Ego‑Networks: Local Structure, Behaviour Patterns, and Graphlets

This article is based on some of the analysis I have done on the financial transaction datasets as part of financial fraud analysis. I will use the same dataset to explain the concept in concrete terms in the latter part of this article.

An egonet (or ego-network) is a very intuitive and powerful tool available in network analysis. It captures the local neighbourhood of a node (we call this the focal node – “ego”). This reveals the structural patterns that defines the behaviour of the node. Obviously, the behaviour being analysed depends very much on the domain of the data being analysed. To cite an example from the financial domain, we can use the egonet to expose how banks interact, the money flow and also the suspicious patterns.

Ego-Network

An ego‑network is the induced subgraph consisting of:

• the ego (the focal node),
• its alters (nodes directly connected to it),
• and optionally the edges among those alters.

The ego-network is called an induced subgraph because, once the first-level vertices of the ego node is selected, we include all the edges that exist amongst them, not just the edges connecting the the ego to its alters.

For example, suppose:

• Ego = A
• Alters = B, C, D
• Original graph edges:
  • A-B, A-C, A-D
  • B-C
  • C-D

The ego-network contains the vertices $\{A,B,C,D\}${A,B,C,D} and all of those edges. Note that the edges B-C and C-D are also included even though they do not involve the ego directly. They are included because they exist between vertices in the selected set. If you only kept the edges from the ego to its alters, you would have a subgraph, but not necessarily the induced subgraph on those vertices

Why Ego-Networks Matter

Egonets reveal local structural patterns that global graph metrics often miss. They are essential for:

• Fraud detection — fan‑in/fan‑out patterns, cycles, unusual neighbourhood density. We will be looking at this in the next section.
• Behaviour modelling — how a bank interacts with others. We will explore this too within this article.
• Graphlet extraction — egonets naturally produce 3–5 node graphlets
• Motif discovery — repeated local transaction patterns. This will be covered in a separate article.
• Orbit role identification — central vs peripheral nodes
• Anomaly detection — egonets that deviate from normal topology

Egonets are the bridge between raw graph data and interpretable local structure.

How Ego‑Networks Connect to Graphlets

Egonets are the easiest way to extract graphlets from real data. If you haven’t already gone through my article on graphlet, click here…

• Ego + 2 alters → 3‑node graphlet
• Ego + 3 alters → 4‑node graphlet
• Ego + 4 alters → 5‑node graphlet

These graphlets naturally expose:

• automorphisms (symmetry in the neighbourhood),
• orbits (distinct structural roles),
• motifs (repeated transaction patterns).

Experiment Setup

For this experiment, I have a minimalist set of data that I have extracted from the IBM aml dataset. This is a labelled set of money laundering transactions from one customer account to another. The flowchart in Figure 1 explains what we will be doing to understand the structure of this graph (motif analysis)

The table below shows the first few rows of the dataset that we are going to analyse. Note that only the most relevant columns (to understand the current analysis) is shown.

edges <- read.csv("motif_analysis/transactions_edges_full_small.csv")
> head(edges)
         txn_timestamp sender_bank_id receiver_bank_id sender_account_id receiver_account_id ml_topology  topology_description transaction_id
1 2026-02-07T23:12:00Z              0              369         8035B1450           800680DB0       CYCLE            Max 4 hops  TXN_000077608
2 2026-02-08T14:58:00Z              0             1924         8018C8DC0           8016CA4C0       CYCLE            Max 9 hops  TXN_000140025
3 2026-02-09T21:10:00Z             11                0         80020F980           80048A8F0      FAN-IN   Max 8-degree Fan-In  TXN_000202358
4 2026-02-10T11:37:00Z              0            57107         800ED43D0           824BF4150      RANDOM            Max 1 hops  TXN_000264666
5 2026-02-11T05:56:00Z              0               10         804259A00           8000B3730       CYCLE           Max 13 hops  TXN_000264683
6 2026-02-11T11:59:00Z          29630                0         803A59980           800CB3D70     FAN-OUT Max 16-degree Fan-Out  TXN_000355997

The output of the graphlet analysis is given below for 4 and 5. To recollect from the previous article, 4-graphlet counts gives you 15 orbits and 5-graphlet counts gives you 73.

