_{hashtag}$ examines the hashtags in tweets and clusters those that share the same hashtags, thus identifying tweets associated with the same organization. Figure 2 displays the knowledge graph formed from the collected tweets centered on $V_{hashtag}$, revealing a distinct division into two main sections, labeled as Section A and Section B.

Figure 2. $V_{hashtag}$—Centered knowledge graph for tracking criminal organizations.

Section A presents a region rich in tweets relevant to tracking criminal organizations, with clusters emerging around the most frequently used hashtags, as illustrated in Table 8. For example, Cluster 1 in Section A is formed around hashtags such as “kw2” and “kw9” and is connected to Cluster 2, which is centered around hashtags like “kw7” and “kw1”. These connections extend into larger, higher-level clusters within Section A. Conversely, Section B comprises clusters in which tweets either lack hashtags or are centered around hashtags unrelated to sexual crimes. Although the content of these tweets includes keywords related to sexual crimes, the hashtags do not reflect this nature. For instance, Cluster 3 in Section B is formed around celebrity-related hashtags such as “kw21”, “kw22”, and kw23”. Although these tweets are not directly related to sexual crimes, they were collected due to the inclusion of sexual crime-related keywords such as “kw3” in their content.

4.2.2. Clustering Tweets Based on $V_{word}$

The knowledge graph centered around $V_{word}$ focuses on the words used within the tweet content, forming clusters based on the occurrence of the same words. This method helps identify tweets that are likely associated with the same organization. Figure 3 shows the knowledge graph generated using $V_{word}$ from the collected tweets. Similar to Figure 2, this graph is divided into two sections, Section A and Section B.

Figure 3. $V_{word}$-Centered knowledge graph for tracking criminal organizations.

Section A contains tweet clusters formed based on the most frequently occurring words listed in Table 8. For example, Cluster 1 is centered around high-frequency words such as “kw8” and “kw14”. A single tweet can contain multiple words; thus, tweets that include frequently occurring words like “kw3” and “kw19” are clustered together, creating larger, higher-level clusters in Section A. Section B contains clusters in which sexual crime-related keywords appear only in hashtags and not in the main tweet content. Alternatively, these clusters may form when part of a specific word in the tweet content matches a sexual crime keyword, leading to its collection. For instance, Cluster 2 in Section B comprises tweets that contain only high-frequency hashtags like “kw7” and “kw3”, with no corresponding words in the tweet content. Therefore, these clusters are composed solely of $V_{tweet}$ and $V_{user}$, with no $V_{word}$ present.

4.2.3. Clustering Tweets Based on $V_{url/code}$

The knowledge graph centered around $V_{url/code}$ focuses on clustering tweets that share the same URL and invitation codes, enabling the identification of the same organization. Figure 4 shows the knowledge graph generated from the collected tweets centered around the $V_{url/code}$. This graph is divided into two sections: Section A contains clusters in which multiple tweets distribute the same URL or invitation code, forming clusters that are significant for tracking sexual crimes, and Section B contains clusters that are less meaningful for tracking purposes. These clusters form when only a few tweets distribute specific URLs or invitation codes or when there is an absence of $V_{url/code}$ altogether.

Figure 4. $V_{url/code}$-Centered knowledge graph for tracking criminal organizations.

Cluster 1 in Section A is formed around the most frequently occurring URL and invitation code, specifically the LINE invitation code “k***8”, as listed in Table 8. An analysis of the 126 tweets associated with “k***8” revealed that these tweets were connected to only 19 unique user nicknames. This indicates that, despite the involvement of 126 different X accounts in disseminating the LINE invitation code “k***8”, these accounts are likely operated by the same individual or organization.

4.2.4. Limitations of the Knowledge Graph for Tracking Criminal Organizations Involved in Sexual Crimes

The collection of actual sexual crime-related tweets demonstrated the effectiveness of knowledge graphs generated around $V_{hashtag}$, $V_{word}$, and $V_{url/code}$ for tracking criminal organizations, as confirmed through graph analysis. However, as observed in Section B of Figure 2, Figure 3 and Figure 4, these graphs also contain clusters that lack substantive significance. Such occurrences occur when the central vertices contain insufficient data or when the number of tweet vertices connected to the central vertices is limited, resulting in a relative lack of useful information for tracking purposes. Therefore, it is important to optimize the knowledge graph generation process by extracting valuable information from the collected sexual crime tweets. In this study, we have developed an optimization model aimed at selecting key vertices that are essential for effective tracking during the knowledge graph generation stage.

4.3. Manual Labeling for Ground-Truth Construction

To quantitatively evaluate the performance of the proposed tracking method and validate the optimized knowledge graph, we established a ground-truth dataset of criminal organizations. Since no public dataset exists for sexual offenses on social media due to privacy and legal constraints, we performed a rigorous manual labeling process on the collected corpus of 3387 tweets. This process followed a two-stage hierarchical protocol designed to combine objective identifiers with contextual pattern analysis.

In the first stage, we formed initial clusters using explicit linkage evidence derived from the crawler’s key elements. Tweets were automatically grouped if they shared identical external contact points, specifically URLs or invitation codes $V_{url/code}$ for instant messaging platforms (e.g., Telegram, LINE, Discord). This grouping relies on the assumption that tweets advertising the exact same access channel originate from the same underlying organization. Additionally, all tweets posted by the same unique user account $P_{user\_ID}$ were aggregated into single user-centric groups. This stage produced a baseline set of clusters based on undeniable direct connections.

Subsequently, in the second stage, we manually inspected the initial clusters to identify and merge fragmented clusters belonging to the same criminal organization. To facilitate this inspection, we visualized the network using a Force-Directed Layout algorithm, which naturally positioned related clusters in close proximity based on their interaction density. This heuristic refinement addresses cases where a single organization operates multiple accounts or utilizes different URLs to evade detection. Two researchers independently examined the clusters based on five heuristic criteria: (i) hashtag sequences, which involve the similarity in the combination and ordering of hashtags $V_{hashtag}$; (ii) lexical and syntactic patterns, such as the usage of distinctive vocabulary $V_{word}$ or identical sentence templates; (iii) account naming conventions, focusing on systematic patterns in user nicknames $P_{user\_nick}$ or IDs (e.g., sequential naming); (iv) temporal synchronization, where tweets appear in bursts across different accounts within short time windows $P_{tweet\_time}$; and (v) multimedia and content consistency, such as the reuse of identical promotional images. Clusters exhibiting strong evidence of organizational continuity based on these criteria were merged. Any disagreements during the labeling process were resolved through cross-verification to minimize subjectivity.

Through this procedure, we finalized the ground-truth dataset, distinguishing independent criminal organizations from individual activities. The statistical summary of the constructed ground-truth dataset is presented in Table 9.

Table 9. Statistical Summary of Ground-Truth Dataset by Organization Size.

Size Category	Clusters	Total Tweets	Avg Tweets	Min Tweets	Max Tweets	Avg Hashtags Per Tweet	Avg Words Per Tweet
Large-scale (50+)	6	1029	171.5	61	346	5.36	4.80
Medium-scale (10–49)	26	498	19.15	10	42	11.86	10.13
Small-scale (2–9)	173	512	2.96	2	9	6.28	8.70
Single (1)	-	1187	-	-	-	-	-
Total	205	3226	15.66	2	346	6.94	8.77

As presented in Table 9, a total of 205 criminal organization clusters were identified through manual labeling. These comprise 6 large-scale organizations (50 or more tweets), 26 medium-scale organizations (10–49 tweets), and 173 small-scale organizations (2–9 tweets). Additionally, 1187 tweets were classified as individual activities, as no evidence of organized behavior was identified. Although large-scale organizations account for only approximately 2.9% of all identified clusters, they represent 50.5% (1029 tweets) of the total tweets attributed to organizations. This disparity suggests that a small number of large-scale entities play a central role in the dissemination of sexual crime-related content.

Notably, the average number of hashtags per tweet was highest for medium-scale organizations at 11.86, indicating that these groups adopt intensive hashtag utilization strategies to maximize content exposure. In contrast, large-scale organizations exhibited a relatively lower average of 5.36 hashtags per tweet. This can be attributed to their established networks and follower bases, which allow for effective content dissemination without heavy reliance on keyword flooding. Regarding word usage, medium-scale organizations demonstrated the highest average of 10.13 words per tweet, followed by small-scale organizations (8.70) and large-scale organizations (4.80). This pattern suggests that large-scale organizations tend to rely more on hashtag-driven propagation with minimal textual content, whereas medium-scale organizations employ more text-rich strategies to attract users.

5. Design of an Optimization Model for the Knowledge Graph in Tracking Criminal Organizations Involved in Sexual Crimes

In this section, we developed an optimization model by performing property and relationship filtering centered on $V_{hashtag}$, $V_{word}$, and $V_{url/code}$. The objective is to generate and validate an optimized knowledge graph that enhances the effectiveness of tracking criminal organizations involved in sexual crimes.

