Large network graph processing

Abstract

Techniques are disclosed for detecting whether an entity associated with a node of a summary graph is suspicious by retrieving, from a graph database storing a network graph representing a plurality of electronic communications, a portion of the network graph that includes a set of target nodes. Based on the target nodes included in the portion of the network graph, the server system generates community graphs that includes at least a target node and nodes connected to the target node. The server system assigns, based on similarities between the community graphs, the community graphs to clusters and generates a closure graph for clusters, including combining two or more community graphs within respective clusters. Based on respective closure graphs, the server system performs preventative actions relative to entities represented by nodes included in respective closure graphs and connected to the target nodes.