Note that each row in the below analysis corresponds to an account that engages in a transaction. This could either be the sender_account_id or the receiver_account_id.

Given below in Figure 3 is the output of the 5graphlet analysis. You see the number of times each node is present in the respective orbits

Figure 4 shows all the orbits plotted in a single view (for the 4 graphlet analysis).

The collection of fifteen ego-network plots serves as a visual dictionary of orbit roles within the network. Each panel illustrates a characteristic local topology associated with a dominant orbit. Together, these plots help explain how different nodes participate in the network and why they receive high counts for particular graphlet orbits.

Rather than viewing orbit counts as isolated numerical features, the plots provide a structural interpretation of the graphlet framework and reveal the diverse local interaction patterns present in the network.

Validation

While the motif analysis provides a good means of identifying the topology, it is not a complete solution. Since the IBM AML dataset is labelled with the topology description for a number of transactions, it would be worthwhile to extract the topology description for one of the major cluster we have identified.

As seen in Figure 5, the topology for each account_id mentions either fan-out or fan-in. The degree mentioned in the label will only match if we take the full AML dataset for analysis. For the sake of simplicity and prototyping, we have considered only a minimal subset.

Intuition

Graphlet orbits capture the local structural role a node plays within small subgraphs. Two nodes may have the same degree but occupy very different orbit positions. Orbit analysis therefore provides a more nuanced view of local network structure than simple degree-based measures.

By visualizing the ego network of a node with a large count in a particular orbit, we gain intuition about the network motifs responsible for generating that orbit.

For example:

• O0 is often associated with peripheral nodes that participate mainly in simple edge structures.
• Triangle-related orbits correspond to nodes embedded in tightly interconnected neighborhoods.
• Path-center orbits correspond to bridging nodes located between other nodes.
• Star-centre or hub-related orbits correspond to highly connected nodes that act as local coordinators. More complex 4-node orbits identify nodes occupying specialized positions within larger motifs, such as connectors, hubs, or members of dense local clusters.

Key Insights from the Orbit Example Plots

Since each node represents an account ID, the orbit plots characterize the transactional role of individual accounts within the network rather than the role of institutions.

1. Most accounts occupy simple local structures

Accounts assigned to low-order orbits (such as O0) are typically involved in relatively simple transaction relationships. These accounts tend to interact with only a few counterparties and are located at the periphery of the network.

2. Orbit counts reveal behavioral patterns beyond transaction volume

Two accounts may have the same number of counterparties but very different orbit profiles. Orbit analysis therefore captures how an account is embedded in its local neighborhood, not merely how active it is.

3. Triangle-related orbits indicate tightly connected transaction groups

Accounts with high counts in triangle orbits belong to groups where counterparties also transact with one another. This may reflect recurring transaction circles, closely connected communities, or clusters of accounts with frequent mutual interactions.

4. Hub-like orbits identify highly connected accounts

Star-center or hub-related orbits correspond to accounts that transact with many counterparties. Such accounts occupy influential local positions and may act as collection points, distribution points, or heavily connected intermediaries.

5. Bridge or path-center orbits highlight intermediary accounts

Some accounts appear in orbit positions that connect otherwise separate parts of the network. These accounts may facilitate transaction flows between different groups of accounts and therefore occupy important structural positions despite not necessarily having the highest degree.

6. Higher-order orbits capture complex transaction arrangements

The 4-node graphlet orbits reveal accounts participating in more sophisticated local transaction patterns involving multiple counterparties simultaneously. These structures would not be identifiable using degree counts alone.

Benefits of visualizing the representative Ego Network:

The orbit counts themselves are numerical and can be difficult to interpret directly. For instance, observing that a node has a large value for “06”​ does not immediately reveal the structural configuration responsible for that count.

The ego-network visualizations bridge this gap by showing:

• the focal node, its immediate neighbors,and the connectivity among those neighbors.

This allows us to connect abstract orbit statistics to recognizable network patterns such as:

• stars, chains, triangles, clustered neighborhoods, and bridge-like structures.