How to use quantified path correctly in this query (for find related bad actors)?

Neo4j Graph Platform Cypher
1

I created a test graph using this query

MERGE (u1:User {name: 'Bad1'})
MERGE (u2:User {name: 'Bad2'})
MERGE (u3:User {name: 'User3'})
MERGE (u4:User {name: 'User4'})
MERGE (u5:User {name: 'User5'})
MERGE (i1:IP {ip: '1.0.0.1'})
MERGE (i2:IP {ip: '1.0.0.2'})
MERGE (i3:IP {ip: '1.0.0.3'})
MERGE (i4:IP {ip: '1.0.0.4'})
MERGE (i5:IP {ip: '1.0.0.5'})
MERGE (a1:ASN {name: 'ASN1'})
MERGE (a2:ASN {name: 'ASN2'})
MERGE (a3:ASN {name: 'ASN3'})
MERGE (u1)-[:USED_IP]->(i1)
MERGE (u2)-[:USED_IP]->(i1)
MERGE (u2)-[:USED_IP]->(i5)
MERGE (u3)-[:USED_IP]->(i2)
MERGE (u3)-[:USED_IP]->(i3)
MERGE (u4)-[:USED_IP]->(i4)
MERGE (u5)-[:USED_IP]->(i5)
MERGE (i1)-[:FROM_ASN]->(a1)
MERGE (i2)-[:FROM_ASN]->(a1)
MERGE (i3)-[:FROM_ASN]->(a2)
MERGE (i4)-[:FROM_ASN]->(a2)
MERGE (i5)-[:FROM_ASN]->(a3);

Which is a simple User -- IP -- ASN graph

image
image1132×908 62.6 KB

Starting from Bad1, I want to find all the related users. I am using this query:

MATCH path=(bad:User where bad.name in ['Bad1'])
((:User)-[:USED_IP]-(:IP)-[:FROM_ASN]-(:ASN)-[:FROM_ASN]-(:IP)-[:USED_IP]-(:User)){1,2}
(:User)
return path

The rationale behind this query is that, starting from Bad1, I want to find all related users who are related through ASN1 within a certain number of hops.

However, the query doesn't return Bad2 and User5.

How can I modify the query so that Bad2 is also included?

2

I believe it is not returning Bad2 because neo4j will not traverse the same relationship twice within a single match statement; therefore, it will not find bad2 because the FROM_ASN relationship to ASN1 would have to be traversed twice to relate bad1 to bad2 with your pattern.

You could identify other patterns that find those other users and add using a union clause.

The other option is not to use quantified paths and use a variable length that finds all users reachable from bad1 that are related through either a FROM_ASN or USED_IP relationships.

3

Thanks for your suggestion! I will try both approaches. I am new to neo4j, and I used the quantified paths because I thought it's a relatively new feature that will replace variable length matching. But maybe I am wrong.