5.1. Knowledge Graph Optimization Model

To improve the efficiency of tracking criminal organizations involved in sexual crimes on X, it is essential to create an optimized knowledge graph that can extract meaningful information based on $V_{type}$. In this study, we introduce four types of filters—$F_1$, $F_2$, $F_3$, and $F_4$—to develop this optimized knowledge graph. The implementation of this optimization model was executed using Neo4j Cypher queries. The mathematical definitions and operational principles for each filter are defined as follows. Complete Neo4j Cypher implementations, including graph schema definitions and executable query templates for all four filters, are provided in Appendix B for reproducibility.

$F_1$ is a filter that selects $v_{{tweet}_i}$ from the knowledge graph $G$, as detailed in Section 4, where the number of $v_{{type}_j}$ connected to $v_{{tweet}_i}$ surpasses a specified $threshold$. The filtered knowledge graph $G_{F_1}$ is then generated as defined in Equation (3).

Equation (3). Definition of Knowledge Graph $G_{F_1}$.

$$\begin{array}{l}{G}_{F_1}=G\cap S\left(F_1\right)\\ S\left(F_1\right)=\{V_{F_1}, E_{F_1}\}\\ V_{F_1}=\{V_{{\mathit{tweetF}}_1}, V_{{\mathit{typeF}}_1}, V_{{\mathit{user}}_1}\}\\ E_{F_1}=\{E_{{\mathit{includeF}}_1}, E_{{\mathit{postedF}}_1}\}\\ V_{{\mathit{tweetF}}_1}=\{v_{{\mathit{tweet}}_i}\mid n\left(E_{{\mathit{include}}_i}\right)\ge \mathit{ threshold}\}\\ V_{{\mathit{typeF}}_1}=\{v_{{\mathit{type}}_j}\mid v_{{\mathit{tweet}}_i}\in V_{{\mathit{tweetF}}_1}, (v_{{\mathit{tweet}}_i}, v_{{\mathit{type}}_j})\in E_{{\mathit{include}}_i}\}\\ V_{{\mathit{userF}}_1}=\{v_{{\mathit{user}}_k}\mid v_{{\mathit{tweet}}_i}\in V_{{\mathit{tweetF}}_1}, (v_{{\mathit{tweet}}_i}, v_{{\mathit{user}}_k})=e_{{\mathit{posted}}_i}\}\\ E_{{\mathit{includeF}}_1}=\{(v_{{\mathit{tweet}}_i}, v_{{\mathit{type}}_j})\mid v_{{\mathit{tweet}}_i}\in V_{{\mathit{tweetF}}_1}, (v_{{\mathit{tweet}}_i}, v_{{\mathit{type}}_j})\in E_{{\mathit{include}}_i}\}\\ E_{{\mathit{postedF}}_1}=\{(v_{{\mathit{tweet}}_i}, v_{{\mathit{user}}_k})\mid v_{{\mathit{tweet}}_i}\in V_{{\mathit{tweetF}}_1}, (v_{{\mathit{tweet}}_i}, v_{{\mathit{user}}_k})=e_{{\mathit{posted}}_i}\}\end{array}$$

(3)

$F_2$ is a filter designed to examine the unique slang used by criminal organizations by treating the most frequently occurring $v_{{type}_j}$, such as “kw7” and “kw2”, as stop words. This filter enhances $G_{F_1}$ by eliminating $v_{{type}_j}$ and the edges ($v_{{tweet}_i}$, $v_{{type}_j}$) associated with these terms, leading to the generation of $G_{F_2}$, as defined in Equation (4).

Equation (4). Definition of Knowledge Graph $G_{F_2}$.

$$\begin{array}{l}\mathrm{For} \mathrm{all} i \mathrm{and} j \mathrm{that} \mathrm{satisfy} (v_{{\mathit{tweet}}_i}, v_{{\mathit{type}}_j})\in E_{\mathit{include}}, \mathrm{let} Freq\left(v_{{\mathit{type}}_j}\right) \mathrm{be} \mathrm{the} \mathrm{frequency}\\ \mathrm{of} v_{{\mathit{type}}_j} \mathrm{included} \mathrm{in}\\ G_{F_2}=G_{F_1}-S\left(F_2\right)\\ S\left(F_2\right)=\{V_{F_2},E_{F_2}\}\\ V_{F_2}=\{V_{{\mathit{type}}_j}\mid \mathit{Freq}\left(v_{{\mathit{type}}_j}\right)\ge \mathit{ threshold}\}\\ E_{F_2}=\{(v_{{\mathit{tweet}}_i},v_{{\mathit{type}}_j})\mid (v_{{\mathit{tweet}}_i},v_{{\mathit{type}}_j})\in E_{\mathit{include}}, \mathit{Freq}\left(v_{{\mathit{type}}_j}\right)\ge \mathit{ threshold}\}\end{array}$$

(4)

Filter $F_3$ operates under the assumption that tweets distributed by the same criminal organization will demonstrate a high degree of content similarity. This filter examines the similarity of content across all tweets and selects those tweets that demonstrate a high degree of similarity with multiple other tweets. As described in Equation (5), for each $v_{{tweet}_i}$ in $G_{F_2}$, the set of relationships $E_{{include}_i}$ between $v_{{tweet}_i}$ and $v_{{type}_j}$ is generated, and the similarity between these sets is measured using Jaccard similarity. Tweet pairs with a similarity score exceeding ${threshold}_{jaccard}$ are selected and compiled into $V_{sim}$. Subsequently, tweets within $V_{sim}$ that appear in pairs equal to or exceeding ${threshold}_{similar\_cluster}$ are selected and considered as tweets likely posted by the criminal organization, resulting in the generation of $G_{F_3}$.

Equation (5). Definition of Knowledge Graph $G_{F_3}$.

$$\begin{array}{l}{G}_{F_3}=G_{F_2}-S\left(F_3\right)\\ V_{\mathit{sim}}=\{v_{{\mathit{tweet}}_p}, v_{{\mathit{tweet}}_q}\mid \mathit{sim}(v_{{\mathit{tweet}}_p}, v_{{\mathit{tweet}}_q})\ge {\mathit{ threshold}}_{\mathit{jaccard}}\}\\ \mathrm{where} p\ne q \mathrm{and} v_{{\mathit{tweet}}_p}, v_{{\mathit{tweet}}_q}\in G_{F_2}\\ \mathit{sim}(v_{{\mathit{tweet}}_p}, v_{{\mathit{tweet}}_q})=\frac{\sum _{x\in I}\mathit{weight}(x)}{\sum _{x\in U}\mathit{weight}(x)}\\ \mathit{weight}(x)=\frac{1}{\log (1 + \mathit{Freq}(x))}\mathrm{ where }x\in U\\ I=\{v_{{\mathit{type}}_j}\mid (v_{{\mathit{tweet}}_p}, v_{{\mathit{type}}_j})\in E_{{\mathit{include}}_p}\}\cap \{v_{{\mathit{type}}_j}\mid (v_{{\mathit{tweet}}_q}, v_{{\mathit{type}}_j})\in E_{{\mathit{include}}_q}\}\\ U=\{v_{{\mathit{type}}_j}\mid (v_{{\mathit{tweet}}_p}, v_{{\mathit{type}}_j})\in E_{{\mathit{include}}_p}\}\cup \{v_{{\mathit{type}}_j}\mid (v_{{\mathit{tweet}}_q}, v_{{\mathit{type}}_j})\in E_{{\mathit{include}}_q}\}\\ \mathrm{For} \mathrm{all} i \mathrm{that} \mathrm{satisfies} v_{{\mathit{tweet}}_i}\in V_{\mathit{sim}}, \mathrm{let} \mathit{Freq}\left(v_{{\mathit{tweet}}_i}\right)\mathrm{be} \mathrm{the} \mathrm{frequency} \mathrm{of} v_{{\mathit{tweet}}_i}\\ \mathrm{included} \mathrm{in} V_{\mathit{sim}}.\\ S\left(F_3\right)=\{V_{F_3}, E_{{\mathit{includeF}}_3}, E_{{\mathit{postedF}}_3}\}\\ V_{F_3}=\{V_{{\mathit{tweet}}_i}\mid \mathit{Freq}\left(v_{{\mathit{tweet}}_i}\right)\ge {\mathit{ threshold}}_{\mathit{similar\_cluster}}\}\\ E_{{\mathit{includeF}}_3}=\{(v_{{\mathit{tweet}}_i}, v_{{\mathit{type}}_j})\mid v_{{\mathit{tweet}}_i}\in V_{F_3}, (v_{{\mathit{tweet}}_i}, v_{{\mathit{type}}_j})\in E_{{\mathit{include}}_i}\}\\ E_{{\mathit{postedF}}_3}=\{(v_{{\mathit{tweet}}_i}, v_{{\mathit{user}}_k})\mid v_{{\mathit{tweet}}_i}\in V_{F_3}, (v_{{\mathit{tweet}}_i}, v_{{\mathit{user}}_k})=e_{{\mathit{posted}}_i}\}\end{array}$$

(5)

Filter $F_4$ is intended to refine the URLs and invitation codes distributed by criminal organizations or individuals within the knowledge graph $G$, as developed in Section 4. This filter identifies $v_{{type}_j}$, where the number of connected $v_{{tweet}_i}$ surpasses a specific $threshold$, resulting in the formation of $G_{F_4}$, as defined in Equation (6).

