Simplicial complexes in network intrusion profiling: pattern construction through simplicial centralities

REVIEW Open Access © The Author(s) 2025. Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/. von Westenholz et al. Applied Network Science (2025) 10:35 https://doi.org/10.1007/s41109-025-00720-z *Correspondence: Mandala von Westenholz mvonwestenho@uni-osnabrueck. de Full list of author information is available at the end of the article Simplicial complexes in network intrusion profiling: pattern construction through simplicial centralities Mandalavon Westenholz1,4*, MartinAtzmueller2,3,4 and TimRömer1,4 Introduction Network intrusion detection (see, e.g.,(Mukherjee etal. 1994; Sommer and Paxson 2010)) is a prominent and important research direction due to growing challenges in cyber security, e.g.,relating to the risk for all that personal data will be assaulted (see, e.g.,(Rosenberg 2017; Walters and Novak 2021)), as well as increased cyber security measures in general (Tirumala etal. 2019). Hence, it is of particular interest to enhance our understanding for making sense of such situations and data, e.g.,by identifying and considering groups of special IP addresses, like the ones that are attacked as well as the attackers themselves during a series of intrusion assaults. For that, we apply graph-based methods. In general, graph-based approaches have found various applications in computer science, mathematics, and neighbouring disciplines (see, e.g.,(Marisca etal. 2024; Kosk 2024; Tang 2023)). In Atzmueller etal. (2023), such an idea was used to model network intrusion detection data, in order to perform group-based analysis of critical situations, i.e.,specific network intrusion events. More Applied Network Science Abstract For studying intrusion detection data we consider data points referring to individual IP addresses and their connections. We build networks represented by graphs associated with those data points, such that vertices in a graph are constructed to denote the respective IP addresses, with the key property that attacked data points are part of the structure of the network. More precisely, this paper proposes a novel approach using simplicial complexes to model the desired network and the respective intrusions in terms of simplicial attributes, thus generalizing previous graph-based approaches. Applying adapted network centrality measures related to simplicial complexes yields patterns associated to vertices, which themselves contain a set of features. These are used to describe the attacked or the attacker vertices, respectively. Comparing this new strategy with classical concepts demonstrates the advantages of the presented approach using simplicial features for detecting and characterizing intrusions. Keywords Simplicial complex, Network intrusion profiling, Simplicial patterns Page 2 of 27von Westenholz et al. Applied Network Science (2025) 10:35 precisely, IP addresses correspond to vertices of an associated directed graph modeled using the network intrusion data. In this graph, there is an edge between two vertices whenever there exists any kind of data exchange between the respective IP addresses. Given such a graph, the authors in Atzmueller etal. (2023) aimed to find patterns associated to vertices, which are themselves sets of well-chosen features of the IP addresses and the respective nodes. The goal is to find common properties (i.e.,sets of features) of groups of vertices that best characterize groups of IP addresses of interest as good as possible, such as the ones related to attackers or attacked data points. For this purpose, graph centrality measures are used to construct specific features as properties of interesting subsets of the vertices of the graph. It turns out that graph-based patterns described in Atzmueller etal. (2023) describe critical situations of IP addresses much better than non-graph-based patterns related to classical constructions. However, there is room for improvement, since graphs only enable the detection of possible pairwise interactions between IP addresses. In contrast, higher order structures, like the interaction of three or more addresses simultaneously are then not directly accessible. There is the need for generalizing the graph-based approach from above in a suitable way, which still is simple enough for practical application. This need is motivated by the latter observation. Simplicial complexes are fulfilling this aim, and that is why we propose these for modeling, analysis and interpretation. Recall that given a set of vertices V, such a simplicial complex is a set of subsets of V, called faces, which is closed under taking subsets. Geometrically, each of these subset corresponds to the vertices of a simplex in a given real vector space. In this work, we usually use Vietoris–Rips complexes (see, e.g.,in general (Edelsbrunner and Harer 2022; Gilbert 1961; Hug and Reitzner 2016; Penrose 2003) and for specific contexts, e.g.,(Akinwande and Reitzner 2020; Reitzner etal. 2024; Grygierek etal. 2020) where V⊂Rn and a set of vertices induces a face if and only if pairwise each two vertices are close enough with respect to a given metric. Given such a simplicial complex, we can associate patterns of features