Listen to this Post
Introduction:
In a world where data sovereignty and operational security are paramount, law enforcement and intelligence agencies are increasingly turning to offline, small-scale Language Models (LLMs) to automate the extraction of complex relationship networks from unstructured text. By leveraging open-source tools and frameworks like Maltego, analysts can now transform narrative data—such as witness statements, intelligence reports, or even TV show summaries—into actionable link charts. This article explores the technical methodology behind using local LLMs for network analysis, providing a step-by-step guide for cybersecurity professionals and digital forensics teams.
Learning Objectives:
- Understand how to deploy and utilize small, offline language models for entity and relationship extraction.
- Learn the process of converting extracted data into a structured format (CSV) for import into network analysis tools like Maltego.
- Identify common pitfalls in automated relationship extraction and implement validation workflows to ensure data integrity.
You Should Know:
- Setting Up Your Offline LLM Environment for Text Extraction
The foundation of this technique relies on running a model locally to maintain data privacy. Unlike cloud-based APIs (like OpenAI), offline models ensure sensitive case data never leaves your machine.
Step‑by‑step guide:
To replicate Tom Jarvis’s training method, you need a local LLM runner and a model optimized for instruction following.
1. Install Ollama (a popular tool for running LLMs locally):
– Linux/macOS: `curl -fsSL https://ollama.com/install.sh | sh`
– Windows: Download the installer from ollama.com.
2. Pull a small, efficient model. For relationship extraction, a model like `phi3` or `llama3.2` (3B parameters) balances performance and resource usage:
– `ollama pull phi3:mini`
3. Prepare your text corpus. In his example, Jarvis used episode summaries. In a real-world scenario, this could be a witness statement or a report.
– Save your text in a `.txt` file (e.g., input_data.txt).
4. Create a system prompt for extraction. The model needs clear instructions to output data in a consistent format.
– Example “You are an OSINT data extraction assistant. Analyze the following text and extract all social relationships. Output the results strictly as a CSV with the headers: SOURCE, TARGET, RELATIONSHIP. Do not include any other text.”
2. Automating Relationship Extraction with a Python Script
Manually feeding text to an LLM is inefficient. Automating this process with a script allows analysts to process large volumes of data quickly.
Step‑by‑step guide:
This Python script uses the `requests` library to interact with Ollama’s API and generates the required CSV.
1. Install Python dependencies:
– `pip install requests pandas`
2. Create a script (`extract_relations.py`):
import requests
import json
import csv
import os
Configuration
OLLAMA_URL = "http://localhost:11434/api/generate"
MODEL = "phi3:mini"
INPUT_FILE = "input_data.txt"
OUTPUT_FILE = "relationships.csv"
Read the text data
with open(INPUT_FILE, 'r') as file:
text_data = file.read()
Define the prompt
prompt = f"""You are an OSINT data extraction assistant. Analyze the following text and extract all social relationships. Output the results strictly as a CSV with the headers: SOURCE, TARGET, RELATIONSHIP. Do not include any other text or markdown.
Text:
{text_data}"""
Payload for Ollama
payload = {
"model": MODEL,
"prompt": prompt,
"stream": False
}
Send request to local LLM
response = requests.post(OLLAMA_URL, json=payload)
response_data = response.json()
csv_output = response_data['response'].strip()
Clean potential markdown code blocks
if csv_output.startswith("```"):
csv_output = csv_output.split("\n", 1)[-1].rsplit("\n", 1)[bash]
Save to CSV
with open(OUTPUT_FILE, 'w') as f:
f.write(csv_output)
print(f"Relationship CSV saved to {OUTPUT_FILE}")
3. Run the script:
– `python extract_relations.py`
3. Importing and Visualizing Data in Maltego
Once the CSV file is generated, it needs to be ingested into a link analysis tool. Maltego is the industry standard for this.
Step‑by‑step guide:
1. Open Maltego and create a new Graph.
2. Import the CSV:
- Go to `Import` -> `Import from File` ->
Text/CSV file.... - Select your `relationships.csv` file.
3. Map the columns:
- Set the `SOURCE` column as the Source Entity (e.g., create or use a “Person” entity).
- Set the `TARGET` column as the Target Entity.
- Set the `RELATIONSHIP` column as the Link Label.
- Run the Import. Maltego will generate the graph, visually displaying the network based on the relationships the LLM extracted from the text.
4. Addressing Hallucinations and Validation (The “Friends” Pitfall)
As noted in the LinkedIn discussion, LLMs can hallucinate relationships (e.g., inferring a romantic link between Rachel and Monica) or miss connections due to ambiguous pronouns.
Step‑by‑step guide for validation:
To ensure data integrity, implement a multi-stage validation process.
1. Cross-reference with Original Text: Use a simple script to highlight the sentences where a specific relationship was inferred. Tools like `grep` (Linux) or `Select-String` (PowerShell) can help.
– Linux: `grep -i “Rachel.Monica” input_data.txt`
2. Implement a Confidence Scoring Mechanism:
- Modify your LLM prompt to ask for a confidence score (e.g., 1-10) based on the explicitness of the relationship in the text.
- Revised Prompt Snippet: “…For each relationship, output: SOURCE, TARGET, RELATIONSHIP, CONFIDENCE_SCORE. Base the score on how directly the text states the connection.”
- Manual Review Filters: In Maltego, use the `CONFIDENCE_SCORE` to color-code or filter entities, allowing analysts to focus on high-confidence links first before investigating speculative ones.
-
Scaling Up: From Episodes to Thousands of Reports
For real-world intelligence, the volume of data can be massive. Processing this efficiently requires batching and potentially using vector databases for entity resolution (e.g., understanding that “Chandler Bing” and “Mr. Bing” are the same person).
Step‑by‑step guide for batching:
- Split large text files into smaller chunks (e.g., 500 words each) to stay within the LLM’s context window. Use the `split` command in Linux:
– `split -l 100 large_report.txt chunk_` (splits every 100 lines) - Loop through chunks using a bash script, calling the Python extraction script for each file.
- Consolidate outputs and use a simple Python script to merge entities that are likely the same, using fuzzy string matching (
pip install fuzzywuzzy).
What Undercode Say:
- AI is an Assistant, Not an Analyst: The “Friends” example perfectly illustrates that while LLMs can process information at scale, they lack the contextual understanding of a human analyst. The model’s failure to understand platonic friendship dynamics is a critical reminder that automated outputs must always be validated against human intelligence.
- Data Sovereignty Drives Innovation: The move toward small, offline models is not just a trend but a necessity for law enforcement. By utilizing tools like Ollama and Phi-3, agencies can harness the power of AI without compromising sensitive case data to third-party cloud servers, thus maintaining chain of custody and compliance.
The integration of local LLMs with network analysis tools like Maltego represents a significant leap forward for digital forensics and intelligence analysis. It transforms the tedious manual process of reading thousands of pages of text into a semi-automated workflow that highlights connections in minutes. However, as demonstrated by the model’s misinterpretation of a simple sitcom plot, the technology is still in its infancy. The future lies not in replacing the analyst, but in augmenting their capabilities—handling the “heavy lifting” of data processing so the human can focus on the nuances, context, and strategic insights that machines have yet to master.
Prediction:
Within the next two years, we will see the emergence of specialized, fine-tuned “OSINT models” that are trained specifically on intelligence reports and relationship dynamics, drastically reducing current hallucination rates. This will lead to the development of automated “first-draft” intelligence products, allowing human analysts to focus purely on validation, strategy, and the human elements of deception and motive that AI cannot yet grasp.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Tompjarvis Yesterday – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