Equation (6). Definition of Knowledge Graph $G_{F_4}$.

$$\begin{array}{l}{G}_{F_4}=G\cap S\left(F_4\right)\\ S\left(F_4\right)=\{V_{F_4}, E_{F_4}\}\\ V_{F_4}=\{V_{{\mathit{tweetF}}_4}, V_{{\mathit{typeF}}_4}, V_{{\mathit{userF}}_4}\}\\ E_{F_4}=\{E_{{\mathit{includeF}}_4}, E_{{\mathit{postedF}}_4}\}\\ V_{{\mathit{typeF}}_4}=\{v_{{\mathit{type}}_j}\mid n\left(\{v_{{\mathit{tweet}}_i}\mid (v_{{\mathit{tweet}}_i}, v_{{\mathit{type}}_j})\in E_{{\mathit{include}}_i}\}\right)\ge \mathit{ threshold}\}\\ V_{{\mathit{tweetF}}_4}=\{v_{{\mathit{tweet}}_i}\mid v_{{\mathit{type}}_j}\in V_{{\mathit{typeF}}_4}, (v_{{\mathit{tweet}}_i}, v_{{\mathit{type}}_j})\in E_{\mathit{include}}\}\\ V_{{\mathit{userF}}_4}=\{v_{{\mathit{user}}_k}\mid v_{{\mathit{tweet}}_i}\in V_{{\mathit{tweetF}}_4}, (v_{{\mathit{tweet}}_i}, v_{{\mathit{user}}_k})=e_{{\mathit{posted}}_i}\}\\ E_{{\mathit{includeF}}_4}=\{(v_{{\mathit{tweet}}_i}, v_{{\mathit{type}}_j})\mid v_{{\mathit{tweet}}_i}\in V_{{\mathit{tweetF}}_4}, (v_{{\mathit{tweet}}_i}, v_{{\mathit{type}}_j})\in E_{\mathit{include}}\}\\ E_{{\mathit{postedF}}_4}=\{(v_{{\mathit{tweet}}_i}, v_{{\mathit{user}}_k})\mid v_{{\mathit{tweet}}_i}\in V_{{\mathit{tweetF}}_4}, (v_{{\mathit{tweet}}_i}, v_{{\mathit{user}}_k})=e_{{\mathit{posted}}_i}\}\end{array}$$

(6)

The four proposed types of filters are used to identify highly significant tweets within the knowledge graph $G$. As shown in Figure 5, various filters are applied based on the $V_{type}$ used as the selection criterion.

Figure 5. Optimization model centered on $V_{hashtag}$, $V_{word}$, and $V_{url/code}$.

The $thresholds$ in Filters $F_1$, $F_2$, and $F_4$, as well as ${threshold}_{jaccard}$ and ${threshold}_{similar\_cluster}$ in $F_3$, serve as benchmark values for selecting tweets of high importance. The creation of $G_{F_1}$, $G_{F_2}$, $G_{F_3}$, and $G_{F_4}$ relies on these predefined $thresholds$. Hence, it is essential to analyze different $threshold$ values to determine the optimal criteria for tracking the same criminal organization.

5.2. Analysis of the Filtering-Based Optimization Model

In this section, we present the $threshold$ values for each filter in the proposed optimization model aimed at tracking the same criminal organization, with the goal of establishing the optimal $threshold$ criteria. As detailed in Table 10, the $threshold$ levels are categorized into low, mid, and high. Increasing the $threshold$ allows the optimization model to select tweets of greater importance within the knowledge graph. This enhances the clarity of cluster boundaries in the knowledge graph, thereby improving the efficiency of tracking the same criminal organization. However, setting the $threshold$ higher than the maximum values specified in Table 10 may lead to excessive filtering of tweets, which may result in the failure to form meaningful clusters.

Table 10. $threshold$ for Each Optimization Model.

Filter	Target Vertex	Threshold
		Low		Mid	High
$F_1$	$V_{tweet}$	1		3	5
$F_2$	$V_{hashtag}$	0	5	10	15
	$V_{word}$	0	5	10	15
$F_3$	$V_{tweet}$	1		5	10
$F_4$	$V_{url/code}$	1		5	10

Using the $thresholds$ detailed in Table 10, this study aims to derive the optimal $threshold$ values that enhance the tracking efficiency of the knowledge graph centered around $V_{type}$.

5.2.1. Optimization Model for the Knowledge Graph Centered on Hashtags

To propose the optimal combination of Filters $F_1$, $F_2$, and $F_3$ for enhancing the tracking efficiency of criminal organizations based on $V_{hashtag}$, this study sequentially derives the optimal $thresholds$ for $F_1$, $F_2$, and $F_3$ in a three-step process. Step 1 involves determining the optimal $threshold$ for $F_1$ by generating the knowledge graph $G_{F_1}$ based on the number of $v_{{hashtag}_j}$ connected to $v_{{tweet}_i}$ in the knowledge graph $G$. As shown in Table 10, the $F_1 threshold$ is set to 1, 3, and 5. The final knowledge graph $G_{F_3}$, generated using these settings, is compared and examined. A $threshold$ of 1 includes all tweets with at least one hashtag in the knowledge graph $G_{F_1}$, whereas a $threshold$ of 5 includes only those tweets that contain five or more hashtags. Step 2 focuses on deriving the optimal $threshold$ for $F_2$, which filters out common hashtags such as “kw7” and “kw2” based on their frequency in sexual crime-related tweets. As depicted in Table 10, the $F_2$ $threshold$ is set to 0, 5, 10, and 15. The knowledge graph $G_{F_3}$ is generated accordingly, where a $threshold$ of 0 means that even the most frequent hashtags are not filtered out, whereas a $threshold$ of 15 filters out the top 15 most frequent hashtags from the knowledge graph $G_{F_2}$. Finally, Step 3 focuses on finding the optimal $threshold$ for $F_3$, which evaluates the similarity between hashtags in tweets and clusters those with high similarity into a single criminal organization cluster. This step is divided into two sub-steps. Step 3-(a) derives the optimal ${threshold}_{jaccard}$, and Step 3-(b) determines the optimal ${threshold}_{similar\_cluster}$. In Step 3-(a), the values for ${threshold}_{jaccard}$ are set to 0.7, 0.8, and 0.9, and the knowledge graph $G_{F_3}$ is generated based on $V_{sim}$, which selects tweet pairs with 70%, 80%, or 90% similarity in hashtag composition, and then compared and analyzed. In Step 3-(b), ${threshold}_{similar\_cluster}$ is set to values of 1, 5, and 10, and the knowledge graphs generated are then compared and analyzed with respect to the selection of tweets featuring similar hashtag compositions. Ultimately, by applying the optimal $thresholds$ for $F_1$, $F_2$, and $F_3$, which are derived through these three steps, it is possible to generate an optimal knowledge graph, denoted as $G_{F_3}$. The resulting $G_{F_3}$ from this optimization process is advantageous as it effectively delineates the boundaries of criminal organization clusters while minimizing over-filtering, thus resulting in a knowledge graph with minimal clustering errors. The process of determining the optimal $threshold$ for $F_1$ in Step 1 is shown in Figure 6.

Figure 6. Scenario for determining the optimal $F_1 threshold$ in a $V_{hashtag}$-centered knowledge graph.

To focus on the changes in the knowledge graph resulting from variations in the $F_1$ $threshold$, it is necessary to fix the $thresholds$ for $F_2$ and $F_3$ at specific values. As shown in Figure 7, when the $thresholds$ for $F_2$ and $F_3$ are fixed at their minimum values, the knowledge graph hardly changes even in different $F_1$ $threshold$ settings. Therefore, in this study, the $thresholds$ for $F_2$ and $F_3$, as depicted in Figure 6, are set to their maximum values to accurately determine the optimal $F_1$ $threshold$.

Figure 7. Scenario applying the minimum $threshold$ to determine the optimal $F_1 threshold$ in a $V_{hashtag}$-centered knowledge graph—(a) $F_1 threshold$ = 1, (b) $F_1 threshold$ = 3, (c) $F_1 threshold$ = 5.

The final knowledge graph $G_{F_1}$ generated with $F_1 thresholds$ set to 1, 3, and 5, respectively, is shown in Figure 8.

Figure 8. Scenario for determining the optimal $F_1$ $threshold$ in a $V_{hashtag}$-centered knowledge graph—(a) $F_1 threshold$ = 1, (b) $F_1 threshold$ = 3, (c) $F_1 threshold$ = 5.