to its vertices using the simplicial structure of the complex. Such a simplicial approach turns out to be effective for describing and studying the structure of a network based on faces in various dimensions. For example, we might be interested in selecting a facet of the highest dimension containing a given vertex v as a feature of a pattern. Then, v is connected to the other vertices of this facet; in this way, we can then describe the connectivity of v concerning the whole network. Observe that graphs appear exactly as 1-dimensional skeletons of simplicial complexes, only containing the faces of dimensions 0 and 1 – thus only providing a 1-dimensional perspective. In contrast, our new approach generalizes the methods in Atzmueller etal. (2023) using simplices in given complexes of higher dimensions. We focus on centrality measures related to simplicial complexes to yield new patterns associated to vertices, which are not visible in the world of graphs. The rest of the paper is structured as follows. Section“Preliminaries” presents relevant basics on simplicial complexes. Next, Section“Adjacencies and degrees for simplicial complexes” provides suitable notions of adjacencies and degrees of faces of simplicial complexes. Note that there are several ways adjacencies can be defined (see (Serrano and Gómez 2020)). In this paper, we use the variant generalizing graph adjacencies. With these definitions, centralities for vertices are constructed in Section“Simplicial Page 3 of 27von Westenholz et al. Applied Network Science (2025) 10:35 centrality measures”, which are generalizations of graph-based centrality measures. In Section“Building patterns”, it is outlined how we can construct simplicial patterns with features, in particular, those ones relying on simplicial centrality measures. Next, purely graph-based patterns and simplicial ones are analyzed. For this, quality functions are introduced, which compare measures for vertices of interest (e.g.,attackers in the network) in relation to all vertices, and measures for vertices of interest inside the support of patterns in relation to its complete support. It turns out that simplicial patterns based in high dimensional structures are significantly better for several complex networks than purely graph-based patterns, as studied in Atzmueller etal. (2023). We conclude the paper with an outlook in Section“Outlook”, presenting a discussion with respect to further work and interesting research directions how to investigate simplicial patterns as related to a network further. Preliminaries In this section, definitions and notation related to simplicial complexes are given, which are used all over the manuscript. For more details, for example, see Munkres (2018), Bobrowski and Kahle (2018), Kahle and Meckes (2013), Stanley (2007). Definition 2.1 Let V={v1,..., v m} be a finite set. A family ∆ of subsets of V is an abstract simplicial complex, if for any σ∈∆and τ⊆σholds τ∈∆. For 0≤k≤m−1 , an element σ∈∆ with |σ|=k+1 is called an abstract k-simplex and k is called the dimension of σ . The highest possible dimension k of an abstract k-simplex in an abstract simplicial complex is called the dimension of the complex. Observe that every abstract simplicial complex can be realized as a geometric simplicial complex (see, e.g.,(Munkres 2018)) in Rn with a sufficiently large n. In the following we are always considering abstract simplicial complexes. For brevity, we often skip the word “abstract” for the corresponding objects. Example 2.2 The (abstract) simplicial complex {∅ , { x1 } , { x2 } , { x3 } , { x4 } , { x5 } , { x1,x 2 } , { x1,x 3 } , { x2,x 3 }, {x4,x 5},{x2,x 5},{x2,x 4},{x1,x 2,x 3},{x4,x 5,x 2}} can be realized in R2 . A possible realization is illustrated in Fig. 1. Though interesting questions in research are related to such embeddings, they are not discussed in this manuscript, except implicitly when illustrating complexes in pictures. Remark 2.3 For this work, it is important to note that simplicial complexes are very good models for describing networks. More precisely, objects in a network correspond to vertices. Such vertices are connected by an edge if the related objects fulfill a given relationship (which is based on the context of the network). A k-simplex with k>1 in the simplicial complex specifies whether a set of at least k+1 vertices fulfills some kind of pairwise relationship of interest. Page 4 of 27von Westenholz et al. Applied Network Science (2025) 10:35 There are several ways to build a simplicial complex on a set of vertices. A key construction in various areas (see, e.g.,( Edelsbrunner and Harer 2022; Gilbert 1961; Hug and Reitzner 2016; Penrose 2003)) is given in the following definition. Definition 2.4 Let V={ v 1 ,..., v m}∈Rn , r∈R>0 , and a given metric d on Rn . The Vietoris–Rips complex R(V, r) is the simplicial complex, whose k-simplices σ( k ) are the sets {v i 1,..., v i k+1 }⊆V with d( v il ,v ij)≤ r for all j, l ∈{1 ,...,k +1}. The Vietoris–Rips complex is the clique complex (see, e.g.,(Kozlov 2008)) of the underlying graph G consisting of its 0and 1-dimensional faces. This means that whenever there exists a (k+ 1) -clique in G, the corresponding k-simplex belongs to the simplicial complex. Note