The degree of suspicion (DOS) quantifies our level of suspicion that a person may be involved in fraud. A DOS value of 0 means that this is a low-risk person and a DOS value of 9 means that this is a high-risk person.
Analysis of historical data shows that professional fraudsters have important positions in their social networks. To incorporate this, first we calculate all of the four centrality metrics of each vertex in our network. We then take the average of these vertices. This translates to the importance of that particular person in the network.
If a person associated with a vertex is involved in fraud, we illustrate this negative outcome by scoring the person using the pre-determined values shown in the preceding table. This is done so that the severity of the crime is reflected in the value of each individual DOS.
Finally, we multiply the average of the centrality metrics and the negative outcome score to get the value of the DOS. We normalize the DOS by dividing it by the maximum value of the DOS in the network.
Let's calculate the DOS for each of the nine nodes in the previous network:
| Node 1 | Node 2 | Node 3 | Node 4 | Node 5 | Node 6 | Node 7 | Node 8 | Node 9 | |
| Degree of centrality | 0.25 | 0.5 | 0.25 | 0.25 | 0.25 | 0.13 | 0.63 | 0.13 | 0.13 |
| Betweenness | 0.25 | 0.47 | 0 | 0 | 0 | 0 | 0.71 | 0 | 0 |
| Closeness | 0.5 | 0.61 | 0.53 | 0.47 | 0.47 | 0.34 | 0.72 | 0.4 | 0.4 |
| Eigenvector | 0.24 | 0.45 | 0.36 | 0.32 | 0.32 | 0.08 | 0.59 | 0.16 | 0.16 |
| Average of centrality Metrics |
0.31 | 0.51 | 0.29 | 0.26 | 0.26 | 0.14 | 0.66 | 0.17 | 0.17 |
| Negative outcome score | 0 | 6 | 0 | 0 | 7 | 8 | 10 | 0 | 0 |
| DOS | 0 | 3 | 0 | 0 | 1.82 | 1.1 | 6.625 | 0 | 0 |
| Normalized DOS | 0 | 0.47 | 0 | 0 | 0.27 | 0.17 | 1 | 0 | 0 |
Each of the nodes and their normalized DOS is shown in the following figure:
In order to calculate the DOS of the new node that has been added, we will use the following formula:
Using the relevant values, we will calculate the DOS as follows:
This will indicate the risk of fraud associated with this new node added to the system. It means that on a scale of 0 to 1, this person has a DOS value of 0.42. We can create different risk bins for the DOS, as follows:
| Value of the DOS | Risk classification |
| DOS = 0 | No risk |
| 0<DOS<=0.10 | Low risk |
| 0.10<DOS<=0.3 | Medium risk |
| DOS>0.3 | High risk |
Based on these criteria, it can be seen that the new individual is a high-risk person and should be flagged.
Usually, a time dimension is not involved when conducting such an analysis. But now, there are some advanced techniques that look at the growth of a graph as time progresses. This allows researchers to look at the relationship between vertices as the network evolves. Although such time-series analysis on graphs will increase the complexity of the problem by many times, it may give additional insight into the evidence of fraud that was not possible otherwise.