In Figure 8a, where all $v_{{tweet}_i}$ containing at least one hashtag are included, the knowledge graph may contain a substantial number of tweets that, whereas using hashtags common to sexual crime clusters, are not necessarily related to sexual crimes. As shown in Figure 8b,c, increasing the $threshold$ allows for the exclusion of unrelated tweets, thereby refining the focus on those specifically related to sexual crimes. However, setting the $threshold$ excessively high, as demonstrated in Figure 8c, with a $threshold$ of 5, can lead to the removal of clusters that use 3 or 4 hashtags. Clusters 1 through 8 in Figure 8a,b, which include tweets with 3 or 4 hashtags, are eliminated in Figure 8c, resulting in a knowledge graph that is less effective for crime tracking. Thus, the optimal $F_1 threshold$ for generating $G_{F_1}$ is determined to be 3, as applied in Figure 8b.

Table 11 presents the quantitative analysis results regarding variations in the $F_1$ $threshold$. As the $threshold$ increased from 1 to 3, the minimum cluster size rose from 1 to 10. This quantitatively supports the finding that tweets unrelated to sexual crimes were effectively filtered, as visually observed in Figure 8a. Conversely, when the $threshold$ was set to 5, the number of tweets decreased by 23.7% (from 649 to 495) compared to $threshold$ 3. This quantitative decline confirms the omission of clusters 1–8, which was previously observed in Figure 8c.

Table 11. Quantitative Analysis of Clustering Results by $F_1$ $threshold$ in $V_{hashtag}$-Centered Knowledge Graph.

${\mathit{F}}_1$  $\mathit{T}\mathit{h}\mathit{r}\mathit{e}\mathit{s}\mathit{h}\mathit{o}\mathit{l}\mathit{d}$	Total Tweets	Clusters	Avg Cluster Size	Max Cluster Size	Min Cluster Size	Avg Hashtags Per Tweet
1	653	27	24.18	109	1	4.68
3	649	24	27.00	109	10	4.70
5	495	18	27.50	97	10	5.79

In Step 2, as illustrated in Figure 9, following the determination of the $F_1 threshold$ as 3 from Step 1, the optimal $F_2 threshold$ is determined. The $F_3 threshold$ is again set to its maximum value, in which is consistent with Step 1.

Figure 9. Scenario for determining the optimal $F_2 threshold$ in a $V_{hashtag}$-centered knowledge graph.

Figure 10 shows the knowledge graph $G_{F_3}$ generated for various $F_2 threshold$ values.

Figure 10. Scenario for determining the optimal $F_2 threshold$ in a $V_{hashtag}$-centered knowledge graph—(a) $F_2 threshold$ = 0, (b) $F_2 threshold$ = 5, (c) $F_2 threshold$ = 10, (d) $F_2 threshold$ = 15.

In Figure 10a, the knowledge graph is generated without filtering any of the most frequently used hashtags related to sexual crimes, leading to the formation of a single large cluster in Section A. This outcome is due to the inclusion of common sexual crime-related slang, such as “kw7”, “kw9”, and “kw2”, as hashtags in most sexual crime-related tweets. Figure 10b displays the knowledge graph after filtering out the top 5 most frequent hashtags. This filtering results in the large cluster in Section A being divided into several smaller clusters. Figure 10c extends this filtering to the top 10 most frequent hashtags, thereby clarifying the boundaries between clusters in Sections B and C, which were less distinct in Figure 10b. Analysis of clusters 1, 2, and 3 in Section B reveals that these clusters not only exhibit similar patterns of $P_{user\_nick}$ such as “kw24”, “kw25”, and “kw26”, but also share many common $P_{hashtag\_keyword}$ under $V_{hashtag}$, such as “kw27”, “kw28”, and “kw29”. This suggests that clusters 1, 2, and 3 are likely related and may represent tweets from the same criminal organization. Furthermore, in clusters 4 and 5 of Section C, the presence of identical $P_{user\_nick}$ strongly suggests that these clusters comprise tweets from the same organization. Figure 10d, which filters out the top 15 most frequent hashtags, shows that while clusters in Sections B and C are even more distinctly separated than in Figure 10c, the removal of mediating hashtags in clusters 2 and 5 leads to a loss of connectivity with adjacent clusters. This disconnection can result in the misidentification of adjacent clusters that were previously thought to be related, thereby diminishing their effectiveness as indicators in criminal tracking. Hence, Figure 10c is more appropriate as a knowledge graph for crime tracking purposes. Therefore, this study determines that a $threshold$ value of 10 is optimal for $F_2 threshold$, and $G_{F_2}$ is generated based on this value.

The quantitative results in Table 12 complement this visual analysis. As the $threshold$ increases from 10 to 15, the $F_2$ filter—designed to remove high-frequency hashtags—becomes more lenient, leading to an increase in the total number of tweets from 617 to 649. At $threshold$ 10, the average number of hashtags per tweet decreased to 5.83, while the minimum cluster size was maintained at 10. This quantitatively supports the clarification of cluster boundaries observed in Sections B and C of Figure 10c.

Table 12. Quantitative Analysis of Clustering Results by $F_2$ $threshold$ in $V_{hashtag}$-Centered Knowledge Graph.

${\mathit{F}}_2$  $\mathit{T}\mathit{h}\mathit{r}\mathit{e}\mathit{s}\mathit{h}\mathit{o}\mathit{l}\mathit{d}$	Total Tweets	Clusters	Avg Cluster Size	Max Cluster Size	Min Cluster Size	Avg Hashtags Per Tweet
0	632	22	28.72	100	1	9.42
5	613	21	29.19	97	10	7.36
10	617	21	29.38	97	10	5.83
15	649	24	27.00	109	10	4.70

Step 3 comprises two sub-steps: Step 3-(a), which seeks to identify the optimal $F_3 {threshold}_{jaccard}$, and Step 3-(b), which aims to determine the optimal $F_3 {threshold}_{similar\_cluster}$. In Step 3-(a), as depicted in Figure 11, the optimal ${threshold}_{jaccard}$ for $F_3$ is established by measuring the similarity of hashtags using Jaccard similarity to generate the set of tweet pairs $V_{sim}$.

Figure 11. Scenario for determining the optimal $F_3 {threshold}_{jaccard}$ in a $V_{hashtag}$-centered knowledge graph.

Figure 12 illustrates the knowledge graph $G_{F_3}$ generated according to different ${threshold}_{jaccard}$ values for the $F_3$ filter.

Figure 12. Scenario for determining the optimal $F_3 {threshold}_{jaccard}$ in a $V_{hashtag}$-centered knowledge graph—(a) $F_3 {threshold}_{jaccard}$ = 0.7, (b) $F_3 {threshold}_{jaccard}$ = 0.8, (c) $F_3 {threshold}_{jaccard}$ = 0.9.

In Figure 12, Figure 12a,b illustrate the knowledge graphs created by setting the ${threshold}_{jaccard}$ to 0.7 and 0.8, respectively. In Figure 12b, the A region observed in Figure 12a is divided into three smaller clusters. A detailed analysis of each cluster reveals that they consist of tweets containing identical $P_{hashtag\_keyword}$ and $P_{user\_nick}$, indicating that these clusters are related. In Figure 12c, where ${threshold}_{jaccard}$ is set to 0.9, clusters 5, 6, and 7 are formed similarly to those in Figure 12b. Nevertheless, setting ${threshold}_{jaccard}$ too high leads to excessive filtering of $V_{tweet}$ from the knowledge graph, which proves problematic. Consequently, clusters 1, 2, 3, and 4, which were present in Figure 12a,b, are excluded in Figure 12c, reducing the graph’s effectiveness for tracking criminal organizations. Therefore, this study concludes that the optimal ${threshold}_{jaccard}$ value is 0.8.

As shown in Table 13, when ${threshold}_{jaccard}$ was set to 0.9, the number of clusters decreased to 20, and the average cluster size increased to 30.85. This corresponds to the exclusion of clusters 1, 2, 3, and 4, as observed in Figure 12c. At ${threshold}_{jaccard}$ 0.8, a balance between the number of clusters (23) and average cluster size (27.30) was maintained, quantitatively confirming that both comprehensiveness and precision in criminal organization tracking can be achieved simultaneously.

Table 13. Quantitative Analysis of Clustering Results by $F_3$ ${threshold}_{jaccard}$ in $V_{hashtag}$-Centered Knowledge Graph.

${\mathit{F}}_3$  ${\mathit{T}\mathit{h}\mathit{r}\mathit{e}\mathit{s}\mathit{h}\mathit{o}\mathit{l}\mathit{d}}_{\mathit{j}\mathit{a}\mathit{c}\mathit{c}\mathit{a}\mathit{r}\mathit{d}}$	Total Tweets	Clusters	Avg Cluster Size	Max Cluster Size	Min Cluster Size	Avg Hashtags Per Tweet
0.7	662	24	27.58	100	5	5.99
0.8	628	23	27.30	100	5	5.89
0.9	617	20	30.85	97	10	5.83

In Step 3-(b), as depicted in Figure 13, the optimal ${threshold}_{similar\_cluster}$ is determined by identifying tweet clusters with similar hashtag compositions, using the optimal $thresholds$ derived in the previous steps.