that there are many other ways to create simplicial complexes, like Cěch complexes. The Vietoris–Rips construction is the only one that is used in this paper. To construct a Vietoris–Rips complex, it is required to define the distance between two data points x1,x 2∈Rn via a metric d. There are several reasonable options for that. Below, there are some suggestions, where the objects according to Remark2.3 are IP addresses and one is interested in their interaction in the internet. •Euclidean distance d1(x1,x 2)=∥x2−x1∥2 •Other spatial distances like d2(x1,x 2)=∥x2−x1∥∞ or d3(x1,x 2)=∥x2−x1∥1 • d 4(x1,x 2)= {1 ϵif there is a possible data exchange of size ϵbetween x1,x 2 2otherwise • d 5(x1,x 2)= {0if there is a possible data exchange between x 1 and x 2 1 otherwise Example 2.5 The simplicial complex in Example2.2 is a Vietoris–Rips complex with V={x1,x 2,x 3,x 4,x 5} , d=d1 , and r=3 . If one is interested in relationships and in activities that are taking place at a special location, e.g.,in a company, it might be helpful to consider spatial distances, like the Euclidean one. There are situations where it might be more reasonable to use distances which are more closely related to possible data exchange, like d4 and d5 . Recall that the constructions of graphs in Atzmueller etal. (2023) are based on placing an (undirected) edge between two vertices v and w in a finite vertex set V corresponding Fig. 1 Geometric realization of a simplicial complex Page 5 of 27von Westenholz et al. Applied Network Science (2025) 10:35 to IP-addresses, when they interact (in one or two directions). These are exactly Vietoris–Rips graphs (which are also called Gilbert graphs or random geometric graphs Gilbert (1961)) using the metric d5 . Example 2.6 Let us reconsider the simplicial complex of Example2.2. Some exemplary distances are given by d1,...,d 5 from above, which are d 1(x1,x 2)= √10 4 ,d 2(x1,x 2)= 3 2 ,d 3(x1,x 2)=2,d 4(x1,x 2)depends on e, d5(x1,x 2 )=0. Note that one can also distinguish between incoming and outcoming data by adding directions to our constructions so far. In this work, we always consider undirected situations. Adjacencies and degrees for simplicial complexes Notions like adjacencies and degrees in graphs are well known (see, e.g.,(Diestel 2025)). Generalizing this to simplicial complexes and based on the work in Serrano and Gómez (2020), the main goal of this section is to introduce various types of adjacencies and degrees in such complexes. Later, these notions are then used, in particular, to construct features of vertices, which use simplicial centrality measures. From now on a simplicial complex is always denoted by ∆ and σ( q ) is a simplex in ∆ of dimension q. First we give the following definitions from Serrano and Gómez (2020,Section 2.1) which will be important in the upcoming parts of this paper. Definition 3.1 Let σ(q)=∅ and σ′( q ′)=∅ be different simplices in ∆ and p∈N with 1≤p≤dim∆ . Then, we define the following: (i) σ( q ) and σ′( q ′) are called p-upper adjacent, denoted by σ(q)∼Up σ ′(q′) if there exists ap−simplex τ( p )∈∆,having both σ( q )and σ′( q ′)as faces. (ii) σ( q ) and σ′( q ′) are called strictly p-upper adjacent, denoted by σ( q )∼ U∗ p σ ′( q ′), if σ( q )∼Up σ′ ( q ′)and σ ( q )∼Up+1 σ′ ( q ′). (iii) The p-upper degree of σ(q) is degp U( σ ( q ))=|{ σ′′ ( q ′′ )∈∆| σ ( q )∼ U p σ′′ ( q ′′ )}|. (iv) The (h,p)-upper degree of σ(q) 1 is deg( h,p ) U( σ ( q ))=|{ σ′′ ( q + h )∈∆| σ′′ ( q + h )∼ U p σ ( q )}|. (v) The strict (h,p)-upper degree of σ(q) is deg( h,p )∗ U( σ ( q ))=|{ σ′′ ( q + h )∈∆| σ′′ ( q + h )∼ U p∗ σ ( q )}|. Page 6 of 27von Westenholz et al. Applied Network Science (2025) 10:35 (vi) The maximal simplicial upper degree of σ(q) is deg ∗ U(σ(q))= dim ∆ −q ∑ h=1 deg(h,(q+h))∗ U(σ(q)) . Notice that the maximal simplicial upper degree deg∗ U( σ (q)) counts the number of maximal simplices, which have dimension strictly higher than q, that contain the simplex σ( q ) . Example 3.2 (i) Two (abstract) simplices, which are faces of a solid tetrahedron are 3-upper adjacent. (ii) Two vertices which share a common edge are 1-upper adjacent; they are even strict 1-upper adjacent, if they are not lying in a common triangle. There are also other variations of the concept of adjacency and degree, which are also introduced in Serrano and Gómez (2020,Section 2.1), that are listed below. Definition 3.3 Let σ(q)=∅ and σ′( q ′)=∅ be different simplices in ∆ and p∈N with 0≤p≤dim ∆−1 . Then, we define the following: (i) σ(q) and σ′( q ′) are called p-lower adjacent, if | σ ( q )∩ σ ′( q ′)|≥ p +1. This is denoted by σ(q)∼Lp σ ′(q′). (ii) σ(q) and σ′(q′) are called strictly p-lower adjacent, if |σ(q)∩σ′(q′)|=p+1. This is denoted by σ( q )∼ L p∗ σ′ ( q ′). (iii) The p-lower degree of σ(q) is degp L( σ ( q ))=|{ σ′′ ( q ′′ )∈∆| σ ( q )∼ L p σ′′ ( q ′′ )}|. (iv) σ(q) and σ′(q′) are called p-adjacent, if they are strictly p-lower adjacent and not p′ -upper adjacent for p′=q+q′−p . This is denoted by σ( q )∼Ap σ′ ( q ′). (v) The p-adjaceny degree of σ(q) is degp A( σ ( q ))=|{ σ ′′( q ′′ )∈∆| σ ( q )∼Ap σ ′′( q ′′ )}|. (vi) σ(q) and σ′( q ′) are called maximal p-adjacent, denoted by σ( q )∼ A ∗ p σ ′( q ′) if and only if σ( q )∼ A p σ ′( q ′)and σ ′( q ′)⊈ σ ′′( q ′′ )whenever σ ( q )∼ A p σ ′′( q ′′ ). (vii) The maximal p-adjaceny degree of σ(q) is Page 7 of 27von Westenholz et al. Applied Network Science (2025) 10:35 degp∗ A( σ ( q ))=|{ σ′′ ( q ′′ )∈∆| σ ( q )∼ A∗ p σ′′ ( q ′′ )}|. (viii) The maximal simplicial degree of σ(q) is deg∗( σ (q)) = deg∗ A( σ (q)) + deg∗ U( σ (q)), where deg ∗ A(σ(q))= q −1 ∑ p=0 degp∗ A(σ(q)) . The following examples are some illustrations for the definitions introduced so far. Example 3.4 Consider the simplicial complex from Example2.2. The simplices x1,x 2,x 3 and x2,x 4,x 5 exhibit the properties outlined below: (i) x2 is a vertex of both simplices. Hence, they are 0-lower adjacent. They are strictly 0-lower adjacent as well, as they share no simplex of higher dimension. (ii) Both simplices are not included in a common simplex of higher dimension, so they are not p-upper adjacent for any p. (iii) They are 0-adjacent, since they are strictly 0-lower adjacent and they are not 4-upper adjacent. (iv) The 0-adjacency degree of {x1,x 2,x 3} is 3, since besides {x2,x 4,x 5} , also {x2,x 4} and {x2,x 5} are 0-adjacent to {x1,x 2,x 3} . In the upcoming sections, we will focus on those situations, where one simplex is always a vertex, although Definition3.3 is of course also usable for simplices of higher dimensions. In this special case we observe for graphs, that two vertices are called adjacent, when they both share a common edge. This graph-adjacency is covered by the definitions of adjacencies in simplicial complexes above as well. More precisely, we have the following result. Lemma 3.5 Let G=( V,E ) be a graph and v∈V be a vertex. Then, the following properties hold: (i) Let w∈V be another vertex in G. Then, w and v are graph-adjacent if and only if they are 1-upper adjacent. (ii) If v=w∈V , then v,w are not p-lower adjacent and they are not p-adjacent for any 0≤p≤dim ∆ −1 . Proof (i) If v and w are graph-adjacent, then it follows immediately from the definitions, that they are 1-upper adjacent. On the other hand, if v and w are 1-upper adjacent, then they are both a face of a 1-simplex (i.e.,an edge) of G. (ii) The vertices v and w have no non-trivial face in common and are not p-lower adjacent for any possible p. This implies that they are also not p-adjacent for such a p. □ Lemma 3.6 Let v∈∆ be a vertex. Then Page 8 of 27von Westenholz et al. Applied Network Science (2025) 10:35 (i) degp L(v) = degp A(v)=0 for all p>0 , (ii) degp L( v )=0=deg p A( v ) for p=0 , (iii) deg∗( v ) = deg∗ U( v ). Proof (i) Since a vertex has no other non-trivial simplices as subsets, the conclusion follows. (ii) By definition v is not 0-lower adjacent to itself. Hence, degp L(v)=0=deg p A(v)=0 . (iii) Since degp A( v )=0 , we have degp∗ A( σ ( q ))=0 . This concludes the proof. □ Below, we are mainly interested in simplices in which a given vertex is included. In this context, only p-upper adjacencies and related degrees are of interest. The upperadjacency is also reasonable to use, as it is a generalization of graph-adjacencies due to Lemma3.5. Hence, in the following we only use p-upper adjacencies. Simplicial centrality measures In this section, we introduce centrality measures for simplicial complexes which are motivated by the same concept related to graphs. In the following we focus on the degree and closeness centralities. These generalizations of well-known graph degree and closeness centralities (see, e.g.,(Borgatti and Everett 2006; Newman 2018)) have all been proposed in Serrano and Gómez (2020). With these centrality measures we create features for vertices of a complex as announced above in the introduction in Section“Introduction”. To be more formal, a centrality measure is a function c:I→R, where I is the set, which is usually called the set of individuals. If I is a simplicial complex, then a more important simplex σ∈I , i.e.,one with a significantly high centrality c( σ ) , contains way more valuable information regarding the considered network than simplices with smaller centralities. There are many possibilities to define such a centrality measure. Hereby, the notation cσ is an abbreviation for the function value c(σ) . Motivated by definitions and suggestions in Serrano and Gómez (2020), we introduce the following centrality measures for simplicial complexes. Observe that in that work, the authors propose centrality measures with images in [0,1]. But, to be consistent with the considered centrality measures in Atzmueller etal. (2023), such normalizations are neglected in this manuscript. Then, centrality measures in Atzmueller etal. (2023) are special cases of the simplicial versions given below. For simplicity, the following concepts are only defined for vertices of simplicial complexes, since, in this paper in considered applications individuals are always vertices. As already mentioned, in the end of Section“Adjacencies and degrees for simplicial complexes”, only upper degrees are considered. The first centrality measure of importance is the one from the following definition. Definition 4.1 Let σ∈∆ be a vertex and p∈N>0 . Then cDp σ= degp U(σ) is the p-degree centrality of σ and Page 9 of 27von Westenholz et al. Applied Network Science (2025) 10:35 cD∗ σ= deg∗(σ) is the maximal simplicial