Echoes of the hidden: Uncovering coordination beyond network structure

TL;DR

The study tackles the problem of uncovering coordination that lies beyond observable network structure in encrypted or fragmented data. It introduces a burstiness-based detection approach and a network-of-networks informed generative model to explain cross-domain coordination as shock propagation across domains. Empirical results show that when observable connectivity density is below $70\%$, burstiness-based detection significantly outperforms baselines from both structure- and time-series perspectives. This work provides a framework for identifying hidden, cross-domain coordination with practical implications for risk management, cyber defense, and informed decision-making in complex, data-restricted environments.

Abstract

The study of connectivity and coordination has drawn increasing attention in recent decades due to their central role in driving markets, shaping societal dynamics, and influencing biological systems. Traditionally, observable connections, such as phone calls, financial transactions, or social media connections, have been used to infer coordination and connectivity. However, incomplete, encrypted, or fragmented data, alongside the ubiquity of communication platforms and deliberate obfuscation, often leave many real-world connections hidden. In this study, we demonstrate that coordinating individuals exhibit shared bursty activity patterns, enabling their detection even when observable links between them are sparse or entirely absent. We further propose a generative model based on the network of networks formalism to account for the mechanisms driving this collaborative burstiness, attributing it to shock propagation across networks rather than isolated individual behavior. Model simulations demonstrate that when observable connection density is below 70\%, burstiness significantly improves coordination detection compared to state-of-the-art temporal and structural methods. This work provides a new perspective on community and coordination dynamics, advancing both theoretical understanding and practical detection. By laying the foundation for identifying hidden connections beyond observable network structures, it enables detection across different platforms, alongside enhancing system behavior understanding, informed decision-making, and risk mitigation.

Figures (7)

• Figure 1: Community synchronization. Presenting three layers of data. a. Control plane encompassing three communities, with members coordinating in the real world. b. Data plane encompassing four distinct domains, with node color indicating community membership. Blue nodes illustrate the implicit connections across domains formed by the collaborating community members. c. Bursty dynamics of each community member, colors indicating community membership.
• Figure 2: Performance evaluation.a, b. Normalized mutual information for community detection in the financial markets and in the social platforms experiments, correspondingly. The bursty model outperforms all temporal (blue-shaded) and structural (yellow-shaded) models in both experiments. c, d, e. Example of cross-platform financial communities, detected using the bursty model, Chronos temporal model and deepWalk structural model, correspondingly.
• Figure 3: Generative model simulations.a. Simulation control plane, encompassing three communities of varying weights. b. Temporal networks in the data plane, resulting from bursty-SBM model simulations. c. Inter-event distributions of individual community members, colors indicating community membership. d, e, f. Simulation communities detection by the bursty, structural and temporal models, correspondingly.
• Figure 4: Density effect on community detection Community detection performance comparison of the bursty model (purple curve) to temporal (orange curve) and structural (light blue curve) models, and their dependence on intra-community edge percentage. The bursty model significantly outperforms baselines when less than $70\%$ of edges in the data plane are between community members.
• Figure 5: Coordination detection in a single financial market Comparing the performance of the inter-event bursty model to temporal (blue-shaded) and structural (yellow-shaded) state of the art models. a. Normalized Mutual Information (NMI) for coordination detection. b. Adjusted Rand Index (ARI) for coordination detection. The bursty model outperforms all baseline models.

Theorems & Definitions (2)

• Definition 1
• Definition 2