Figure 13. Scenario for determining the optimal $F_3 {threshold}_{similar\_cluster}$ in a $V_{hashtag}$-centered knowledge graph.

Figure 14 shows the knowledge graph $G_{F_3}$ generated using different ${threshold}_{similar\_cluster}$ values for the $F_3$ filter.

Figure 14. Scenario for determining the optimal $F_3 {threshold}_{similar\_cluster}$ in a $V_{hashtag}$-centered knowledge graph—(a) $F_3 {threshold}_{similar\_cluster}$ = 1, (b) $F_3 {threshold}_{similar\_cluster}$ = 5, (c) $F_3 {threshold}_{similar\_cluster}$= 10.

In Figure 14, Figure 14a–c denote knowledge graphs where $v_{{tweet}_i}$ is selected based on the number of times it appears in $V_{sim}$, which comprises tweet pairs with a hashtag similarity exceeding ${threshold}_{jaccard}$. Specifically, these parts correspond to selections, where $v_{{tweet}_i}$ appears at least 1, 5, and 10 times. In Section A, Figure 14a displays a single large cluster, whereas Figure 14c depicts three smaller clusters. Figure 14b shows an intermediate result where the cluster size in Section A is reduced compared to Figure 14a, but lower-level clusters that could help identify the same organization are not formed, as seen in Figure 14c. Thus, for Section A, a ${threshold}_{similar\_cluster}$ of 10 or higher, as depicted in Figure 14c, is deemed optimal for effective crime tracking. In Section B, Figure 14a forms a single large cluster, making it challenging to distinguish the same organization. Conversely, Figure 14b,c clearly define sub-clusters. However, in Figure 14c, applying a high ${threshold}_{similar\_cluster}$ excludes too many $v_{{tweet}_i}$, causing the disappearance of clusters identified in Figure 14b. Therefore, for Section B, a ${threshold}_{similar\_cluster}$ of 5 or higher, as depicted in Figure 14b, is deemed optimal for the knowledge graph. In summary, setting the ${threshold}_{similar\_cluster}$ slightly higher, as in Figure 14b,c, is more effective in filtering out unnecessary individuals or small organizations compared to the lower setting in Figure 14a. However, an excessively high ${threshold}_{similar\_cluster}$ may also filter out medium-sized criminal organizations, thereby eliminating valuable clues for crime tracking. Therefore, setting an appropriate ${threshold}_{similar\_cluster}$ is crucial and should be based on the analytical perspective.

Table 14 illustrates the changes in clustering characteristics according to variations in ${threshold}_{similar\_cluster}$. At ${threshold}_{similar\_cluster}$ 1, 115 clusters were formed, including many representing individual-level activities. In contrast, at ${threshold}_{similar\_cluster}$ 10, the number of clusters converged to 23, with the minimum cluster size rising to 5. In the visual analysis of Figure 14, ${threshold}_{similar\_cluster}$ 10 was determined to be appropriate for Section A, while ${threshold}_{similar\_cluster}$ 5 was deemed suitable for Section B. Table 14 quantitatively confirms that at ${threshold}_{similar\_cluster}$ 5, the minimum cluster size remains at 1, which enables the inclusion of small- to medium-scale organizations that might otherwise be filtered out.

Table 14. Quantitative Analysis of Clustering Results by $F_3$ ${threshold}_{similar\_cluster}$ in $V_{hashtag}$-Centered Knowledge Graph.

${\mathit{F}}_3$  ${\mathit{T}\mathit{h}\mathit{r}\mathit{e}\mathit{s}\mathit{h}\mathit{o}\mathit{l}\mathit{d}}_{\mathit{s}\mathit{i}\mathit{m}\mathit{i}\mathit{l}\mathit{a}\mathit{r}\_\mathit{c}\mathit{l}\mathit{u}\mathit{s}\mathit{t}\mathit{e}\mathit{r}}$	Total Tweets	Clusters	Avg Cluster Size	Max Cluster Size	Min Cluster Size	Avg Hashtags Per Tweet
1	1422	115	12.37	296	1	6.30
5	907	43	21.09	156	1	6.18
10	628	23	27.30	100	5	5.89

The optimal $thresholds$ for each filter, determined through the three-step process to create the most effective knowledge graph for tracking criminal organizations based on $V_{hashtag}$, are summarized in Figure 15.

Figure 15. Optimal $threshold$ for the $V_{hashtag}$-centered knowledge graph.

To validate the effectiveness of the proposed boundary-based clustering model optimized through the $F_1$, $F_2$, and $F_3$ filtering process, a comparative analysis was conducted against standard clustering algorithms using the optimal $thresholds$ derived in the previous sections ($F_1$ = 3, $F_2$ = 10, ${F_3}_{jaccard}$ = 0.8, ${F_3}_{similar\_cluster}$ = 10) as illustrated in Figure 16. After generating the optimized knowledge graph by applying these filters, the resulting clusters were evaluated against a ground-truth dataset constructed via manual labeling, as well as clusters generated by standard algorithms such as Agglomerative Clustering and K-Means Clustering.

Figure 16. Comparison of Clustering Results for $V_{hashtag}$-Centered Knowledge Graph: (a) Manual labeling, (b) Agglomerative Clustering, and (c) K-Means Clustering.

As presented in Figure 16a, the manual labeling process identified five clearly distinct clusters (1–5), each representing a separate criminal organization. However, the automated algorithms exhibited limitations in distinguishing these boundaries. Specifically, Agglomerative Clustering (Figure 16b) merged clusters 1 and 3 from the manual labeling into a single group in the region marked as Cluster A. These tweets shared high-frequency hashtags such as “kw27” and “kw28”, leading the algorithm to classify them as belonging to the same organization. Detailed analysis, however, revealed that each cluster possessed organization-specific unique hashtags and distinct $P_{user\_nick}$ patterns, confirming that they represent clearly distinguishable organizations. Similarly, in K-Means clustering (Figure 16c), a partial merging of clusters 4 and 5 was observed in the region marked as Cluster B. This misclassification can be attributed to the overestimation of high-frequency common hashtags, a limitation often observed in Euclidean distance-based clustering methods. These results demonstrate that while standard algorithms may group data based on statistical similarity, they struggle to capture the contextual nuances that define the actual boundaries of criminal organizations in social media analysis.

5.2.2. Optimization Model for the Knowledge Graph Centered on Words

To track criminal organizations by analyzing the words in tweet content, which are broken down into word units ($V_{word}$), this study sequentially determines the optimal $thresholds$ for $F_1$, $F_2$, and $F_3$ in three steps, similar to the approach used for $V_{hashtag}$ in Section 5.2.1.

Step 1 involves determining the optimal $F_1 threshold$ for generating the knowledge graph $G_{F_1}$ by analyzing the number of $v_{{word}_j}$ connected to $v_{{tweet}_i}$ in the knowledge graph $G$. As shown in Figure 17, the $F_1 threshold$ is set to 1, 3, and 5. To accurately assess the impact of variations in the $F_1 threshold$ on the knowledge graph, it is important to fix the $F_2$ and $F_3$ $thresholds$ at their maximum values. If the $thresholds$ for $F_2$ and $F_3$ are instead set to their minimum values, the knowledge graph will not undergo significant changes despite adjustments to the $F_1 threshold$, as shown in Figure 7.

Figure 17. Scenario for determining the optimal $F_1 threshold$ in a $V_{word}$-centered knowledge graph.

Figure 18 illustrates the knowledge graph $G_{F_3}$ generated using different $F_1 threshold$ values.

Figure 18. Scenario for deriving the optimal $F_1 threshold$ in a $V_{word}$-centered knowledge graph—(a) $F_1 threshold$ = 1, (b) $F_1 threshold$ = 3, (c) $F_1 threshold$ = 5.

In Figure 18, Figure 18a includes all $v_{{tweet}_i}$ containing at least one $v_{{word}_j}$, whereas Figure 18b selects only those $v_{{tweet}_i}$ that contain three or more $v_{{word}_j}$. In Figure 18b, clusters 1 and 5, which were present in Figure 18a, have been removed. A detailed analysis of the removed clusters 1 and 5 shows that Cluster 1 was formed around keywords that included some terms related to sexual crimes, but the tweets themselves were not related to sexual crimes. Cluster 5, which was centered around the word “kw18” might have been considered a sexual crime cluster, but it was composed of tweets posted by individuals rather than an organized group, justifying its exclusion from the knowledge graph. Generally, tweets with only one $v_{{word}_j}$ are more often characterized by multiple hashtags rather than by their textual content, making it more appropriate to analyze such tweets using $V_{hashtag}$, as in Section 5.2.1, rather than $V_{word}$. If the $threshold$ is set too high, as shown in Figure 18c, where only $v_{{tweet}_i}$ with five or more $v_{{word}_j}$ are included, all clusters (1 through 6) are filtered out, making the knowledge graph ineffective for tracking criminal organizations. Thus, the optimal $F_1$ $threshold$ for generating $G_{F_1}$ is determined to be 3, as applied in Figure 18b.