degree centrality of σ . See (Serrano and Gómez 2020, Def. 12, 13) for a related definition. An important property of this centrality measure is discussed in the following theorem. Theorem 4.2 The p-degree centrality of a vertex σ∈∆ fulfills c Dp σ≤ p +1 ∑ j=1 ( deg(0,1) U(σ)+1 j ) −1 . (1) Proof Observe that ( j −1) -dimensional faces in ∆ with 2≤j≤p+1 are p-upper adjacent to σ , if they lie in a common p-dimensional simplex with σ . Given such a face, all its vertices not equal to σ have the property that they induce an edge in ∆ together with σ , i.e.,they are (0,1)-adjacent to σ . Note that σ might be a vertex of such a face or not. Hence, it suffices to count all possible (j−1) -faces induced by vertices which are either σ or (0,1)-adjacent to σ , accepting an over-count of such situations. Finally, there are at most deg(0,1) U(σ) many 0-dimensional faces in ∆ which are p-upper adjacent to σ . This concludes the proof. □ There is some significant computational effort required to provide an upper bound for the p-degree centrality of σ through Theorem4.2. Next, we define a further degree centrality which allows alternative upper bounds. Definition 4.3 Let σ∈∆ be a vertex and p∈N>0 . Then c D (p,p) σ= deg( p,p ) U( σ ) is the (p,p)-degree centrality of σ and c D ( p,p )∗ σ= deg( p,p )∗ U( σ ) is the (p,p)-strict degree centrality of σ . See (Serrano and Gómez 2020, Def. 10, 11) for a related definition. Note that the (p,p)- degree centrality of σ is the number of p-dimensional faces of ∆ that contain σ , and the (p,p)-strict degree centrality is the corresponding strict version. Since σ is always a simplex of dimension 0, we have c D∗ σ= dim ∆ ∑ p =1 deg(p,p)∗ U(σ) . (2) Remark 4.4 A new upper bound for c D p σ is c Dp σ≤deg( p,p ) U(σ)·(2 p +1 −2) = c D ( p,p ) σ·(2 p +1 −2). (3) This bound follows from the fact that every non-trivial face, except for σ , of a p-simplex, containing σ , is p-upper adjacent to σ . The upper bound in (3) is often better than the bound in Theorem4.2. For example, consider a simplicial complex ∆ which has exactly one tetrahedron that contains σ , and Page 16 of 27von Westenholz et al. Applied Network Science (2025) 10:35 is called a k-pattern with respect to F. We denote the set of k-patterns by F(k) . Then, we say that p∈F(k) is true with respect to i∈I , if p( i )={ f 1 b1( i ) ,...,f k bk( i )}={1}. The support of p is sp={i∈I|p(i)={1}} ⊆ I, which is also called the p-fulfilling individuals. Set ip:= |sp| . Remark 5.3 (i) Let ∆ be an attributed simplicial complex and p be a compatible pattern. This pattern can also be considered as true or false with respect to a vertex σ∈∆ by taking the value p(i), where i is the first component of D(σ) . (ii) In the literature, e.g.,in Atzmueller etal. (2023), there exist various ways of defining patterns. For example, one could equip the patterns with more structure by using tuples instead of sets. This provides the opportunity to consider multiplicities and to order the features. In this paper, patterns are always sets, which is suitable for the considered applications below. For binary functions as already considered above, it is useful to introduce the following notation. Definition 5.4 Let p be a pattern. A target t is a binary function t:I→{0,1}. The target share of t with respect to p is t p:= |{i∈s p |t(i)=1}| i p = |{i∈I|p(i)=1and t(i)=1}| i p . For a given target, we search for patterns with a high target share. To find a useful measurement for the pattern quality and, thus, for its interestingness, we consider a quality function (see (Atzmueller 2015; Atzmueller etal. 2023; Grosskreutz etal. 2008) for further details). Definition 5.5 Given a target t, a k-quality function is a real-valued function qt:F(k)→R. The quality of a k-pattern p with respect to t is given by qt(p) . Let t 0 =|{ i ∈ I | t ( i )=1}| |I| be the share of the individuals that fulfill a target t with respect to all individuals and choose a∈R such that (ip)a is well defined. For example, the quality of a k-pattern p with respect to t can now be determined by the following k-quality function. qa t(p)=(ip)a·(tp−t0). (6) Here, we target situations, for example, where t0 is rather small in comparison to tp and tp itself should be much larger. The size of the pattern in terms of contained instances is then weighted by parameter a. Based on this approach, several well-established quality functions can be found in the literature Atzmueller (2015), as shown below: •The gain quality function q0 t , Page 17 of 27von Westenholz et al. Applied Network Science (2025) 10:35 •The binomial test quality function q0.5 t , •The Piatetsky–Shapiro quality function q1 t . Then, the goal is to find patterns with a high quality value, i.e.,a high qa t(p) for a pattern p, with a given a and the target t as the concept of interest. In the remaining part of this section, strategies are discussed to build and then to evaluate simplicial-based patterns. For a sample data set, we investigate the problem whether simplicial features help to increase the quality of corresponding patterns in comparison to graph-based features. For this purpose, we focus on patterns in the context of specifically constructed synthetic data, which specifically features analysis options for our evaluation strategies. For generating synthetic data in our application context, we rely on standard approaches from the field of complex networks, applying the susceptible infectious (SI) model, e.g.,(Crepey etal. 2006; Li 2018), for generating the non-attacker/attacker structures. Thus, at first, we create synthetic data by building a simplicial complex, whose vertices are assigned as attackers or non-attackers (which are partially attacked). Using the obtained synthetic dataset, we create features using the available metrics on simplicial complexes and networks, respectively. Using these features, we can then construct patterns with respect to the targets attacker/non-attacker, for studying the impact of metrics on simplicial complexes. Remark 5.6 The strategy for constructing the synthetic data is given through the following steps. (i) Choose an existing and real world social network which has not too many individuals. Then, these correspond to vertices, which are connected by an edge if there is interaction on the level of individuals. (ii) Choose a number k∈N and select k random vertices to be attackers. (iii) Create s time periods of attacks on the given social network. Individuals who have been attacked may mutate into new attackers. (iv) Determine a resulting network from (iii) for further investigations. (v) Build the Vietoris–Rips complex of the underlying network from (iv) using the metric d5 from Section2. In the following we apply this algorithm on one specific social network to illustrate our modeling and analysis approach using simplicial complexes. In particular, for step (i), here we use the congress network from Fink (2023), which is reduced to the first 20 individuals. Thus, all other vertices (with numbers 21–475), as well as all edges involving at least one of such vertices are deleted. The resulting network is illustrated in Fig.4. For step (ii), four data points are randomly chosen with respect to the discrete uniform distribution. Then, we perform steps (iii) and (iv) for s=1 and use the SI model approach described below. Finally, the Vietoris–Rips distance is chosen as r=1/2 for step (v); see Definition2.4. For (iii) it remains to discuss shortly the SI model for modelling disease infections at a time t, which is well-known in the literature (see, e.g.,(Li 2018)). Let Page 18 of 27von Westenholz et al. Applied Network Science (2025) 10:35 Sdenote the number of susceptible individuals (non-attackers), and V the number of virus infectious individuals (attackers), where S=f(t)and V=g(t) for functions f and g with values in N at a time t≥0 . There are the following necessary assumptions for the SI model: (i) No births and deaths happen, i.e.,the number of total individuals N is constant at any time t. This means f(t)+g(t)=Nfor all t≥0. (7) (ii) As suggested in Li (2018, Equation 1.21), we choose the infection reproducing rate as r=P·λ/N, where P is the probability of a contact to produce an infection and λ is the average contact number which is also given by the average (1,1)-degree of the vertices in the corresponding network. The change of the susceptibles is modeled by a multiple of the product of the number of the two groups (attackers and non-attackers), since this model assumes that the rate of change is proportional to the number of susceptibles and the number of infectious individuals. Moreover, −dS dt =dV dt due to Eq. (7). Hence, the change of infectious and susceptible individuals is described by dS dt = − cV · Sand dV dt =cV ·S Fig. 4 Modified congress network Page 19 of 27von Westenholz et al. Applied Network Science (2025) 10:35 for a constant c∈R . Thus, one has dV dt =cNV · (1 − V /N ) . Assuming that V≪N it follows V N∼0 . Hence, dV dt ≈ cN · V=rV with the change rate r=cN . Since the resulting differential equation dV dt =rV (1 −V N) (8) is separable, one obtains the integral equation ∫1 V(1 − V N )dV = ∫r dt, which can be solved by using partial fraction decomposition. ∫ r dt = ∫ A V+B 1− V N dV = ∫ A (1 − V N ) V (1 − V N) +BV V (1 − V N) dV leads to the solution A=1 and B=1/N . So, we obtain ∫ rdt = ∫1 N(1 − V N )dV + ∫1 V dV. Observe that by calculating the integrals we have rt +c1= ln(V) − ln(N − V) = ln V N−V. Finally, one receives e rtec1= V N−V. This equation can be transformed into V= e rt c 2 N − e rt c 2 V by defining c2:= ec1 . Then, V can be rewritten as V =e rt c2N 1+ertc 2 =e rt c2N e rt c2(1+e− rt c −1 2) =N 1+e − rtc (9) by defining another constant c:= c −1 2 . This constant c can be computed by inserting t=0 into the previous equation. The equation g (0) = N 1+e− r · 0 c leads to Page 20 of 27von Westenholz et al. Applied Network Science (2025) 10:35 c = N g(0) − 1 . Equation (9) implies that g (t)= N 1+( N g(0) − 1)e−rt . (10) An analogous consideration for S shows that f (t)= N 1+( N g (0) − 1)ert . (11) In the limit one has lim t→∞ g(t) = lim t →∞ N 1+( N g(0) − 1) · e−rt =Nand lim t →∞ f(t) = lim t →∞ N 1+( N g(0) − 1) · ert =0, since e− rt t →∞ →0 . This means that in the limit everyone is infected. Applying the SI model and, in particular, Eqs. (10) and (11) we employ the following algorithm for step (iii) in Remark5.6 using the modified congress data set. Algorithm 5.7 (i) Choose randomly a start