According to the quantitative analysis results in Table 15, as the $threshold$ increased from 1 to 3, the minimum cluster size rose from 1 to 9, and the number of clusters decreased from 19 to 15. This quantitatively supports the validity of removing clusters 1 and 5, as visually confirmed in Figure 18b. At $threshold$ 5, the number of clusters further decreased to 12. This reduction quantitatively confirms the filtering of clusters 1–6 observed in Figure 18c, indicating potential information loss at higher $thresholds$.

Table 15. Quantitative Analysis of Clustering Results by $F_1$ $threshold$ in $V_{\mathrm{w}\mathrm{o}\mathrm{r}\mathrm{d}}$-Centered Knowledge Graph.

${\mathit{F}}_1$  $\mathit{T}\mathit{h}\mathit{r}\mathit{e}\mathit{s}\mathit{h}\mathit{o}\mathit{l}\mathit{d}$	Total Tweets	Clusters	Avg Cluster Size	Max Cluster Size	Min Cluster Size	Avg Words Per Tweet
1	451	19	23.74	50	1	7.35
3	271	15	18.07	104	9	6.96
5	259	12	21.58	72	5	9.35

In Step 2, as illustrated in Figure 19, the $F_1 threshold$ is set to the optimal value of 3 obtained in Step 1. The goal here is to determine the best $F_2 threshold$ from the values 0, 5, 10, and 15.

Figure 19. Scenario for determining the optimal $F_2 threshold$ in a $V_{word}$-centered knowledge graph.

Step 2 considers the appropriateness of filtering commonly used sexual crime keywords to create a knowledge graph that accurately mirrors the characteristics of criminal organizations, which allows effective clustering. Figure 20 shows the knowledge graph $G_{F_3}$ created based on different $F_2$ $threshold$ values.

Figure 20. Scenario for deriving the optimal $F_2 threshold$ in a $V_{word}$-centered knowledge graph—(a) $F_2 threshold$ = 0, (b) $F_2 threshold$ = 5, (c) $F_2 threshold$ = 10, (d) $F_2 threshold$ = 15.

In Figure 20, Figure 20a represents a knowledge graph generated without filtering any of the most frequent $v_{{word}_j}$, resulting in the formation of adjacent sub-clusters 1, 2, 3, and 4 in Section A. However, a detailed analysis of each cluster revealed that, except for Cluster 3, Clusters 1, 2, and 4 contained the same $P_{user\_nick}$ such as “kw30” and the same $P_{word\_keyword}$ such as “kw3” and “kw31”. This indicates that Cluster 3 is associated with a different organization than clusters 1, 2, and 4, which implies that Figure 20a with a $threshold$ set to 0 is not appropriate. Conversely, Figure 20b, which filters the top 5 most frequent $v_{{word}_j}$, demonstrates that Cluster 3 is entirely separated from clusters 1, 2, and 4, making it more suitable than Figure 20a. Meanwhile, Figure 20c,d, which filter the top 10 and 15 most frequent $v_{{word}_j}$, respectively, lead to the exclusion of Cluster 5, which disseminates illegal adult websites, thereby making them less suitable for crime tracking. Therefore, after a thorough analysis of the collected data, this study concludes that Figure 20b provides the most appropriate knowledge graph while maintaining suitable connections between clusters and without over-filtering crime organization clusters. Consequently, the optimal $F_2$ $threshold$ was identified as 5.

In Table 16, the effect of the $F_2$ filter in the $V_{\mathrm{w}\mathrm{o}\mathrm{r}\mathrm{d}}$-based analysis appears relatively gradual compared to the $V_{hashtag}$ analysis. The variation in the number of clusters remains within the range of 14–15 across $threshold$ changes. This stability is attributed to the more diverse distribution of words extracted from tweet content compared to hashtags, as well as their lower dependence on specific high-frequency words. At $threshold$ 5, the average number of words per tweet was appropriately maintained at 9.71, quantitatively supporting the separation between cluster 3 and clusters 1, 2, and 4, as confirmed in Figure 20b.

Table 16. Quantitative Analysis of Clustering Results by $F_2$ $threshold$ in $V_{\mathrm{w}\mathrm{o}\mathrm{r}\mathrm{d}}$-Centered Knowledge Graph.

${\mathit{F}}_2$  $\mathit{T}\mathit{h}\mathit{r}\mathit{e}\mathit{s}\mathit{h}\mathit{o}\mathit{l}\mathit{d}$	Total Tweets	Clusters	Avg Cluster Size	Max Cluster Size	Min Cluster Size	Avg Words Per Tweet
0	271	16	16.94	76	1	11.55
5	222	15	14.80	50	9	9.71
10	203	14	14.50	50	9	9.39
15	227	14	16.21	56	9	6.96

In Step 3-(a), as shown in Figure 21, the objective is to measure the similarity between $v_{{tweet}_i}$ based on $v_{{word}_j}$ and select tweet pairs with similarity exceeding the ${threshold}_{jaccard}$. This step is intended to determine the optimal ${threshold}_{jaccard}$.

Figure 21. Scenario for determining the optimal $F_3 {threshold}_{jaccard}$ in a $V_{word}$-centered knowledge graph.

Figure 22 shows the knowledge graph $G_{F_3}$ generated with varying ${threshold}_{jaccard}$ values for the $F_3$ filter.

Figure 22. Scenario to determine the optimal $F_3 {threshold}_{jaccard}$ in a $V_{word}$-centered knowledge graph—(a) $F_3 {threshold}_{jaccard}$ = 0.7, (b) $F_3 {threshold}_{jaccard}$ = 0.8, (c) $F_3 {threshold}_{jaccard}$ = 0.9.

In Figure 22, Figure 22a,b show knowledge graphs generated with ${threshold}_{jaccard}$ set to 0.7 and 0.8, respectively. It is evident that the size of Cluster 4 in Figure 22b is smaller than that in Figure 22a. Cluster 4 is associated with tweets promoting illegal adult websites and involve multiple accounts. Nevertheless, an analysis of the $P_{word\_keyword}$ revealed that these tweets were disseminated by an individual using multiple accounts. Despite the reduction in cluster size in Figure 22b compared to Figure 22a, the identified criminal organization remained consistent, indicating that the refined graph in Figure 22b is more efficient for crime tracking. When a higher ${threshold}_{jaccard}$ of 0.9 is applied, as shown in Figure 22c, clusters 1, 2, and 3—previously identified as part of the criminal organization—are excluded from the knowledge graph, which makes it ineffective for crime tracking. Therefore, the optimal ${threshold}_{jaccard}$ for Step 3-(a) was determined to be 0.8.

The results in Table 17 quantitatively complement the visual analysis in Figure 22. At ${threshold}_{jaccard}$ 0.8, the minimum cluster size increased from 2 to 9, effectively excluding individual tweets that coincidentally shared similar words. At ${threshold}_{jaccard}$ 0.9, the total number of tweets decreased by 52.6% (from 418 to 222) compared to ${threshold}_{jaccard}$ 0.7. This sharp decline quantitatively confirms the omission of clusters 1, 2, and 3, which was observed in Figure 22c.

Table 17. Quantitative analysis of clustering results by $F_3$ ${threshold}_{jaccard}$ in $V_{\mathrm{w}\mathrm{o}\mathrm{r}\mathrm{d}}$-centered knowledge graph.

${\mathit{F}}_3$  ${\mathit{T}\mathit{h}\mathit{r}\mathit{e}\mathit{s}\mathit{h}\mathit{o}\mathit{l}\mathit{d}}_{\mathit{j}\mathit{a}\mathit{c}\mathit{c}\mathit{a}\mathit{r}\mathit{d}}$	Total Tweets	Clusters	Avg Cluster Size	Max Cluster Size	Min Cluster Size	Avg Words Per Tweet
0.7	418	18	23.22	126	2	8.58
0.8	277	17	16.29	105	9	9.02
0.9	222	15	14.80	50	9	9.71

In Step 3-(b), as shown in Figure 23, the objective was to determine the optimal ${threshold}_{similar\_cluster}$ to identify tweet clusters with similar $v_{{word}_j}$ compositions.

Figure 23. Scenario for determining the optimal $F_3 {threshold}_{similar\_cluster}$ in a $V_{word}$-centered knowledge.

Figure 24 shows the knowledge graph $G_{F_3}$ generated with varying ${threshold}_{similar\_cluster}$ values for the $F_3$ filter.

Figure 24. Scenario for determining the optimal $F_3 {threshold}_{similar\_cluster}$ in a $V_{word}$-centered knowledge graph—(a) $F_3 {threshold}_{similar\_cluster}$ = 1, (b) $F_3 {threshold}_{similar\_cluster}$ = 5, (c) $F_3 {threshold}_{similar\_cluster}$ = 10.