population of k= g (0) = 4 attackers. (ii) Compute the number of virus infectious individuals g(1) where the probability of a contact to produce an infection is chosen as P=0.2 . (iii) From the set of susceptible individuals, which are connected to at least one infectious individual, choose randomly g(1) −g(0) many individuals with respect to the discrete uniform distribution. (iv) The set of virus infectious individuals at time 1 is then given by the infectious individual at time 0 together with the new ones. After applying Algorithm5.7 on the modified congress network data set, one obtains the attacker data set which is shown in Fig.5 below (the blue vertices correspond to the attackers). With the given synthetic data, one is able to build simplicial patterns using measures from Section4. To keep the discussion simple, we focus on patterns of length 1, which means that we only concentrate on one feature in each pattern. More precisely, the following features are discussed, where  is the indicator-function and k,l ∈R . (i)  ( cD (p,p) σ <k )and  ( cD (p,p) σ >l ), (ii)   ( c Ep σ <k )and  ( c Ep σ >l ), (iii)  (cCp σ<k)and  (cCp σ>l). We compare the chosen feature patterns of length 1 for p=1 , which corresponds to the graph-based case that is already discussed in Atzmueller etal. (2023), and for larger p with each other by computing their quality q0 ti with respect to the target of finding Page 21 of 27von Westenholz et al. Applied Network Science (2025) 10:35 attackers and non-attackers. This means that targets t1 and t2 are considered, where t1 maps an individual to 1 if it is a non-attacker and otherwise to 0, and t2 maps an individual to 1 if it is an attacker and otherwise to 0. For (i) the quality values of the features p1=(c D (1 , 1) σ<k 1),p 2=(c D (2 , 2) σ<k 2)and p3=(c D (3 , 3) σ<k 3) are analyzed with respect to t1 . Moreover, the quality values of the features p3=(c D (1 , 1) σ>l 1),p 4=(c D (2 , 2) σ>l 2)and p5=(c D (3 , 3) σ>l 3) are analyzed with respect to t2 . One could also construct length-one patterns using features c D (p,p) σ for p≥4 , but in this example it suffices to consider p<4 . As illustrated in Fig.5 no simplices exist in the network with dimensions higher than 3 (see Table1). Here we choose k1=4,k 2=2and k3=1 as well as l1=5,l 2= 14 and l3=7. These choices turn out to deliver the best quality values q0 t1 (resp. q0 t2 ) for c D (i,i) σ>l i (resp. c D (i,i) σ<k i ) compared to other possible numbers. The features as well as the property of being an attacker or a non-attacker are shown in Table1. More precisely, the considered patterns have the quality values which are determined via Fig. 5 Modified congress network with attackers after one time step of SI Page 22 of 27von Westenholz et al. Applied Network Science (2025) 10:35 Table 1 (p, p)-degree centralities Vertex c D (1,1) c D (2,2) c D (3,3) c D (4,4) Attacker? Non-attacker? 0 6 5 1 0 0 1 1 3 2 0 0 0 1 2 3 1 0 0 0 1 3 5 6 2 0 0 1 4 6 5 0 0 1 0 5 2 1 0 0 0 1 6 1 0 0 0 0 1 7 5 7 3 0 0 1 8 8 12 6 0 0 1 9 6 3 0 0 1 0 10 2 0 0 0 0 1 11 8 9 3 0 0 1 12 6 8 2 0 1 0 13 10 14 6 0 0 1 14 4 2 0 0 1 0 15 6 6 2 0 1 0 16 4 4 1 0 0 1 17 12 21 8 0 1 0 18 5 3 0 0 1 0 19 4 5 2 0 0 1 Vertex p1 p2 p3 p4 p5 p6 0 0 0 0 1 0 0 1 1 0 1 0 0 0 2 1 1 1 0 0 0 3 0 0 0 0 0 0 4 0 0 1 1 0 0 5 1 1 1 0 0 0 6 1 1 1 0 0 0 7 0 0 0 0 0 0 8 0 0 0 1 0 0 9 0 0 1 1 0 0 10 1 1 1 0 0 0 11 0 0 0 1 0 0 12 0 0 0 1 0 0 13 0 0 0 1 0 0 14 0 0 1 0 0 0 15 0 0 0 1 0 0 16 0 0 0 0 0 0 17 0 0 0 1 1 1 18 0 0 1 0 0 0 19 0 0 0 0 0 0 Page 23 of 27von Westenholz et al. Applied Network Science (2025) 10:35 q0 t1 ( p1 )= i 0 p· ( tp−t0 )=5 0 · (5 / 5 − 13 / 20) = 7 / 20, q 0 t1(p2)=4 0·(4/4−13/20) = 7/20, q 0 t1(p3)=9 0·(5/9−13/20) = 17/180, q 0 t2(p4)=9 0·(5/9−7/20) = 37/180, q 0 t2(p5)=1 0·(1 −7/20) = 13/20, q 0 t2 (p6)=1 0 · (1 − 7/20) = 13/20. Thus, the (1,1)-degree centrality is as good as the (2,2)-degree centrality, and they have both a higher quality than the (3,3)-degree centrality, with respect to the pattern t1 and the chosen quality function. The (2,2)-degree centrality is as good as the (3,3)-degree centrality and they have both a higher quality than the (1,1)-degree centrality with respect to the pattern t2 and q0 t2 . Hence, p=2 is the best choice for considering a simplicial degree centrality feature pattern of only length 1, given the described setup. The features in (ii) are considered in Table 2. Here we analyze the following patterns with respect to t1 . p1=( cE 1 σ <k 1) ,p 2=( cE 2 σ <k 2)and p 3=( cE 3 σ <k 3) with k1=0.5,k 2=0.2and k3=2. Moreover, we investigate the following patterns with respect to t2 . p4=(c E 1 σ>l 1),p 5=(c E 2 σ>l 2)and p6=(c E 3 σ>l 3) with l1=2.5,l 2=2.5and l3=2.5. Table 2 p-eigenvector centralities Vertex c( E 1) c( E 2) c( E 3) c( E 4) Attacker? Non-attacker? p1 p2 p3 p4 p5 p6 0 1.421 1.279 0.913 0.0 0 1 0 0 1 0 1 0 1 0.962 0.973 0.0 0.0 0 1 0 0 1 0 0 0 2 0.663 0.122 0.0 0.0 0 1 0 1 1 0 0 0 3 1.384 1.430 1.338 0.0 0 1 0 0 1 0 0 0 4 1.442 1.455 0.0 0.0 1 0 0 0 1 0 0 0 5 0.648 0.661 0.0 0.0 0 1 0 0 1 0 0 0 6 0.298 0.0 0.0 0.0 0 1 1 1 1 0 0 0 7 1.564 1.617 1.760 0.0 0 1 0 0 1 0 0 0 8 1.935 1.962 2.134 0.0 0 1 0 0 0 0 0 0 9 0.908 0.384 0.0 0.0 1 0 0 0 1 0 0 0 10 0.421 0.0 0.0 0.0 0 1 1 1 1 0 0 0 11 1.828 