In Figure 24, Figure 24a–c denote knowledge graphs where $v_{{tweet}_i}$ is selected based on the number of times it appears in pairs within $V_{sim}$, specifically appearing at least 1, 5, and 10 times, respectively. In Section A, Figure 24b reveals 10 sub-clusters that are not identifiable in Figure 24a. In Figure 24a, the overlap of keywords in tweets from individuals or small organizations with those from medium to large organizations strengthens cluster connections. However, in Figure 24c, where the ${threshold}_{similar\_cluster}$ is set higher than in Figure 24b, excessive filtering of $v_{{tweet}_i}$ results in the disappearance of clusters 1 through 10, which were identified as criminal organizations in Figure 24b. Therefore, for Section A, Figure 24b with a ${threshold}_{similar\_cluster}$ of 5 or higher is deemed optimal. In Section B, clusters 11 and 12 are visible in Figure 24c but not in Figure 24a,b. A detailed analysis of clusters 11 and 12 shows that Cluster 11 pertains to a crime where an instant messenger LINE account is advertised through tweets to attract consumers of sexually exploitative content. Conversely, Cluster 12, which includes the keyword “kw3” as a search term, was found not to be related to sexual crime, making the division into two sub-clusters, as shown in Figure 24c, appropriate. Therefore, unlike Section A, for Section B, Figure 24c with a ${threshold}_{similar\_cluster}$ of 10 or higher is deemed the optimal knowledge graph.

Table 18 illustrates the clustering characteristics according to variations in ${threshold}_{similar\_cluster}$. At ${threshold}_{similar\_cluster}$ 5, the average cluster size reached its highest value of 29.12, indicating that medium- to large-scale organizations were effectively distinguished, corresponding to the 10 sub-clusters identified in Section A of Figure 24b. Conversely, at ${threshold}_{similar\_cluster}$ 10, the number of clusters decreased to 17, and the minimum cluster size rose to 9. This quantitatively confirms the filtering of clusters 1–10, as observed in Figure 24c.

Table 18. Quantitative Analysis of Clustering Results by $F_3$ ${threshold}_{similar\_cluster}$ in $V_{\mathrm{w}\mathrm{o}\mathrm{r}\mathrm{d}}$-Centered Knowledge Graph.

${\mathit{F}}_3$  ${\mathit{T}\mathit{h}\mathit{r}\mathit{e}\mathit{s}\mathit{h}\mathit{o}\mathit{l}\mathit{d}}_{\mathit{s}\mathit{i}\mathit{m}\mathit{i}\mathit{l}\mathit{a}\mathit{r}\_\mathit{c}\mathit{l}\mathit{u}\mathit{s}\mathit{t}\mathit{e}\mathit{r}}$	Total Tweets	Clusters	Avg Cluster Size	Max Cluster Size	Min Cluster Size	Avg Words Per Tweet
1	1235	96	12.86	296	1	8.25
5	699	24	29.12	200	1	7.79
10	277	17	16.29	105	9	9.02

To create the most efficient knowledge graph for tracking criminal organizations based on $V_{word}$, the optimal $thresholds$ for each filter, determined through the three-step process, are summarized in Figure 25.

Figure 25. Optimal $threshold$ for the $V_{word}$-centered knowledge graph.

To validate the effectiveness of the proposed boundary-based clustering model optimized through the $F_1$, $F_2$, and $F_3$ filtering process, a comparative analysis was conducted against standard clustering algorithms using the optimal $thresholds$ derived in the previous sections ($F_1$ = 3, $F_2$ = 5, ${F_3}_{jaccard}$ = 0.8, ${F_3}_{similar\_cluster}$ = 10). After generating the optimized knowledge graph by applying these filters, the resulting clusters were evaluated against a ground-truth dataset constructed via manual labeling, as well as clusters generated by standard algorithms such as Agglomerative Clustering and K-Means Clustering, as illustrated in Figure 26.

Figure 26. Comparison of Clustering Results for $V_{word}$-Centered Knowledge Graph: (a) Manual labeling, (b) Agglomerative Clustering, and (c) K-Means Clustering.

Figure 26 presents a comparison of the clustering algorithm results for the $V_{word}$-centered knowledge graph. As shown in Figure 26a, manual labeling identified three independent clusters (1, 2, and 3). However, Agglomerative Clustering (Figure 26b) merged clusters 1 and 2 into a single organization in the region marked as Cluster B, maintaining only cluster 3 as a separate group. This tendency was more pronounced in K-Means clustering (Figure 26c), where all three clusters (1, 2, and 3) were integrated into a single organization in the region marked as Cluster A.

These three clusters shared common sexual crime-related keywords, such as “kw28” and “kw32”, and were all engaged in promoting LINE IDs. This overlap led the automated algorithms to classify them as activities of the same organization. However, manual verification revealed that each organization exhibited unique text patterns. Furthermore, no evidence supporting their classification as a single organization was found in terms of hashtag combinations, nickname patterns, or user account characteristics. These organization-specific unique patterns form the actual boundaries between clusters—boundaries that cannot be accurately identified solely based on the frequency of common keyword occurrences. These results suggest that automated clustering algorithms alone have limitations in capturing the qualitative differences between organizations when tracking sexual crime networks.

5.2.3. Optimization Model for the Knowledge Graph Centered on URLs/Codes

$V_{url/code}$ denotes the URLs and invitation codes for instant messenger access included in tweets. Clusters formed around the same $V_{url/code}$ within the knowledge graph $G$ can be distinctly identified as belonging to the same organization. A knowledge graph focused on $V_{url/code}$ can be created by applying only $F_4$ to $G$, as depicted in Figure 5. Filter $F_4$ selects only those $v_{{url/code}_j}$ connected to $v_{{tweet}_i}$ a number of times greater than or equal to the $threshold$. In this study, as shown in Figure 27, the $F_4$ $threshold$ is set at 1, 5, and 10 to generate the knowledge graph $G_{F_4}$. The resulting $G_{F_4}$ graphs are then compared and analyzed to determine the optimal $F_4 threshold$.

Figure 27. Scenario for determining the optimal $F_4 threshold$ in a $V_{url/code}$—centered knowledge graph.

Figure 28 illustrates the knowledge graph $G_{F_4}$ generated with varying $F_4$ $threshold$ values.

Figure 28. Scenario for deriving the optimal $F_4 threshold$ in a $V_{url/code}$—centered knowledge graph—(a) $F_4 threshold$ = 1, (b) $F_4 threshold$ = 5, (c) $F_4 threshold$ = 10.

In Figure 28c, clusters are formed around particular URLs and invitation codes that are disseminated in 10 or more tweets, resulting in 13 clusters (1–13). Cluster 1 is further divided into two sub-clusters, 1-1 and 1-2, with 1-1 comprise 177 tweets sharing the LINE account “kc****” and 1-2 encompasses 63 tweets sharing the LINE account “kc***”. Cluster 2 consists of 98 tweets that share a URL for a sexual crime-related Telegram open chat room. Similarly, clusters 3–13 also feature LINE and Telegram accounts disseminated across 10 or more tweets. In Figure 28b, clusters 14 through 35 are added, representing URLs and invitation codes disseminated in 5 to 9 tweets. Figure 28a displays a total of 154 additional clusters, including 107 clusters formed by URLs and invitation codes disseminated in only one tweet. Although Figure 28c is effective for identifying large-scale criminal organizations, it has the drawback of filtering out smaller organizations from the knowledge graph, which may lead to their exclusion from investigation. Consequently, it is important to set the $threshold$ according to the investigative perspective to generate the knowledge graph $G_{F_4}$. In this study, an $F_4 threshold$ of 5 is determined to be the optimal value for identifying medium to large-scale criminal organizations.

6. Discussion

In Section 5, we generated knowledge graphs focusing on $V_{type}$ elements such as $V_{hashtag}$, $V_{word}$, and $V_{url/code}$ and established the optimal $thresholds$ for effectively monitoring the same criminal organization. Although knowledge graphs based on specific $V_{type}$ elements have been proven effective for clustering criminal organizations, integrating two or more $V_{type}$ elements may uncover additional criminal organizations not identified using a graph centered on a single $V_{type}$. Figure 29 illustrates a portion of the optimized knowledge graph created based on $V_{url/code}$, as discussed in Section 5.2.3.

Figure 29. A subset of clusters from the optimized $V_{url/code}$-centered knowledge graph $G_{F_4}$.

The knowledge graph contains four clusters centered around the $V_{url/code}$ elements labeled A–F. As detailed in Section 5, these four clusters are identified as different criminal organizations. However, when this graph is integrated with the knowledge graph optimized around $V_{hashtag}$, as shown in Section 5.2.1, the clusters A through F are consolidated into a single large cluster, as depicted in Figure 30.

Figure 30. Merging the optimized $G_{F_3}$ centered on $V_{hashtag}$ with the optimized $G_{F_4}$ centered on $V_{url/code}$.

A detailed analysis of clusters 2 and 3 in Figure 29 reveals that many tweets within these clusters share identical elements and sequences of hashtags. Additionally, multiple tweets with identical content were found across clusters 1, 3, and 4. This supports the justification for combining clusters 1, 2, 3, and 4 into a single cluster, as shown in Figure 30. In conclusion, generating knowledge graphs centered on individual $V_{type}$ elements allows us to estimate the same criminal organization from a vast collection of tweets. Subsequently, to finalize the identification of the criminal organization, a knowledge graph that integrates two or more effective $V_{type}$ elements can be created. This approach allows for more accurate identification and clustering of criminal organizations.

The filter-based optimization model and quantitative indicators proposed in this study are not intended to provide definitive automated answers to investigators; rather, they are designed to function as tools that support more effective criminal investigation analysis. In real-world investigative environments, the final decision regarding whether to classify adjacent clusters as a single organization or separate entities must rely on the professional judgment of investigators. Therefore, the boundary-based knowledge graph proposed in this study aims to provide an analytical environment where investigators can visually comprehend the relationships between clusters and explore potential inter-organizational associations through connecting elements such as shared hashtags, words, and URLs/invitation codes. This approach assists investigators in identifying criminal organizations more accurately by combining their domain knowledge and contextual judgment with the system’s output, rather than relying entirely on automated clustering results.

7. Conclusions

As cybercrimes exploit social media platform increase, there is a growing demand for advanced cyber investigation methods that leverage social media data analysis. This study focused on X, a platform on which significant amounts of digital sexual crime content are disseminated, to create a collection and tracking system aimed at identifying digital sexual crime organizations. Six commonly used slang terms related to sexual crimes were used as search keywords on X to collect data, resulting in the collection of 3387 tweets. Three key elements—hashtags, words, and URLs/invitation codes—were identified to track sexual crime organizations, and these elements were extracted from each tweet. Hashtags were identified as elements used to increase the visibility of illegal content posts to potential consumers. Words were parsed into distinct lexical units within the tweet’s text, while URLs/invitation codes were associated with open chatroom URLs or user accounts on instant messaging services such as Telegram and LINE, which are used to attract users. A knowledge graph was created by defining user accounts, tweets, hashtags, words, and URLs/invitation codes as vertices and modeling the relationships between these vertices as edges. To extract meaningful information to track sexual crime organizations from the knowledge graph, it is essential to optimize the graph based on an analytical focus. This study developed and optimized knowledge graphs centered around each key element to facilitate the clustering of sexual crime organizations and validated the clustering results by analyzing the vertices and edges of each cluster. Furthermore, this study examined the relationships between adjacent clusters to validate the proposed knowledge graph-based system for tracking sexual crime organizations. Additionally, the study investigated the generation of knowledge graphs that combined two or more key elements, thereby enabling the identification of higher-level criminal organizations that might not be detected using single-element-focused knowledge graphs. The tweet collection and tracking system developed in this study to identify sexual crime organizations is applicable not only to X but also to various other social media platforms. It can serve as a cyber investigation tool to track organizations involved in the dissemination of sexual crime content, illegal prostitution advertisements, deepfake-based synthetic images of ordinary people and celebrities, and the dissemination of sexually exploitative content and illegal recordings via instant messaging services.

Future efforts will focus on securing additional criminal evidence related to the organizations identified in this study by collecting data from instant messaging services, such as Telegram and LINE. Future research will focus on linking and analyzing data collected from social media and instant messaging platforms to accurately identify and apprehend these criminal organizations.

Appendix B.1. Knowledge Graph Schema Definition

The knowledge graph is constructed with five vertex types and three relationship types, as defined in Table 3, Table 4 and Table 5.

Appendix B.1.1. Vertex Creation

// Tweet vertex with properties MERGE (tweet:Tweet {Post_ID: row.PostID}) ON CREATE SET tweet.Content = row.Content, tweet.Date = row.Timestamp // User vertex with properties MERGE (user:User {ID: row.AuthorID}) ON CREATE SET user.Name = row.Nickname, user.CreateDate = row.AccountCreationDate // Type vertices (Hashtag, Word, URL_Code) MERGE (ht:Hashtag {Hashtag: tag}) MERGE (kw:Word {Word: keyword}) MERGE (lc:URL_Code {Link: code})

Appendix B.1.2. Relationship Creation

// POST relationship: User→Tweet MERGE (user)-[:POST]->(tweet) // INCLUDE relationships: Tweet→Type MERGE (tweet)-[:INCLUDE]->(ht)  // Tweet→Hashtag MERGE (tweet)-[:INCLUDE]->(kw)  // Tweet→Word MERGE (tweet)-[:INCLUDE]->(lc)  // Tweet→URL_Code

Appendix B.1.3. Frequency and Weight Calculation

// Calculate frequency and inverse-frequency weight for all Type vertices MATCH (type)  // Apply to Hashtag, Word, or URL_Code WHERE type:Hashtag OR type:Word OR type:URL_Code WITH type, size([(type)<-[:INCLUDE]-(t:Tweet) | t]) AS frequency SET type.Frequency = frequency, type.Weight = 1.0/log(1 + frequency)

Appendix B.2. Filter $F_1$: Tweet Content Density Selection

Purpose: Select tweets containing ≥ $threshold$ number of Type vertices ($V_{type}$).

Implementation

// Specify target type: {Hashtag} or {Word} MATCH (t:Tweet)-[:INCLUDE]->(type:{Hashtag|Word}) WITH t, COUNT(DISTINCT type) AS num_types WHERE num_types >= {$threshold$} RETURN t

Appendix B.3. Filter $F_2$: High-Frequency Stopword Removal

Purpose: Remove top-N most frequent Type vertices from $G_{F_1}$.

Implementation

// Step 1: Identify high-frequency Type vertices // Specify target type: {Hashtag} or {Word} MATCH (type:{Hashtag|Word}) WITH type ORDER BY type.Frequency DESC LIMIT {N} WITH COLLECT(type) AS stopwords // Step 2: Filter relationships excluding stopwords MATCH (t:Tweet)-[r:INCLUDE]->(type:{Hashtag|Word}) WHERE NOT type IN stopwords RETURN t, type

Appendix B.4. Filter $F_3$: Similarity-Based Tweet Clustering

Purpose: Select tweets with high content similarity using weighted Jaccard similarity.

Appendix B.4.1. Step 3-(a): Compute Tweet Pair Similarity

// Initialize similarity count MATCH (t:Tweet) SET t.SimilarityCount = 0; // Select tweet pairs sharing Type vertices from G_F2 // Specify target type: {Hashtag} or {Word} MATCH (t1:Tweet)-[:INCLUDE]->(type:{Hashtag|Word}) MATCH (t2:Tweet)-[:INCLUDE]->(type:{Hashtag|Word}) WHERE id(t1) < id(t2) // Collect Type vertices for each tweet WITH t1, t2w MATCH (t1)-[:INCLUDE]->(type1:{Hashtag|Word}) MATCH (t2)-[:INCLUDE]->(type2:{Hashtag|Word}) WITH t1, t2, COLLECT(DISTINCT type1) AS types1, COLLECT(DISTINCT type2) AS types2 // Calculate intersection (I) and union (U) WITH t1, t2, apoc.coll.intersection(types1, types2) AS intersectionTypes, apoc.coll.union(types1, types2) AS unionTypes // Calculate weighted Jaccard similarity: Σ(weight(x) for x in I)/Σ(weight(x) for x in U) WITH t1, t2, REDUCE(w = 0, type IN intersectionTypes|w + type.Weight) AS intersectionWeight, REDUCE(w = 0, type IN unionTypes|w + type.Weight) AS unionWeight // Compute similarity as per Equation (5) WITH t1, t2, CASE WHEN unionWeight = 0 THEN 0 ELSE intersectionWeight/unionWeight END AS similarity WHERE similarity >= {${threshold}_{jaccard}$} // Update similarity count for both tweets SET t1.SimilarityCount = t1.SimilarityCount + 1, t2.SimilarityCount = t2.SimilarityCount + 1

Appendix B.4.2. Step 3-(b): Select Tweets with High Similarity Frequency

// Select tweets appearing in multiple similar pairs MATCH (t: Tweet) WHERE t.SimilarityCount >= {${threshold}_{similar\_cluster}$} OPTIONAL MATCH (t)-[:INCLUDE]->(type:{Hashtag|Word}) OPTIONAL MATCH (t)<-[:POST]-(user:User) RETURN t, COLLECT(DISTINCT type) AS types, user

Appendix B.5. Filter $F_4$: URL/Code-Based Organization Identification

Purpose: Select URL_Code vertices connecting ≥ $threshold$ tweets (organization indicator).

Implementation

// Find URL_Code vertices with multiple connected tweets MATCH (tweet:Tweet)-[:INCLUDE]->(lc:URL_Code) MATCH (user:User)-[:POST]->(tweet) // Group by URL_Code and count connections WITH lc, COLLECT(DISTINCT tweet) AS tweets, COLLECT(DISTINCT user) AS users WHERE size(tweets) >= {$threshold$} // Return organization cluster RETURN lc, tweets, users