1.803 1.564 0.0 0 1 0 0 1 0 0 0 12 1.643 1.640 1.299 0.0 1 0 0 0 1 0 0 0 13 2.380 2.336 2.293 0.0 0 1 0 0 0 0 0 0 14 0.772 0.617 0.0 0.0 1 0 0 0 1 0 0 0 15 1.601 1.514 1.475 0.0 1 0 0 0 1 0 0 0 16 1.321 1.362 1.238 0.0 0 1 0 0 1 0 0 0 17 2.816 2.772 2.565 0.0 1 0 0 0 0 1 1 1 18 1.014 0.384 0.0 0.0 1 0 0 0 1 0 0 0 19 1.187 1.244 1.381 0.0 0 1 0 0 1 0 0 0 Page 24 of 27von Westenholz et al. Applied Network Science (2025) 10:35 Here the chosen k1,k 2,k 3 and l1,l 2,l 3 deliver the best quality values with respect to q0 t1 and q0 t2 . These numbers are not unique with this property. e.g.,for l3 one can also choose 2.4. It is not helpful to consider eigenvector centralities for p≥4 for the modified congress network, since then the eigenvector centralities are 0 for all vertices (see Table2 for examples). Thus, it is not possible to use such p≥4 to create patterns for distinguishing attackers and non-attackers. A computation yields q0 t1 ( p1 )=2 0 · (2 / 2 − 13 / 20) = 7 / 20 , q 0 t1(p2)=3 0·(3/3−13/20) = 7/20, q 0 t1(p3) = 170·(12/17 −13/20) = 19/340 , q 0 t2(p4)=1 0·(1/1−7/20) = 13/20, q 0 t2(p5)=1 0·(1/1−7/20) = 13/20, q 0 t2 (p 6 )=1 0 · (1/1 − 7/20) = 13/20. Thus, the 1-eigenvector centrality is as good as the 2-eigenvector centrality, and they have both a higher quality than the 3-eigenvector centrality with respect to the pattern t1 and the chosen quality function. The 1-eigenvector centrality is as useful as the 2-eigenvector centrality and the 3-eigenvector centrality with respect to the pattern t2 . So, in total, the eigenvector-centralities for p=1 and p=2 are the best choices regarding the simplicial-eigenvector-feature-patterns of length 1. For (iii) only features for c C 1 σ are considered, since the closeness centrality measure is always 0 for other p, see Table 3. The best quality for characterizing non-attackers (target t1 ) is achieved with the pattern p1=(c C 1 σ<0.024). Table 3 p-closeness centralities Vertex Attacker? Non-attacker? c C 1 p1 p2 0 0 1 0.029 1 0 1 1 0 0.026 0 0 2 1 0 0.025 0 0 3 0 1 0.028 1 0 4 0 1 0.028 1 0 5 1 0 0.023 0 1 6 1 0 0.02 0 1 7 1 0 0.029 1 0 8 1 0 0.031 1 0 9 1 0 0.027 1 0 10 1 0 0.023 0 1 11 1 0 0.032 1 0 12 0 1 0.030 1 0 13 1 0 0.036 1 0 14 1 0 0.024 0 0 15 0 1 0.031 1 0 16 1 0 0.028 1 0 17 1 0 0.039 1 0 18 0 1 0.029 1 0 19 1 0 0.025 1 0 Page 25 of 27von Westenholz et al. Applied Network Science (2025) 10:35 Moreover, the feature p2=(c C 1 σ>0.027) has the highest quality with respect to target t2 , i.e.,for characterizing attackers. As in (ii) the chosen numbers are not unique with respect to this property. More precisely, p1 and p2 have the following quality values. q0 t1 ( p1 )= ip· ( tp−t0 )=3 0 · (3 / 3 − 13 / 20) = 7 / 20 , q 0 t2 (p 2 )=i p· (t p− t 0 ) = 130 · (6/13 − 7/20) = 29/260 . The pattern p1 has a rather high quality and is thus useful for further investigations. The constructed feature pattern with respect to the attacker target t2 is not that beneficial, but there may be additional other possibilities for using this feature (which are not considered here in this manuscript), like combining it with other features in longer patterns. Observe that, in contrast to (i) and (ii), in (iii) for the modified congress network, it was not possible to construct helpful simplicial features of complexes of higher dimensions than 1, but only graph-based features using the closeness centrality. In consequence, it would be reasonable to consider here in the future other networks, where there might be a denser structure for higher dimensional simplices to find vertices that have non-zero p-closeness centrality for p>1 . Remark 5.8 To avoid the synthetic data used in this section one has to record non-trivial real intrusion data, which contains not only the attacks, but also the interaction inbetween groups of attackers and of attacked IP-addresses. This is left as an future research problem. Outlook In this work we applied simplicial complexes for detecting higher-order patterns as simplicial-based patterns, in the context of network intrusion detection settings. In Section 5 we considered a synthetic data set and assessed how good the considered simplicial feature patterns worked for it. In the following we outline perspectives on further eligible strategies to evaluate the usage of simplicial-based patterns for describing targets, e.g.,to differentiate attacker and non-attackers in networks based on real data. There are several options to continue the investigations from our work, including the following. (i) Using various (further) datasets to analyze the utility of simplicial feature patterns. For this it is reasonable to vary synthetic or real large or small data as well as data from different application domains. (ii) Constructing patterns that use more simplicial complex features at once. It is reasonable to consider patterns that have length >1 to study further centrality measures which were not yet mentioned in this manuscript. (iii) Equipping simplicial patterns with further features which are not originating from simplicial centrality measures. It is also possible to construct further features from one given centrality measure by using new conditions. In the following we provide some examples for the latter suggestion.